XSS, Cross Site Scripting in www.shopping.com, 01142012-01, CWE-79, CAPEC-86, Report
Netsparker - Scan Report Summary
|
|
|
Total Requests
162
Average Speed
3.91
req/sec.
|
4
identified
1
confirmed
0
critical
0
informational
|
SCAN SETTINGS
Scan Settings
|
|
PROFILE
|
Previous Settings
|
|
ENABLED ENGINES
|
Static Tests, Find Backup Files, Blind Command Injection, Blind SQL Injection, Boolean SQL Injection, Command Injection, HTTP Header Injection, Local File Inclusion, Open Redirection, Remote Code Evaluation, Remote File Inclusion, SQL Injection, Cross-site Scripting
|
|
Authentication
Scheduled
|
VULNERABILITIES
Vulnerabilities
|
|
|
|
VULNERABILITY SUMMARY
Vulnerability Summary
|
|
|
[Possible] Permanent Cross-site Scripting
[Possible] Permanent Cross-site Scripting
Permanent XSS (Cross-site Scripting) allows an attacker to execute dynamic scripts (Javascript, VbScript) in the context of the application. This allows several different attack opportunities, mostly hijacking the current session of the user or changing the look of the page by changing the HTML on the fly and to steal the user's credentials. This happens because the input entered by the user has been interpreted by HTML/Javascript/VbScript within the browser.
Permanent means that the attack will be stored in the back-end system. In normal XSS attacks an attack needs to e-mail the victim but in a permanent XSS an attacker can just execute the attack and wait for users to see the affected page. As soon as someone visits the page, the attacker's stored payload will get executed.
XSS targets the users of the application instead of the server. Although this is a limitation, since it only allows attackers to hijack other users' session the attacker might attack an administrator to gain full control over the application.
Impact
Permanent XSS is a dangerous issue that has many exploitation vectors, some of which includes:
- User session sensitive information such as cookies can be stolen.
- XSS can enable client-side worms which could modify, delete or steal other users' data within the application.
- The website can be redirected to a new location, defaced or used as a phishing site.
The issue occurs because the browser interprets the input as active HTML, Javascript or VbScript. To avoid this, all input and output from the application should be filtered. Output should be filtered according to the output format and location. Typically the output location is HTML. Where the output is HTML ensure that all active content is removed prior to its presentation to the server.
Prior to sanitizing user input, ensure you have a pre-defined list of both expected and acceptable characters with which you populate a white-list. This list needs only be defined once and should be used to sanitize and validate all subsequent input.
There are a number of pre-defined, well structured white-list libraries available for many different environments, good examples of these include, OWASP Reform and Microsoft Anti Cross-site Scripting libraries are good examples.
Remedy References
External References
Classification
|
- /bushnell-backtrack/info
|
http://www.shopping.com/bushnell-backtrack/info?linkin_id=%3C/a%20style=x:expre/**/ssion(netsparker(0x00001B))%3E
Injection Request
GET /bushnell-backtrack/info?linkin_id=%3C/a%20style=x:expre/**/ssion(netsparker(0x00001B))%3E HTTP/1.1
Referer: http://www.shopping.com/bushnell-backtrack/info
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Cache-Control: no-cache
Host: www.shopping.com
Cookie: JSESSIONID=D1107028605DBCEA4D4E1476DF45EA9B; btc=www.shopping.com; session=LI%3D2455-ping%2520-c%252026%2520127.0.0.1%2520%2526%5Ervi%3D111963271%255EBushnell%2520BACKTRACK%2520GPS%2520Receiver%255E44.95%255Ebushnell-backtrack%255E1325740829374%2521%253A%2521%5EPVS%3D13%5ESRID%3DJk9yLgRvun%5Ets%3D1; reloadCheck=%2Fbushnell-backtrack%2Finfo%3Flinkin_id%3Dping%2520-c%252026%2520127.0.0.1%2520%2526http%3A%2F%2Fwww.shopping.com%2Fbushnell-backtrack%2Finfo; pdscookie=0%3A%3A%3A%3A%3A%3A1398%3A%3A%3A%3A111963271%3A%3A%3A%3A%3A%3A%3A%3A2%3A%3A1; perm=countryCode%3Dus; DealTimeUserID=AN6pakQkMT
Accept-Encoding: gzip, deflate
Identification Request
GET /bushnell-backtrack/info?lt;/a%20style=x:expre/**/ssion(netsparker(0x00001B))%3E&linkin_id=8068691 HTTP/1.1
Referer: http://www.shopping.com/bushnell-backtrack/info?linkin_id=%3C/a%20style=x:expre/**/ssion(netsparker(0x00001B))%3E
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Cache-Control: no-cache
Host: www.shopping.com
Cookie: JSESSIONID=DC46900DA47474530160BC12EE01E0A0; btc=www.shopping.com; session=LI%3D2455-data%253A%253Bbase64%252CTlM3NzU0NTYxNDQ2NTc1%5Ervi%3D111963271%255EBushnell%2520BACKTRACK%2520GPS%2520Receiver%255E44.95%255Ebushnell-backtrack%255E1325740841758%2521%253A%2521%5EPVS%3D26%5ESRID%3Df8s7HWMfTu%5Ets%3D1; reloadCheck=%2Fbushnell-backtrack%2Finfo%3Flinkin_id%3Ddata%253A%253Bbase64%252CTlM3NzU0NTYxNDQ2NTc1http%3A%2F%2Fwww.shopping.com%2Fbushnell-backtrack%2Finfo; pdscookie=0%3A%3A%3A%3A%3A%3A1398%3A%3A%3A%3A111963271%3A%3A%3A%3A%3A%3A%3A%3A2%3A%3A1; perm=countryCode%3Dus; DealTimeUserID=AN6pakQkMT
Accept-Encoding: gzip, deflate
Proxy-Connection: Keep-Alive
Injection Response
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=CBD5E34161CD6A46CE2A8A65008AFF4D; Path=/,session=LI%3D2455-%2526lt%253B%252Fa%2520style%253Dx%253Aexpre%252F**%252Fssion%2528netsparker%25280x00001B%2529%2529%2526gt%253B%5Ervi%3D111963271%255EBushnell%2520BACKTRACK%2520GPS%2520Receiver%255E44.95%255Ebushnell-backtrack%255E1325740830839%2521%253A%2521%5EPVS%3D14%5ESRID%3Dgll3O0bf1D%5Ets%3D1; Domain=.shopping.com; Path=/,reloadCheck=%2Fbushnell-backtrack%2Finfo%3Flinkin_id%3D%26lt%3B%2Fa%2520style%3Dx%3Aexpre%2F**%2Fssion%28netsparker%280x00001B%29%29%26gt%3Bhttp%3A%2F%2Fwww.shopping.com%2Fbushnell-backtrack%2Finfo; Domain=.shopping.com; Path=/,pdscookie=0%3A%3A%3A%3A%3A%3A1398%3A%3A%3A%3A111963271%3A%3A%3A%3A%3A%3A%3A%3A2%3A%3A1; Domain=.shopping.com; Path=/,perm=countryCode%3Dus; Domain=.shopping.com; Expires=Tue, 04-Jan-2022 05:20:30 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Vary: Accept-Encoding
Date: Thu, 05 Jan 2012 05:20:30 GMT
Connection: close
Content-Length: 124879
Identification Response
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=EC11E53118771A3D83BFE07C5753AAA6; Path=/,session=LI%3D2455-8068691%5Ervi%3D111963271%255EBushnell%2520BACKTRACK%2520GPS%2520Receiver%255E44.95%255Ebushnell-backtrack%255E1325740845279%2521%253A%2521%5EPVS%3D27%5ESRID%3Dx2npbYeQnI%5Ets%3D1; Domain=.shopping.com; Path=/,reloadCheck=%2Fbushnell-backtrack%2Finfo%3Flt%3B%2Fa%2520style%3Dx%3Aexpre%2F**%2Fssion%28netsparker%280x00001B%29%29%26gt%3B%26linkin_id%3D8068691http%3A%2F%2Fwww.shopping.com%2Fbushnell-backtrack%2Finfo%3Flinkin_id%3D%253C%2Fa%2520style%3Dx%3Aexpre%2F**%2Fssion%28netsparker%280x00001B%29%29%253E; Domain=.shopping.com; Path=/,pdscookie=0%3A%3A%3A%3A%3A%3A1398%3A%3A%3A%3A111963271%3A%3A%3A%3A%3A%3A%3A%3A2%3A%3A1; Domain=.shopping.com; Path=/,perm=countryCode%3Dus; Domain=.shopping.com; Expires=Tue, 04-Jan-2022 05:20:45 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Vary: Accept-Encoding
Date: Thu, 05 Jan 2012 05:20:44 GMT
Connection: close
Content-Length: 124060
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xml:lang="en" lang="en"><head><script>var debugStartTime = new Date().getTime();var clogd = false; // console log debug levelfunction debugGetTimeDelta() {return new Date().getTime() - debugStartTime;}function consoleLog(msg) {if (typeof(console) != "undefined" && clogd) {console.log(debugGetTimeDelta() + " " + msg);}}function consoleLogNoTime(msg) {if (typeof(console) != "undefined" && clogd) {console.log(msg);}}</script><script>function appendScriptToHead(scriptUri) {var a = document.createElement("script");a.type="text/javascript";document.getElementsByTagName("head")[0].appendChild(a);a.src= scriptUri;}consoleLog("pagetype [ productOverview ]");consoleLog("sitespeedv2 [ YES ]");</script><meta http-equiv="X-UA-Compatible" content="IE=7" /><meta http-equiv="content-type" content="text/html; charset=UTF-8"/><meta http-equiv="Content-language" content="en"/><title>Bushnell BACKTRACK GPS Receiver - GPS Devices - Product Reviews and Prices - Shopping.com</title><meta name="title" content="Bushnell BACKTRACK GPS Receiver - GPS Devices - Product Reviews and Prices - Shopping.com"/><meta name="description" content="Bushnell BACKTRACK Overview, Features, and Description. Bushnell 360053 GPS BackTrack Personal Locator Tech Gray. - Store and locate up to 3 locations. - Provides distance and direction back. - Utilizes the latest technology. - High-sensitivity SiRF&#174; Star III GPS receiver. - Self-calibrating digital compass. - Weather resistant. - Operates on 2 AAA batteries (not included). - Compact size stores easily in your pocket or purse. - Lanyard included for easy attachment. This Bundle Also Includes : - Digital Point and Shoot Case. - Duracell AAA Alkaline Battery Retail Pack.."/><meta name="KEYWORDS" content="Bushnell BACKTRACK GPS Receiver, , GPS Devices, Handheld Electronics, Electronics, Shopping.com"/><meta name="SKYPE_TOOLBAR" content="SKYPE_TOOLBAR_PARSER_COMPATIBLE" /><meta name="robots" content="NOODP" /><meta name="msvalidate.01" content="D3229F8896DA563A3B0BED38FF19D6BC"/><meta name="y_key" content="7bca370a0704da9e"/><link rel="SHORTCUT ICON" type="image/x-icon" href="/favicon.ico"/><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/build/global-productPages-US-all-min.css"/><script>var gTopJsFileName = "singleModelPage-US-all-min.js";</script><script type="text/javascript" src="http://img.shopping.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/js/singleModelPage-US-all-min.js"></script><!--[if IE]><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/sdc/sdcIe.css"/><![endif]--><!--[if IE 6]><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/sdc/sdcIe6.css"/><![endif]--><script type="text/javascript">var showTooltipFeature = false;var domain = ".shopping.com";var RecaptchaOptions = {theme : 'custom'};var pageDataLocale = "en_US"; var brandPop2ndOffset = 30;var brandTopArrow2ndOffset = 20;var brandBtmArrow2ndOffset = 0; var gOmnitureEnabled = true;var gOmnitureEnv = "shopping";var glogd = false;var gloga = false; // localized url suffixvar UrlSuffix = {PRODUCTS:'products',INFO:'info',REVIEWS:'reviews',PRICES:'prices',LISTS:'lists',PRICE_ALERTS:'pricealerts'};var gIsSuffixedUrl = true;var gSearchPageTypePrefix = '';var LocalizedText = {searchQuestion: 'What are you shopping for?' };var fbConnectApiKey = '352830106610';var omniture_env = 'shopping';var omniPageName = 'Product Overview (PSPO)';var matchedReviewPublishToFb = 'false';var matchedSpotlightPublishToFb = 'false';var adsLazyLoadLevel = 'BELOW_FOLD'; var isSN;var userId;var userName;var visibility;var clientSiteId = '1';var fb_loggedInUser;var sameSes;var fb_session_key;var fb_session_secret;var fbSessionSession;var fbConnectStatusEnum = {'Disconnected':'0','Connected_Confirm_Publish':'1','Connected_Auto_Publish':'2','Connected_No_Publish':'3'};isSN=0;var browserWidthCookie = false;var VisualSearch = {title: 'Similar Items' };var Comments = {total: 'Comments' };</script><link rel="canonical" id="canonical" href="http://www.shopping.com/bushnell-backtrack/info?lt;/a%20style=x:expre/**/ssion(netsparker(0x00001B))>"/> <script type="text/javascript">var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-23132118-1']);_gaq.push(['_setDomainName', '.shopping.com']);_gaq.push(['_trackPageview']);_gaq.push(['_trackPageLoadTime']);(function() {consoleLog("google analytics");var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body id="productOverview"> <div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;" ></div><div id="emailShareMask"></div><script type="text/javascript">function cguidJsonpCallback(resp) {consoleLog("cguid jsonp callback ["+resp.data+"]");setPdsAttributeEbayData(resp.data);}if (typeof(deferredFunctions) != "undefined") {$(window).load(function() {//consoleLog("STAGING - no cguid pds call");jQuery.getJSON("http://rover.ebay.com/idmap/1?pid=ussdc&site=0&psv=&m=1325740845281&callback=?");});} else {//consoleLog("STAGING - no cguid pds call");jQuery.getJSON("http://rover.ebay.com/idmap/1?pid=ussdc&site=0&psv=&m=1325740845281&callback=?");}</script><script type="text/javascript">consoleLog("pdsAttributeData (server) []");</script><script>consoleLog("votf");</script><div class="hide"><script type="text/javascript"><!--abc = Math.random() + '';pixelUrl = "http://stat.dealtime.com/pixel/" + abc.substring(2,11) + "?" + "PV_NmWlDs=&PV_PgVwID=W8JiGzkXg9&PV_BrnID=2455&PV_FrmID=1398&PV_EvnTyp=PV%5ERRW%5EDS&PV_SrvPgTyp=PSPO&PV_LI_LnkInID=8068691&PV_LI_IsLnkInID=Y&PV_HTTPTrg=%2Fbushnell-backtrack%2Finfo&PV_LI_PrtTrm=&PV_LI_SbmKyw=&PV_StBhvID=1&PV_ErrCd=&PV_DmnUsr=AN6pakQkMT&PV_SrvDsp=&PV_SrvRsl=&PV_DspStLng=1&PV_TstCnfId=&PV_Cmt_MmbID=&PV_Cmt_SgnIn=0&PV_Cmt_CntTypID=8&PV_Cmt_CntID=&PV_PrdID=111963271&DS_DlSrcID=x2npbYeQnI&DS_ClkLnkTyp=&DS_PrdID=111963271&DS_PrcMn=44.95&DS_PrcMx=99&DS_NmbMrcInPg=0&DS_NmbRslDls=25&DS_NmFtrDls=0&DS_IsSmrBy=1&PV_HTTPRfr=http%3A%2F%2Fwww.shopping.com%2Fbushnell-backtrack%2Finfo%3Flinkin_id%3D%253C%2Fa%2520style%3Dx%3Aexpre%2F**%2Fssion%28netsparker%280x00001B%29%29%253E&PV_WbSrvRqsTms=01%2F05%2F12%2012%3A20%3A45%20AM&PV_HTTPQryStr=lt%3B%2Fa%2520style%3Dx%3Aexpre%2F**%2Fssion%28netsparker%280x00001B%29%29%26gt%3B%26linkin_id%3D8068691&PV_WghGrpID=1&PV_NvgGrpID=1&PV_WbSrvIP=10.59.9.92&PV_LI_RslFrmID=1398&DS_FrDlsAvl=0&DS_FrDlsFlt=0&DS_FrDlsDsp=0&DS_FrMrcDsp=0&DS_FrMrcFlt=0&DS_MxDlsDsp=0&DS_UsrActTyp=DD&DS_RslPgNmb=1&DS_MnfID=12702&DS_MrcInPg=448775%5E300751%5E301531%5E40085%5E301531%5E301531%5E448775%5E301531%5E448775%5E40085%5E448775%5E448775%5E448775%5E448775%5E332196%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E448775%5E464756&DS_NmbTrsMrc=13&DS_NmbAthRsl=0&DS_NmbMrcGrp=0&DS_NmbDlsInPg=0&DS_FrsRslNmb=1&DS_LstRslNmb=0&RRW_NmRslRvw=0&RRW_PrdID=111963271&PV_ClkLnkTyp=&PV_DspDlsLng=&PV_LI_SbmFrmID=&PV_LI_SbmPrd=&PV_LI_RslKyw=&PV_LI_RslPrd=&PV_ChnPgNm=&PV_HPMrcNm=&DS_Zp=&DS_DlSrcKyw=&DS_IsSkp=&DS_SkpFrmEvn=&DS_SkpRt=&DS_CtgRnk=&DS_CtgRnkAlg=&DS_PrdTyp=&DS_MtQry=&RRW_MrchID=&RRW_RvwID=";document.write('<img src="' + pixelUrl + '" width="2" height="2" alt=""/>');//--></script><noscript><p class="abso"><img src="http://stat.dealtime.com/pixel/noscript?PV_NmWlDs=&PV_PgVwID=W8JiGzkXg9&PV_BrnID=2455&PV_FrmID=1398&PV_EvnTyp=PV%5ERRW%5EDS&PV_SrvPgTyp=PSPO&PV_LI_LnkInID=8068691&PV_LI_IsLnkInID=Y&PV_HTTPTrg=%2Fbushnell-backtrack%2Finfo&PV_LI_PrtTrm=&PV_LI_SbmKyw=&PV_StBhvID=1&PV_ErrCd=&PV_DmnUsr=AN6pakQkMT&PV_SrvDsp=&PV_SrvRsl=&PV_DspStLng=1&PV_TstCnfId=&PV_Cmt_MmbID=&PV_Cmt_SgnIn=0&PV_Cmt_CntTypID=8&PV_Cmt_CntID=&PV_PrdID=111963271&DS_DlSrcID=x2npbYeQnI&DS_ClkLnkTyp=&DS_PrdID=111963271&DS_PrcMn=44.95&DS_PrcMx=99&DS_NmbMrcInPg=0&DS_NmbRslDls=25&DS_NmFtrDls=0&DS_IsSmrBy=1&PV_HTTPRfr=http%3A%2F%2Fwww.shopping.com%2Fbushnell-backtrack%2Finfo%3Flinkin_id%3D%253C%2Fa%2520style%3Dx%3Aexpre%2F**%2Fssion%28netsparker%280x00001B%29%29%253E&PV_WbSrvRqsTms=01%2F05%2F12%2012%3A20%3A45%20AM&PV_HTTPQryStr=lt%3B%2Fa%2520style%3Dx%3Aexpre%2F**%2Fssion%28netsparker%280x00001B%29%29%26gt%3B%26linkin_id%3D8068691&PV_WghGrpID=1&PV_NvgGrpID=1&PV_WbSrvIP=10.59.9.92&PV_LI_RslFrmID=1398&DS_FrDlsAvl=0&DS_FrDlsFlt=0&DS_FrDlsDsp=0&DS_FrMrcDsp=0&DS_FrMrcFlt=0&DS_MxDlsDsp=0&DS_UsrActTyp=DD&DS_RslPgNmb=1&DS_MnfID=12702&DS_MrcInPg=448775%5E300751%5E301531%5E40085%5E301531%5E301531%5E448775%5E301531%5E448775%5E40085%5E448775%5E448775%5E448775%5E448775%5E332196%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E448775%5E464756&DS_NmbTrsMrc=13&DS_NmbAthRsl=0&DS_NmbMrcGrp=0&DS_NmbDlsInPg=0&DS_FrsRslNmb=1&DS_LstRslNmb=0&RRW_NmRslRvw=0&RRW_PrdID=111963271&PV_ClkLnkTyp=&PV_DspDlsLng=&PV_LI_SbmFrmID=&PV_LI_SbmPrd=&PV_LI_RslKyw=&PV_LI_RslPrd=&PV_ChnPgNm=&PV_HPMrcNm=&DS_Zp=&DS_DlSrcKyw=&DS_IsSkp=&DS_SkpFrmEvn=&DS_SkpRt=&DS_CtgRnk=&DS_CtgRnkAlg=&DS_PrdTyp=&DS_MtQry=&RRW_MrchID=&RRW_RvwID=" width="2" height="2" alt="" /></p></noscript></div><div class="intScr intScrWide"><table id="topLeaderBoardArea" cellspacing="0" cellpadding="0" class="genAdBanner" align="center"><tr><td align="center"> <iframe id="doubleClickAds1" name="doubleClickAds1" class="adContainer" src="about:blank" width="728" height="90" marginwidth="0" marginheight="0" frameborder="0" scrolling="no" allowtransparency="true"></iframe><a class="adChoice hide" onclick="adSensePopUp('http://cgi6.ebay.com/ws/eBayISAPI.dll?AdPreferenceInterstitialPopup&partner=2');" href="javascript:void(0);">AdChoice<span class="sdcSprite iAdChoice"></span></a></td></tr></table><div class="innerScr"><div id="navigation"><div class="navInner"><ul id="outerNav"><li class="last" ><div class="ieFilterWrap"><a ><span class="tabText">Shop By Department</span><span class="sdcSprite iNavArrowDown"></span></a></div><ul class="mainNav"><li><a href="/xCH-clothing_and_accessories" target="_top"><span class="tabText">Clothing</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/clothing/181007-women/products" target="_top">Women</a></li><li><a href="/clothing/10089-men/products" target="_top">Men</a></li><li><a href="/clothing/ap-gender-age-girls/products" target="_top">Girls</a></li><li><a href="/clothing/ap-gender-age-boys/products" target="_top">Boys</a></li><li><a href="/clothing/ap-gender-age-infants-and-toddlers/products" target="_top">Infants and Toddlers</a></li><li><a href="/xCH-clothing_and_accessories" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/shoes/products" target="_top"><span class="tabText">Shoes</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/shoes/sh-gender-and-age-womens/products" target="_top">Womens</a></li><li><a href="/shoes/sh-gender-and-age-mens/products" target="_top">Mens</a></li><li><a href="/shoes/sh-gender-and-age-infants-and-toddlers/products" target="_top">Kids</a></li><li><a href="/shoes/products" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-computers" target="_top"><span class="tabText">Computers</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/cartridges-and-toners/products" target="_top">Cartridges and Toners</a></li><li><a href="/memory-cards/products" target="_top">Flash Memory</a></li><li><a href="/monitors/products" target="_top">Monitors</a></li><li><a href="/laptops/products" target="_top">PC Laptops</a></li><li><a href="/pdas/products" target="_top">PDAs</a></li><li><a href="/printers/products" target="_top">Printers</a></li><li><a href="/xCH-software" target="_top">Software</a></li><li><a href="/xCH-computers" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-electronics" target="_top"><span class="tabText">Electronics</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/camcorders/products" target="_top">Camcorders</a></li><li><a href="/cellular-phones/products" target="_top">Cellular Phones</a></li><li><a href="/digital-cameras/products" target="_top">Digital Cameras</a></li><li><a href="/gps-devices/products" target="_top">GPS Devices</a></li><li><a href="/mp3-players/products" target="_top">MP3 Players</a></li><li><a href="/flat-panel-televisions/products" target="_top">Flat Panel Televisions</a></li><li><a href="/home-theater-speakers-and-subwoofers/products" target="_top">Speakers and Subwoofers</a></li><li><a href="/sc/buying-guides" target="_top">Buying Guides</a></li><li><a href="/xCH-electronics" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-home_and_garden" target="_top"><span class="tabText">At Home</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/furniture/products" target="_top">Furniture</a></li><li><a href="/garden/products" target="_top">Garden</a></li><li><a href="/home-furnishing/products" target="_top">Home Furnishings</a></li><li><a href="/xCH-homeandgarden_kitchen" target="_top">Kitchen</a></li><li><a href="/xCH-pets" target="_top">Pet Supplies</a></li><li><a href="/building-supplies/products" target="_top">Building Supplies</a></li><..
Cookie Not Marked As HttpOnly
Cookie Not Marked As HttpOnly
Cookie was not marked as HTTPOnly. HTTPOnly cookies can not be read by client-side scripts therefore marking a cookie as HTTPOnly can provide an additional layer of protection against Cross-site Scripting attacks..
Impact
During a Cross-site Scripting attack an attacker might easily access cookies and hijack the victim's session.
Actions to Take
- See the remedy for solution
- Consider marking all of the cookies used by the application as HTTPOnly (After these changes javascript code will not able to read cookies.
Mark the cookie as HTTPOnly. This will be an extra layer of defence against XSS. However this is not a silver bullet and will not protect the system against Cross-site Scripting attacks. An attacker can use a tool such as
XSS Tunnel to bypass HTTPOnly protection.
External References
Classification
|
- /bushnell-backtrack/info
|
JSESSIONID
Request
GET /bushnell-backtrack/info?linkin_id=8068691 HTTP/1.1
Referer: http://www.shopping.com/bushnell-backtrack/info
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Cache-Control: no-cache
Host: www.shopping.com
Cookie: JSESSIONID=E2BEBA278135C8ED13E896434CFAF8F4; btc=www.shopping.com; session=rvi%3D111963271%255EBushnell%2520BACKTRACK%2520GPS%2520Receiver%255E44.95%255Ebushnell-backtrack%255E1325740811188%2521%253A%2521%5ESRID%3DXUM74HHbNw%5EPVS%3D1%5Ets%3D2; reloadCheck=%2Fbushnell-backtrack%2Finfonull; pdscookie=0%3A%3A%3A%3A%3A%3A1398%3A%3A%3A%3A111963271%3A%3A%3A%3A%3A%3A%3A%3A2%3A%3A1; perm=countryCode%3Dus; DealTimeUserID=TedzfFljOr
Accept-Encoding: gzip, deflate
Response
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=96ACB36FC192F5A80AFC4572AD272055; Path=/,session=LI%3D2455-8068691%5Ervi%3D111963271%255EBushnell%2520BACKTRACK%2520GPS%2520Receiver%255E44.95%255Ebushnell-backtrack%255E1325740812301%2521%253A%2521%5ESRID%3DFJQguw0eKa%5EPVS%3D2%5Ets%3D2; Domain=.shopping.com; Path=/,reloadCheck=%2Fbushnell-backtrack%2Finfo%3Flinkin_id%3D8068691http%3A%2F%2Fwww.shopping.com%2Fbushnell-backtrack%2Finfo; Domain=.shopping.com; Path=/,pdscookie=0%3A%3A%3A%3A%3A%3A1398%3A%3A%3A%3A111963271%3A%3A%3A%3A%3A%3A%3A%3A2%3A%3A1; Domain=.shopping.com; Path=/,perm=countryCode%3Dus; Domain=.shopping.com; Expires=Tue, 04-Jan-2022 05:20:12 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Vary: Accept-Encoding
Date: Thu, 05 Jan 2012 05:20:12 GMT
Connection: close
Content-Length: 123588
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xml:lang="en" lang="en"><head><script>var debugStartTime = new Date().getTime();var clogd = false; // console log debug levelfunction debugGetTimeDelta() {return new Date().getTime() - debugStartTime;}function consoleLog(msg) {if (typeof(console) != "undefined" && clogd) {console.log(debugGetTimeDelta() + " " + msg);}}function consoleLogNoTime(msg) {if (typeof(console) != "undefined" && clogd) {console.log(msg);}}</script><script>function appendScriptToHead(scriptUri) {var a = document.createElement("script");a.type="text/javascript";document.getElementsByTagName("head")[0].appendChild(a);a.src= scriptUri;}consoleLog("pagetype [ productOverview ]");consoleLog("sitespeedv2 [ YES ]");</script><meta http-equiv="X-UA-Compatible" content="IE=7" /><meta http-equiv="content-type" content="text/html; charset=UTF-8"/><meta http-equiv="Content-language" content="en"/><title>Bushnell BACKTRACK GPS Receiver - GPS Devices - Product Reviews and Prices - Shopping.com</title><meta name="title" content="Bushnell BACKTRACK GPS Receiver - GPS Devices - Product Reviews and Prices - Shopping.com"/><meta name="description" content="Bushnell BACKTRACK Overview, Features, and Description. Bushnell 360053 GPS BackTrack Personal Locator Tech Gray. - Store and locate up to 3 locations. - Provides distance and direction back. - Utilizes the latest technology. - High-sensitivity SiRF&#174; Star III GPS receiver. - Self-calibrating digital compass. - Weather resistant. - Operates on 2 AAA batteries (not included). - Compact size stores easily in your pocket or purse. - Lanyard included for easy attachment. This Bundle Also Includes : - Digital Point and Shoot Case. - Duracell AAA Alkaline Battery Retail Pack.."/><meta name="KEYWORDS" content="Bushnell BACKTRACK GPS Receiver, , GPS Devices, Handheld Electronics, Electronics, Shopping.com"/><meta name="SKYPE_TOOLBAR" content="SKYPE_TOOLBAR_PARSER_COMPATIBLE" /><meta name="robots" content="NOODP" /><meta name="msvalidate.01" content="D3229F8896DA563A3B0BED38FF19D6BC"/><meta name="y_key" content="7bca370a0704da9e"/><link rel="SHORTCUT ICON" type="image/x-icon" href="/favicon.ico"/><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/build/global-productPages-US-all-min.css"/><script>var gTopJsFileName = "singleModelPage-US-all-min.js";</script><script type="text/javascript" src="http://img.shopping.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/js/singleModelPage-US-all-min.js"></script><!--[if IE]><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/sdc/sdcIe.css"/><![endif]--><!--[if IE 6]><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/sdc/sdcIe6.css"/><![endif]--><script type="text/javascript">var showTooltipFeature = false;var domain = ".shopping.com";var RecaptchaOptions = {theme : 'custom'};var pageDataLocale = "en_US"; var brandPop2ndOffset = 30;var brandTopArrow2ndOffset = 20;var brandBtmArrow2ndOffset = 0; var gOmnitureEnabled = true;var gOmnitureEnv = "shopping";var glogd = false;var gloga = false; // localized url suffixvar UrlSuffix = {PRODUCTS:'products',INFO:'info',REVIEWS:'reviews',PRICES:'prices',LISTS:'lists',PRICE_ALERTS:'pricealerts'};var gIsSuffixedUrl = true;var gSearchPageTypePrefix = '';var LocalizedText = {searchQuestion: 'What are you shopping for?' };var fbConnectApiKey = '352830106610';var omniture_env = 'shopping';var omniPageName = 'Product Overview (PSPO)';var matchedReviewPublishToFb = 'false';var matchedSpotlightPublishToFb = 'false';var adsLazyLoadLevel = 'BELOW_FOLD'; var isSN;var userId;var userName;var visibility;var clientSiteId = '1';var fb_loggedInUser;var sameSes;var fb_session_key;var fb_session_secret;var fbSessionSession;var fbConnectStatusEnum = {'Disconnected':'0','Connected_Confirm_Publish':'1','Connected_Auto_Publish':'2','Connected_No_Publish':'3'};isSN=0;var browserWidthCookie = false;var VisualSearch = {title: 'Similar Items' };var Comments = {total: 'Comments' };</script><link rel="canonical" id="canonical" href="http://www.shopping.com/bushnell-backtrack/info"/> <script type="text/javascript">var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-23132118-1']);_gaq.push(['_setDomainName', '.shopping.com']);_gaq.push(['_trackPageview']);_gaq.push(['_trackPageLoadTime']);(function() {consoleLog("google analytics");var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body id="productOverview"> <div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;" ></div><div id="emailShareMask"></div><script type="text/javascript">function cguidJsonpCallback(resp) {consoleLog("cguid jsonp callback ["+resp.data+"]");setPdsAttributeEbayData(resp.data);}if (typeof(deferredFunctions) != "undefined") {$(window).load(function() {//consoleLog("STAGING - no cguid pds call");jQuery.getJSON("http://rover.ebay.com/idmap/1?pid=ussdc&site=0&psv=&m=1325740812302&callback=?");});} else {//consoleLog("STAGING - no cguid pds call");jQuery.getJSON("http://rover.ebay.com/idmap/1?pid=ussdc&site=0&psv=&m=1325740812302&callback=?");}</script><script type="text/javascript">consoleLog("pdsAttributeData (server) []");</script><script>consoleLog("votf");</script><div class="hide"><script type="text/javascript"><!--abc = Math.random() + '';pixelUrl = "http://stat.dealtime.com/pixel/" + abc.substring(2,11) + "?" + "PV_NmWlDs=&PV_PgVwID=uG4TEC9Ic7&PV_BrnID=2455&PV_FrmID=1398&PV_EvnTyp=PV%5ERRW%5EDS&PV_SrvPgTyp=PSPO&PV_LI_LnkInID=8068691&PV_LI_IsLnkInID=Y&PV_HTTPTrg=%2Fbushnell-backtrack%2Finfo&PV_LI_PrtTrm=&PV_LI_SbmKyw=&PV_StBhvID=1&PV_ErrCd=&PV_DmnUsr=TedzfFljOr&PV_SrvDsp=&PV_SrvRsl=&PV_DspStLng=1&PV_TstCnfId=&PV_Cmt_MmbID=&PV_Cmt_SgnIn=0&PV_Cmt_CntTypID=8&PV_Cmt_CntID=&PV_PrdID=111963271&DS_DlSrcID=FJQguw0eKa&DS_ClkLnkTyp=&DS_PrdID=111963271&DS_PrcMn=44.95&DS_PrcMx=99&DS_NmbMrcInPg=0&DS_NmbRslDls=25&DS_NmFtrDls=0&DS_IsSmrBy=1&PV_HTTPRfr=http%3A%2F%2Fwww.shopping.com%2Fbushnell-backtrack%2Finfo&PV_WbSrvRqsTms=01%2F05%2F12%2012%3A20%3A12%20AM&PV_HTTPQryStr=linkin_id%3D8068691&PV_WghGrpID=1&PV_NvgGrpID=1&PV_WbSrvIP=10.59.8.51&PV_LI_RslFrmID=1398&DS_FrDlsAvl=0&DS_FrDlsFlt=0&DS_FrDlsDsp=0&DS_FrMrcDsp=0&DS_FrMrcFlt=0&DS_MxDlsDsp=0&DS_UsrActTyp=DD&DS_RslPgNmb=1&DS_MnfID=12702&DS_MrcInPg=448775%5E300751%5E301531%5E40085%5E301531%5E301531%5E448775%5E301531%5E448775%5E40085%5E448775%5E448775%5E448775%5E448775%5E332196%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E448775%5E464756&DS_NmbTrsMrc=13&DS_NmbAthRsl=0&DS_NmbMrcGrp=0&DS_NmbDlsInPg=0&DS_FrsRslNmb=1&DS_LstRslNmb=0&RRW_NmRslRvw=0&RRW_PrdID=111963271&PV_ClkLnkTyp=&PV_DspDlsLng=&PV_LI_SbmFrmID=&PV_LI_SbmPrd=&PV_LI_RslKyw=&PV_LI_RslPrd=&PV_ChnPgNm=&PV_HPMrcNm=&DS_Zp=&DS_DlSrcKyw=&DS_IsSkp=&DS_SkpFrmEvn=&DS_SkpRt=&DS_CtgRnk=&DS_CtgRnkAlg=&DS_PrdTyp=&DS_MtQry=&RRW_MrchID=&RRW_RvwID=";document.write('<img src="' + pixelUrl + '" width="2" height="2" alt=""/>');//--></script><noscript><p class="abso"><img src="http://stat.dealtime.com/pixel/noscript?PV_NmWlDs=&PV_PgVwID=uG4TEC9Ic7&PV_BrnID=2455&PV_FrmID=1398&PV_EvnTyp=PV%5ERRW%5EDS&PV_SrvPgTyp=PSPO&PV_LI_LnkInID=8068691&PV_LI_IsLnkInID=Y&PV_HTTPTrg=%2Fbushnell-backtrack%2Finfo&PV_LI_PrtTrm=&PV_LI_SbmKyw=&PV_StBhvID=1&PV_ErrCd=&PV_DmnUsr=TedzfFljOr&PV_SrvDsp=&PV_SrvRsl=&PV_DspStLng=1&PV_TstCnfId=&PV_Cmt_MmbID=&PV_Cmt_SgnIn=0&PV_Cmt_CntTypID=8&PV_Cmt_CntID=&PV_PrdID=111963271&DS_DlSrcID=FJQguw0eKa&DS_ClkLnkTyp=&DS_PrdID=111963271&DS_PrcMn=44.95&DS_PrcMx=99&DS_NmbMrcInPg=0&DS_NmbRslDls=25&DS_NmFtrDls=0&DS_IsSmrBy=1&PV_HTTPRfr=http%3A%2F%2Fwww.shopping.com%2Fbushnell-backtrack%2Finfo&PV_WbSrvRqsTms=01%2F05%2F12%2012%3A20%3A12%20AM&PV_HTTPQryStr=linkin_id%3D8068691&PV_WghGrpID=1&PV_NvgGrpID=1&PV_WbSrvIP=10.59.8.51&PV_LI_RslFrmID=1398&DS_FrDlsAvl=0&DS_FrDlsFlt=0&DS_FrDlsDsp=0&DS_FrMrcDsp=0&DS_FrMrcFlt=0&DS_MxDlsDsp=0&DS_UsrActTyp=DD&DS_RslPgNmb=1&DS_MnfID=12702&DS_MrcInPg=448775%5E300751%5E301531%5E40085%5E301531%5E301531%5E448775%5E301531%5E448775%5E40085%5E448775%5E448775%5E448775%5E448775%5E332196%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E448775%5E464756&DS_NmbTrsMrc=13&DS_NmbAthRsl=0&DS_NmbMrcGrp=0&DS_NmbDlsInPg=0&DS_FrsRslNmb=1&DS_LstRslNmb=0&RRW_NmRslRvw=0&RRW_PrdID=111963271&PV_ClkLnkTyp=&PV_DspDlsLng=&PV_LI_SbmFrmID=&PV_LI_SbmPrd=&PV_LI_RslKyw=&PV_LI_RslPrd=&PV_ChnPgNm=&PV_HPMrcNm=&DS_Zp=&DS_DlSrcKyw=&DS_IsSkp=&DS_SkpFrmEvn=&DS_SkpRt=&DS_CtgRnk=&DS_CtgRnkAlg=&DS_PrdTyp=&DS_MtQry=&RRW_MrchID=&RRW_RvwID=" width="2" height="2" alt="" /></p></noscript></div><div class="intScr intScrWide"><table id="topLeaderBoardArea" cellspacing="0" cellpadding="0" class="genAdBanner" align="center"><tr><td align="center"> <iframe id="doubleClickAds1" name="doubleClickAds1" class="adContainer" src="about:blank" width="728" height="90" marginwidth="0" marginheight="0" frameborder="0" scrolling="no" allowtransparency="true"></iframe><a class="adChoice hide" onclick="adSensePopUp('http://cgi6.ebay.com/ws/eBayISAPI.dll?AdPreferenceInterstitialPopup&partner=2');" href="javascript:void(0);">AdChoice<span class="sdcSprite iAdChoice"></span></a></td></tr></table><div class="innerScr"><div id="navigation"><div class="navInner"><ul id="outerNav"><li class="last" ><div class="ieFilterWrap"><a ><span class="tabText">Shop By Department</span><span class="sdcSprite iNavArrowDown"></span></a></div><ul class="mainNav"><li><a href="/xCH-clothing_and_accessories" target="_top"><span class="tabText">Clothing</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/clothing/181007-women/products" target="_top">Women</a></li><li><a href="/clothing/10089-men/products" target="_top">Men</a></li><li><a href="/clothing/ap-gender-age-girls/products" target="_top">Girls</a></li><li><a href="/clothing/ap-gender-age-boys/products" target="_top">Boys</a></li><li><a href="/clothing/ap-gender-age-infants-and-toddlers/products" target="_top">Infants and Toddlers</a></li><li><a href="/xCH-clothing_and_accessories" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/shoes/products" target="_top"><span class="tabText">Shoes</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/shoes/sh-gender-and-age-womens/products" target="_top">Womens</a></li><li><a href="/shoes/sh-gender-and-age-mens/products" target="_top">Mens</a></li><li><a href="/shoes/sh-gender-and-age-infants-and-toddlers/products" target="_top">Kids</a></li><li><a href="/shoes/products" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-computers" target="_top"><span class="tabText">Computers</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/cartridges-and-toners/products" target="_top">Cartridges and Toners</a></li><li><a href="/memory-cards/products" target="_top">Flash Memory</a></li><li><a href="/monitors/products" target="_top">Monitors</a></li><li><a href="/laptops/products" target="_top">PC Laptops</a></li><li><a href="/pdas/products" target="_top">PDAs</a></li><li><a href="/printers/products" target="_top">Printers</a></li><li><a href="/xCH-software" target="_top">Software</a></li><li><a href="/xCH-computers" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-electronics" target="_top"><span class="tabText">Electronics</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/camcorders/products" target="_top">Camcorders</a></li><li><a href="/cellular-phones/products" target="_top">Cellular Phones</a></li><li><a href="/digital-cameras/products" target="_top">Digital Cameras</a></li><li><a href="/gps-devices/products" target="_top">GPS Devices</a></li><li><a href="/mp3-players/products" target="_top">MP3 Players</a></li><li><a href="/flat-panel-televisions/products" target="_top">Flat Panel Televisions</a></li><li><a href="/home-theater-speakers-and-subwoofers/products" target="_top">Speakers and Subwoofers</a></li><li><a href="/sc/buying-guides" target="_top">Buying Guides</a></li><li><a href="/xCH-electronics" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-home_and_garden" target="_top"><span class="tabText">At Home</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/furniture/products" target="_top">Furniture</a></li><li><a href="/garden/products" target="_top">Garden</a></li><li><a href="/home-furnishing/products" target="_top">Home Furnishings</a></li><li><a href="/xCH-homeandgarden_kitchen" target="_top">Kitchen</a></li><li><a href="/xCH-pets" target="_top">Pet Supplies</a></li><li><a href="/building-supplies/products" target="_top">Building Supplies</a></li><li><a href="/xCH-home_and_garden" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-health_and_beauty" target="_top"><span class="tabText">Health</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/cosmetics/products" target="_top">Cosmetics</a></li><li><a href=&q..
Apache Coyote Version Disclosure
Apache Coyote Version Disclosure
Netsparker identified that the target web server is disclosing Apache Coyote version in the HTTP response. This information can help an attacker to gain a greater understanding of the systems in use and potentially develop further attacks targeted at the specific version of Apache.
Impact
An attacker can look for specific security vulnerabilities for the version identified in the SERVER header. The attacker can also use this information in conjunction with the other vulnerabilities in the application or the web server.
Configure your web server to prevent information leakage from the SERVER header of its HTTP response.
Classification
|
- /bushnell-backtrack/info
|
Apache-Coyote/1.1
Request
GET /bushnell-backtrack/info HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Cache-Control: no-cache
Accept-Encoding: gzip, deflate,gzip, deflate
Host: www.shopping.com
Response
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=0EA9D54A24A97E143C657353DF78249C; Path=/,session=rvi%3D111963271%255EBushnell%2520BACKTRACK%2520GPS%2520Receiver%255E44.95%255Ebushnell-backtrack%255E1325740811618%2521%253A%2521%5ESRID%3DBBo5p3viqI%5EPVS%3D1%5Ets%3D2; Domain=.shopping.com; Path=/,reloadCheck=%2Fbushnell-backtrack%2Finfo%3Fsb%3D1null; Domain=.shopping.com; Path=/,pdscookie=0%3A%3A%3A%3A%3A%3A1398%3A%3A%3A%3A111963271%3A%3A%3A%3A%3A%3A%3A%3A2%3A%3A1; Domain=.shopping.com; Path=/,perm=countryCode%3Dus; Domain=.shopping.com; Expires=Tue, 04-Jan-2022 05:20:11 GMT; Path=/,DealTimeUserID=ibElE25Fig; Domain=.shopping.com; Expires=Tue, 04-Jan-2022 05:20:11 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Vary: Accept-Encoding
Date: Thu, 05 Jan 2012 05:20:11 GMT
Connection: close
Content-Length: 120573
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xml:lang="en" lang="en"><head><script>var debugStartTime = new Date().getTime();var clogd = false; // console log debug levelfunction debugGetTimeDelta() {return new Date().getTime() - debugStartTime;}function consoleLog(msg) {if (typeof(console) != "undefined" && clogd) {console.log(debugGetTimeDelta() + " " + msg);}}function consoleLogNoTime(msg) {if (typeof(console) != "undefined" && clogd) {console.log(msg);}}</script><script>function appendScriptToHead(scriptUri) {var a = document.createElement("script");a.type="text/javascript";document.getElementsByTagName("head")[0].appendChild(a);a.src= scriptUri;}consoleLog("pagetype [ productOverview ]");consoleLog("sitespeedv2 [ YES ]");</script><meta http-equiv="X-UA-Compatible" content="IE=7" /><meta http-equiv="content-type" content="text/html; charset=UTF-8"/><meta http-equiv="Content-language" content="en"/><title>Bushnell BACKTRACK GPS Receiver - GPS Devices - Product Reviews and Prices - Shopping.com</title><meta name="title" content="Bushnell BACKTRACK GPS Receiver - GPS Devices - Product Reviews and Prices - Shopping.com"/><meta name="description" content="Bushnell BACKTRACK Overview, Features, and Description. Bushnell 360053 GPS BackTrack Personal Locator Tech Gray. - Store and locate up to 3 locations. - Provides distance and direction back. - Utilizes the latest technology. - High-sensitivity SiRF&#174; Star III GPS receiver. - Self-calibrating digital compass. - Weather resistant. - Operates on 2 AAA batteries (not included). - Compact size stores easily in your pocket or purse. - Lanyard included for easy attachment. This Bundle Also Includes : - Digital Point and Shoot Case. - Duracell AAA Alkaline Battery Retail Pack.."/><meta name="KEYWORDS" content="Bushnell BACKTRACK GPS Receiver, , GPS Devices, Handheld Electronics, Electronics, Shopping.com"/><meta name="SKYPE_TOOLBAR" content="SKYPE_TOOLBAR_PARSER_COMPATIBLE" /><meta name="robots" content="NOODP" /><meta name="msvalidate.01" content="D3229F8896DA563A3B0BED38FF19D6BC"/><meta name="y_key" content="7bca370a0704da9e"/><link rel="SHORTCUT ICON" type="image/x-icon" href="/favicon.ico"/><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/build/global-productPages-US-all-min.css"/><script>var gTopJsFileName = "singleModelPage-US-all-min.js";</script><script type="text/javascript" src="http://img.shopping.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/js/singleModelPage-US-all-min.js"></script><!--[if IE]><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/sdc/sdcIe.css"/><![endif]--><!--[if IE 6]><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/sdc/sdcIe6.css"/><![endif]--><script type="text/javascript">var showTooltipFeature = false;var domain = ".shopping.com";var RecaptchaOptions = {theme : 'custom'};var pageDataLocale = "en_US"; var brandPop2ndOffset = 30;var brandTopArrow2ndOffset = 20;var brandBtmArrow2ndOffset = 0; var gOmnitureEnabled = true;var gOmnitureEnv = "shopping";var glogd = false;var gloga = false; // localized url suffixvar UrlSuffix = {PRODUCTS:'products',INFO:'info',REVIEWS:'reviews',PRICES:'prices',LISTS:'lists',PRICE_ALERTS:'pricealerts'};var gIsSuffixedUrl = true;var gSearchPageTypePrefix = '';var LocalizedText = {searchQuestion: 'What are you shopping for?' };var fbConnectApiKey = '352830106610';var omniture_env = 'shopping';var omniPageName = 'Product Overview (PSPO)';var matchedReviewPublishToFb = 'false';var matchedSpotlightPublishToFb = 'false';var adsLazyLoadLevel = 'BELOW_FOLD'; var isSN;var userId;var userName;var visibility;var clientSiteId = '1';var fb_loggedInUser;var sameSes;var fb_session_key;var fb_session_secret;var fbSessionSession;var fbConnectStatusEnum = {'Disconnected':'0','Connected_Confirm_Publish':'1','Connected_Auto_Publish':'2','Connected_No_Publish':'3'};isSN=0;var browserWidthCookie = false;var VisualSearch = {title: 'Similar Items' };var Comments = {total: 'Comments' };</script><link rel="canonical" id="canonical" href="http://www.shopping.com/bushnell-backtrack/info"/> <script type="text/javascript">var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-23132118-1']);_gaq.push(['_setDomainName', '.shopping.com']);_gaq.push(['_trackPageview']);_gaq.push(['_trackPageLoadTime']);(function() {consoleLog("google analytics");var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body id="productOverview"> <div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;" ></div><div id="emailShareMask"></div><script type="text/javascript">function cguidJsonpCallback(resp) {consoleLog("cguid jsonp callback ["+resp.data+"]");setPdsAttributeEbayData(resp.data);}if (typeof(deferredFunctions) != "undefined") {$(window).load(function() {//consoleLog("STAGING - no cguid pds call");jQuery.getJSON("http://rover.ebay.com/idmap/1?pid=ussdc10&site=0&psv=&m=1325740811619&callback=?");});} else {//consoleLog("STAGING - no cguid pds call");jQuery.getJSON("http://rover.ebay.com/idmap/1?pid=ussdc10&site=0&psv=&m=1325740811619&callback=?");}</script><script type="text/javascript">consoleLog("pdsAttributeData (server) []");</script><script>consoleLog("votf");</script><div class="hide"><script type="text/javascript"><!--abc = Math.random() + '';pixelUrl = "http://stat.dealtime.com/pixel/" + abc.substring(2,11) + "?" + "PV_NmWlDs=&PV_PgVwID=btUGzND8qg&PV_BrnID=3993&PV_FrmID=1398&PV_EvnTyp=PV%5ERRW%5EDS&PV_SrvPgTyp=PSPO&PV_LI_LnkInID=&PV_LI_IsLnkInID=N&PV_HTTPTrg=%2Fbushnell-backtrack%2Finfo&PV_LI_PrtTrm=&PV_LI_SbmKyw=&PV_StBhvID=124632&PV_ErrCd=&PV_DmnUsr=ibElE25Fig&PV_SrvDsp=&PV_SrvRsl=&PV_DspStLng=1&PV_TstCnfId=&PV_Cmt_MmbID=&PV_Cmt_SgnIn=0&PV_Cmt_CntTypID=8&PV_Cmt_CntID=&PV_PrdID=111963271&DS_DlSrcID=BBo5p3viqI&DS_ClkLnkTyp=&DS_PrdID=111963271&DS_PrcMn=44.95&DS_PrcMx=99&DS_NmbMrcInPg=0&DS_NmbRslDls=25&DS_NmFtrDls=0&DS_IsSmrBy=1&PV_HTTPRfr=&PV_WbSrvRqsTms=01%2F05%2F12%2012%3A20%3A11%20AM&PV_HTTPQryStr=sb%3D1&PV_WghGrpID=178&PV_NvgGrpID=1&PV_WbSrvIP=10.59.9.97&PV_LI_RslFrmID=1398&DS_FrDlsAvl=0&DS_FrDlsFlt=0&DS_FrDlsDsp=0&DS_FrMrcDsp=0&DS_FrMrcFlt=0&DS_MxDlsDsp=0&DS_UsrActTyp=DD&DS_RslPgNmb=1&DS_MnfID=12702&DS_MrcInPg=448775%5E300751%5E301531%5E40085%5E301531%5E301531%5E448775%5E301531%5E448775%5E40085%5E448775%5E448775%5E448775%5E448775%5E332196%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E448775%5E464756&DS_NmbTrsMrc=13&DS_NmbAthRsl=0&DS_NmbMrcGrp=0&DS_NmbDlsInPg=0&DS_FrsRslNmb=1&DS_LstRslNmb=0&RRW_NmRslRvw=0&RRW_PrdID=111963271&PV_ClkLnkTyp=&PV_DspDlsLng=&PV_LI_SbmFrmID=&PV_LI_SbmPrd=&PV_LI_RslKyw=&PV_LI_RslPrd=&PV_ChnPgNm=&PV_HPMrcNm=&DS_Zp=&DS_DlSrcKyw=&DS_IsSkp=&DS_SkpFrmEvn=&DS_SkpRt=&DS_CtgRnk=&DS_CtgRnkAlg=&DS_PrdTyp=&DS_MtQry=&RRW_MrchID=&RRW_RvwID=";document.write('<img src="' + pixelUrl + '" width="2" height="2" alt=""/>');//--></script><noscript><p class="abso"><img src="http://stat.dealtime.com/pixel/noscript?PV_NmWlDs=&PV_PgVwID=btUGzND8qg&PV_BrnID=3993&PV_FrmID=1398&PV_EvnTyp=PV%5ERRW%5EDS&PV_SrvPgTyp=PSPO&PV_LI_LnkInID=&PV_LI_IsLnkInID=N&PV_HTTPTrg=%2Fbushnell-backtrack%2Finfo&PV_LI_PrtTrm=&PV_LI_SbmKyw=&PV_StBhvID=124632&PV_ErrCd=&PV_DmnUsr=ibElE25Fig&PV_SrvDsp=&PV_SrvRsl=&PV_DspStLng=1&PV_TstCnfId=&PV_Cmt_MmbID=&PV_Cmt_SgnIn=0&PV_Cmt_CntTypID=8&PV_Cmt_CntID=&PV_PrdID=111963271&DS_DlSrcID=BBo5p3viqI&DS_ClkLnkTyp=&DS_PrdID=111963271&DS_PrcMn=44.95&DS_PrcMx=99&DS_NmbMrcInPg=0&DS_NmbRslDls=25&DS_NmFtrDls=0&DS_IsSmrBy=1&PV_HTTPRfr=&PV_WbSrvRqsTms=01%2F05%2F12%2012%3A20%3A11%20AM&PV_HTTPQryStr=sb%3D1&PV_WghGrpID=178&PV_NvgGrpID=1&PV_WbSrvIP=10.59.9.97&PV_LI_RslFrmID=1398&DS_FrDlsAvl=0&DS_FrDlsFlt=0&DS_FrDlsDsp=0&DS_FrMrcDsp=0&DS_FrMrcFlt=0&DS_MxDlsDsp=0&DS_UsrActTyp=DD&DS_RslPgNmb=1&DS_MnfID=12702&DS_MrcInPg=448775%5E300751%5E301531%5E40085%5E301531%5E301531%5E448775%5E301531%5E448775%5E40085%5E448775%5E448775%5E448775%5E448775%5E332196%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E448775%5E464756&DS_NmbTrsMrc=13&DS_NmbAthRsl=0&DS_NmbMrcGrp=0&DS_NmbDlsInPg=0&DS_FrsRslNmb=1&DS_LstRslNmb=0&RRW_NmRslRvw=0&RRW_PrdID=111963271&PV_ClkLnkTyp=&PV_DspDlsLng=&PV_LI_SbmFrmID=&PV_LI_SbmPrd=&PV_LI_RslKyw=&PV_LI_RslPrd=&PV_ChnPgNm=&PV_HPMrcNm=&DS_Zp=&DS_DlSrcKyw=&DS_IsSkp=&DS_SkpFrmEvn=&DS_SkpRt=&DS_CtgRnk=&DS_CtgRnkAlg=&DS_PrdTyp=&DS_MtQry=&RRW_MrchID=&RRW_RvwID=" width="2" height="2" alt="" /></p></noscript></div><div class="intScr "><table id="topLeaderBoardArea" cellspacing="0" cellpadding="0" class="genAdBanner" align="center"><tr><td align="center"> <iframe id="doubleClickAds1" name="doubleClickAds1" class="adContainer" src="about:blank" width="728" height="90" marginwidth="0" marginheight="0" frameborder="0" scrolling="no" allowtransparency="true"></iframe><a class="adChoice hide" onclick="adSensePopUp('http://cgi6.ebay.com/ws/eBayISAPI.dll?AdPreferenceInterstitialPopup&partner=2');" href="javascript:void(0);">AdChoice<span class="sdcSprite iAdChoice"></span></a></td></tr></table><div class="innerScr"><div id="navigation"><div class="navInner"><ul id="outerNav"><li class="last" ><div class="ieFilterWrap"><a ><span class="tabText">Shop By Department</span><span class="sdcSprite iNavArrowDown"></span></a></div><ul class="mainNav"><li><a href="/xCH-clothing_and_accessories" target="_top"><span class="tabText">Clothing</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/clothing/181007-women/products" target="_top">Women</a></li><li><a href="/clothing/10089-men/products" target="_top">Men</a></li><li><a href="/clothing/ap-gender-age-girls/products" target="_top">Girls</a></li><li><a href="/clothing/ap-gender-age-boys/products" target="_top">Boys</a></li><li><a href="/clothing/ap-gender-age-infants-and-toddlers/products" target="_top">Infants and Toddlers</a></li><li><a href="/xCH-clothing_and_accessories" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/shoes/products" target="_top"><span class="tabText">Shoes</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/shoes/sh-gender-and-age-womens/products" target="_top">Womens</a></li><li><a href="/shoes/sh-gender-and-age-mens/products" target="_top">Mens</a></li><li><a href="/shoes/sh-gender-and-age-infants-and-toddlers/products" target="_top">Kids</a></li><li><a href="/shoes/products" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-computers" target="_top"><span class="tabText">Computers</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/cartridges-and-toners/products" target="_top">Cartridges and Toners</a></li><li><a href="/memory-cards/products" target="_top">Flash Memory</a></li><li><a href="/monitors/products" target="_top">Monitors</a></li><li><a href="/laptops/products" target="_top">PC Laptops</a></li><li><a href="/pdas/products" target="_top">PDAs</a></li><li><a href="/printers/products" target="_top">Printers</a></li><li><a href="/xCH-software" target="_top">Software</a></li><li><a href="/xCH-computers" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-electronics" target="_top"><span class="tabText">Electronics</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/camcorders/products" target="_top">Camcorders</a></li><li><a href="/cellular-phones/products" target="_top">Cellular Phones</a></li><li><a href="/digital-cameras/products" target="_top">Digital Cameras</a></li><li><a href="/gps-devices/products" target="_top">GPS Devices</a></li><li><a href="/mp3-players/products" target="_top">MP3 Players</a></li><li><a href="/flat-panel-televisions/products" target="_top">Flat Panel Televisions</a></li><li><a href="/home-theater-speakers-and-subwoofers/products" target="_top">Speakers and Subwoofers</a></li><li><a href="/sc/buying-guides" target="_top">Buying Guides</a></li><li><a href="/xCH-electronics" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-home_and_garden" target="_top"><span class="tabText">At Home</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/furniture/products" target="_top">Furniture</a></li><li><a href="/garden/products" target="_top">Garden</a></li><li><a href="/home-furnishing/products" target="_top">Home Furnishings</a></li><li><a href="/xCH-homeandgarden_kitchen" target="_top">Kitchen</a></li><li><a href="/xCH-pets" target="_top">Pet Supplies</a></li><li><a href="/building-supplies/products" target="_top">Building Supplies</a></li><li><a href="/xCH-home_and_garden" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-health_and_beauty" target="_top"><span class="tabText">Health</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/cosmetics/products" target="_top">Cosmetics</a></li><li><a href="/fragrance/products" target="_top">Fragrances</a></li><li><a h..
[Possible] Internal IP Address Leakage
[Possible] Internal IP Address Leakage
Netsparker discovered an internal IP address in the page. It was not determined if the IP address was that of the system itself or that of an internal network.
Impact
This kind of information can be useful for an attacker when combined with other vulnerabilities.
First ensure that this is not a false positive. Due to the nature of the issue. Netsparker could not confirm that this IP address was actually the real internal IP address of the target web server or internal network. If it is then consider removing it.
Classification
|
- /bushnell-backtrack/info
|
10.59.9.97
Request
GET /bushnell-backtrack/info HTTP/1.1
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1; .NET CLR 1.1.4322; .NET CLR 2.0.50727; .NET CLR 3.0.04506.30)
Cache-Control: no-cache
Accept-Encoding: gzip, deflate,gzip, deflate
Host: www.shopping.com
Response
HTTP/1.1 200 OK
Server: Apache-Coyote/1.1
Set-Cookie: JSESSIONID=0EA9D54A24A97E143C657353DF78249C; Path=/,session=rvi%3D111963271%255EBushnell%2520BACKTRACK%2520GPS%2520Receiver%255E44.95%255Ebushnell-backtrack%255E1325740811618%2521%253A%2521%5ESRID%3DBBo5p3viqI%5EPVS%3D1%5Ets%3D2; Domain=.shopping.com; Path=/,reloadCheck=%2Fbushnell-backtrack%2Finfo%3Fsb%3D1null; Domain=.shopping.com; Path=/,pdscookie=0%3A%3A%3A%3A%3A%3A1398%3A%3A%3A%3A111963271%3A%3A%3A%3A%3A%3A%3A%3A2%3A%3A1; Domain=.shopping.com; Path=/,perm=countryCode%3Dus; Domain=.shopping.com; Expires=Tue, 04-Jan-2022 05:20:11 GMT; Path=/,DealTimeUserID=ibElE25Fig; Domain=.shopping.com; Expires=Tue, 04-Jan-2022 05:20:11 GMT; Path=/
Content-Type: text/html;charset=UTF-8
Content-Language: en-US
Vary: Accept-Encoding
Date: Thu, 05 Jan 2012 05:20:11 GMT
Connection: close
Content-Length: 120573
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN""http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml" xmlns:fb="http://www.facebook.com/2008/fbml" xml:lang="en" lang="en"><head><script>var debugStartTime = new Date().getTime();var clogd = false; // console log debug levelfunction debugGetTimeDelta() {return new Date().getTime() - debugStartTime;}function consoleLog(msg) {if (typeof(console) != "undefined" && clogd) {console.log(debugGetTimeDelta() + " " + msg);}}function consoleLogNoTime(msg) {if (typeof(console) != "undefined" && clogd) {console.log(msg);}}</script><script>function appendScriptToHead(scriptUri) {var a = document.createElement("script");a.type="text/javascript";document.getElementsByTagName("head")[0].appendChild(a);a.src= scriptUri;}consoleLog("pagetype [ productOverview ]");consoleLog("sitespeedv2 [ YES ]");</script><meta http-equiv="X-UA-Compatible" content="IE=7" /><meta http-equiv="content-type" content="text/html; charset=UTF-8"/><meta http-equiv="Content-language" content="en"/><title>Bushnell BACKTRACK GPS Receiver - GPS Devices - Product Reviews and Prices - Shopping.com</title><meta name="title" content="Bushnell BACKTRACK GPS Receiver - GPS Devices - Product Reviews and Prices - Shopping.com"/><meta name="description" content="Bushnell BACKTRACK Overview, Features, and Description. Bushnell 360053 GPS BackTrack Personal Locator Tech Gray. - Store and locate up to 3 locations. - Provides distance and direction back. - Utilizes the latest technology. - High-sensitivity SiRF&#174; Star III GPS receiver. - Self-calibrating digital compass. - Weather resistant. - Operates on 2 AAA batteries (not included). - Compact size stores easily in your pocket or purse. - Lanyard included for easy attachment. This Bundle Also Includes : - Digital Point and Shoot Case. - Duracell AAA Alkaline Battery Retail Pack.."/><meta name="KEYWORDS" content="Bushnell BACKTRACK GPS Receiver, , GPS Devices, Handheld Electronics, Electronics, Shopping.com"/><meta name="SKYPE_TOOLBAR" content="SKYPE_TOOLBAR_PARSER_COMPATIBLE" /><meta name="robots" content="NOODP" /><meta name="msvalidate.01" content="D3229F8896DA563A3B0BED38FF19D6BC"/><meta name="y_key" content="7bca370a0704da9e"/><link rel="SHORTCUT ICON" type="image/x-icon" href="/favicon.ico"/><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/build/global-productPages-US-all-min.css"/><script>var gTopJsFileName = "singleModelPage-US-all-min.js";</script><script type="text/javascript" src="http://img.shopping.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/js/singleModelPage-US-all-min.js"></script><!--[if IE]><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/sdc/sdcIe.css"/><![endif]--><!--[if IE 6]><link rel="stylesheet" type="text/css" href="http://img.shoppingshadow.com/jfe/JavaFrontEnd-fe113.ebaylinks.p3-6368/css/sdc/sdcIe6.css"/><![endif]--><script type="text/javascript">var showTooltipFeature = false;var domain = ".shopping.com";var RecaptchaOptions = {theme : 'custom'};var pageDataLocale = "en_US"; var brandPop2ndOffset = 30;var brandTopArrow2ndOffset = 20;var brandBtmArrow2ndOffset = 0; var gOmnitureEnabled = true;var gOmnitureEnv = "shopping";var glogd = false;var gloga = false; // localized url suffixvar UrlSuffix = {PRODUCTS:'products',INFO:'info',REVIEWS:'reviews',PRICES:'prices',LISTS:'lists',PRICE_ALERTS:'pricealerts'};var gIsSuffixedUrl = true;var gSearchPageTypePrefix = '';var LocalizedText = {searchQuestion: 'What are you shopping for?' };var fbConnectApiKey = '352830106610';var omniture_env = 'shopping';var omniPageName = 'Product Overview (PSPO)';var matchedReviewPublishToFb = 'false';var matchedSpotlightPublishToFb = 'false';var adsLazyLoadLevel = 'BELOW_FOLD'; var isSN;var userId;var userName;var visibility;var clientSiteId = '1';var fb_loggedInUser;var sameSes;var fb_session_key;var fb_session_secret;var fbSessionSession;var fbConnectStatusEnum = {'Disconnected':'0','Connected_Confirm_Publish':'1','Connected_Auto_Publish':'2','Connected_No_Publish':'3'};isSN=0;var browserWidthCookie = false;var VisualSearch = {title: 'Similar Items' };var Comments = {total: 'Comments' };</script><link rel="canonical" id="canonical" href="http://www.shopping.com/bushnell-backtrack/info"/> <script type="text/javascript">var _gaq = _gaq || [];_gaq.push(['_setAccount', 'UA-23132118-1']);_gaq.push(['_setDomainName', '.shopping.com']);_gaq.push(['_trackPageview']);_gaq.push(['_trackPageLoadTime']);(function() {consoleLog("google analytics");var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);})();</script></head><body id="productOverview"> <div id="FB_HiddenContainer" style="position:absolute; top:-10000px; width:0px; height:0px;" ></div><div id="emailShareMask"></div><script type="text/javascript">function cguidJsonpCallback(resp) {consoleLog("cguid jsonp callback ["+resp.data+"]");setPdsAttributeEbayData(resp.data);}if (typeof(deferredFunctions) != "undefined") {$(window).load(function() {//consoleLog("STAGING - no cguid pds call");jQuery.getJSON("http://rover.ebay.com/idmap/1?pid=ussdc10&site=0&psv=&m=1325740811619&callback=?");});} else {//consoleLog("STAGING - no cguid pds call");jQuery.getJSON("http://rover.ebay.com/idmap/1?pid=ussdc10&site=0&psv=&m=1325740811619&callback=?");}</script><script type="text/javascript">consoleLog("pdsAttributeData (server) []");</script><script>consoleLog("votf");</script><div class="hide"><script type="text/javascript"><!--abc = Math.random() + '';pixelUrl = "http://stat.dealtime.com/pixel/" + abc.substring(2,11) + "?" + "PV_NmWlDs=&PV_PgVwID=btUGzND8qg&PV_BrnID=3993&PV_FrmID=1398&PV_EvnTyp=PV%5ERRW%5EDS&PV_SrvPgTyp=PSPO&PV_LI_LnkInID=&PV_LI_IsLnkInID=N&PV_HTTPTrg=%2Fbushnell-backtrack%2Finfo&PV_LI_PrtTrm=&PV_LI_SbmKyw=&PV_StBhvID=124632&PV_ErrCd=&PV_DmnUsr=ibElE25Fig&PV_SrvDsp=&PV_SrvRsl=&PV_DspStLng=1&PV_TstCnfId=&PV_Cmt_MmbID=&PV_Cmt_SgnIn=0&PV_Cmt_CntTypID=8&PV_Cmt_CntID=&PV_PrdID=111963271&DS_DlSrcID=BBo5p3viqI&DS_ClkLnkTyp=&DS_PrdID=111963271&DS_PrcMn=44.95&DS_PrcMx=99&DS_NmbMrcInPg=0&DS_NmbRslDls=25&DS_NmFtrDls=0&DS_IsSmrBy=1&PV_HTTPRfr=&PV_WbSrvRqsTms=01%2F05%2F12%2012%3A20%3A11%20AM&PV_HTTPQryStr=sb%3D1&PV_WghGrpID=178&PV_NvgGrpID=1&PV_WbSrvIP=
10.59.9.97&PV_LI_RslFrmID=1398&DS_FrDlsAvl=0&DS_FrDlsFlt=0&DS_FrDlsDsp=0&DS_FrMrcDsp=0&DS_FrMrcFlt=0&DS_MxDlsDsp=0&DS_UsrActTyp=DD&DS_RslPgNmb=1&DS_MnfID=12702&DS_MrcInPg=448775%5E300751%5E301531%5E40085%5E301531%5E301531%5E448775%5E301531%5E448775%5E40085%5E448775%5E448775%5E448775%5E448775%5E332196%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E448775%5E464756&DS_NmbTrsMrc=13&DS_NmbAthRsl=0&DS_NmbMrcGrp=0&DS_NmbDlsInPg=0&DS_FrsRslNmb=1&DS_LstRslNmb=0&RRW_NmRslRvw=0&RRW_PrdID=111963271&PV_ClkLnkTyp=&PV_DspDlsLng=&PV_LI_SbmFrmID=&PV_LI_SbmPrd=&PV_LI_RslKyw=&PV_LI_RslPrd=&PV_ChnPgNm=&PV_HPMrcNm=&DS_Zp=&DS_DlSrcKyw=&DS_IsSkp=&DS_SkpFrmEvn=&DS_SkpRt=&DS_CtgRnk=&DS_CtgRnkAlg=&DS_PrdTyp=&DS_MtQry=&RRW_MrchID=&RRW_RvwID=";document.write('<img src="' + pixelUrl + '" width="2" height="2" alt=""/>');//--></script><noscript><p class="abso"><img src="http://stat.dealtime.com/pixel/noscript?PV_NmWlDs=&PV_PgVwID=btUGzND8qg&PV_BrnID=3993&PV_FrmID=1398&PV_EvnTyp=PV%5ERRW%5EDS&PV_SrvPgTyp=PSPO&PV_LI_LnkInID=&PV_LI_IsLnkInID=N&PV_HTTPTrg=%2Fbushnell-backtrack%2Finfo&PV_LI_PrtTrm=&PV_LI_SbmKyw=&PV_StBhvID=124632&PV_ErrCd=&PV_DmnUsr=ibElE25Fig&PV_SrvDsp=&PV_SrvRsl=&PV_DspStLng=1&PV_TstCnfId=&PV_Cmt_MmbID=&PV_Cmt_SgnIn=0&PV_Cmt_CntTypID=8&PV_Cmt_CntID=&PV_PrdID=111963271&DS_DlSrcID=BBo5p3viqI&DS_ClkLnkTyp=&DS_PrdID=111963271&DS_PrcMn=44.95&DS_PrcMx=99&DS_NmbMrcInPg=0&DS_NmbRslDls=25&DS_NmFtrDls=0&DS_IsSmrBy=1&PV_HTTPRfr=&PV_WbSrvRqsTms=01%2F05%2F12%2012%3A20%3A11%20AM&PV_HTTPQryStr=sb%3D1&PV_WghGrpID=178&PV_NvgGrpID=1&PV_WbSrvIP=
10.59.9.97&PV_LI_RslFrmID=1398&DS_FrDlsAvl=0&DS_FrDlsFlt=0&DS_FrDlsDsp=0&DS_FrMrcDsp=0&DS_FrMrcFlt=0&DS_MxDlsDsp=0&DS_UsrActTyp=DD&DS_RslPgNmb=1&DS_MnfID=12702&DS_MrcInPg=448775%5E300751%5E301531%5E40085%5E301531%5E301531%5E448775%5E301531%5E448775%5E40085%5E448775%5E448775%5E448775%5E448775%5E332196%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E301531%5E448775%5E464756&DS_NmbTrsMrc=13&DS_NmbAthRsl=0&DS_NmbMrcGrp=0&DS_NmbDlsInPg=0&DS_FrsRslNmb=1&DS_LstRslNmb=0&RRW_NmRslRvw=0&RRW_PrdID=111963271&PV_ClkLnkTyp=&PV_DspDlsLng=&PV_LI_SbmFrmID=&PV_LI_SbmPrd=&PV_LI_RslKyw=&PV_LI_RslPrd=&PV_ChnPgNm=&PV_HPMrcNm=&DS_Zp=&DS_DlSrcKyw=&DS_IsSkp=&DS_SkpFrmEvn=&DS_SkpRt=&DS_CtgRnk=&DS_CtgRnkAlg=&DS_PrdTyp=&DS_MtQry=&RRW_MrchID=&RRW_RvwID=" width="2" height="2" alt="" /></p></noscript></div><div class="intScr "><table id="topLeaderBoardArea" cellspacing="0" cellpadding="0" class="genAdBanner" align="center"><tr><td align="center"> <iframe id="doubleClickAds1" name="doubleClickAds1" class="adContainer" src="about:blank" width="728" height="90" marginwidth="0" marginheight="0" frameborder="0" scrolling="no" allowtransparency="true"></iframe><a class="adChoice hide" onclick="adSensePopUp('http://cgi6.ebay.com/ws/eBayISAPI.dll?AdPreferenceInterstitialPopup&partner=2');" href="javascript:void(0);">AdChoice<span class="sdcSprite iAdChoice"></span></a></td></tr></table><div class="innerScr"><div id="navigation"><div class="navInner"><ul id="outerNav"><li class="last" ><div class="ieFilterWrap"><a ><span class="tabText">Shop By Department</span><span class="sdcSprite iNavArrowDown"></span></a></div><ul class="mainNav"><li><a href="/xCH-clothing_and_accessories" target="_top"><span class="tabText">Clothing</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/clothing/181007-women/products" target="_top">Women</a></li><li><a href="/clothing/10089-men/products" target="_top">Men</a></li><li><a href="/clothing/ap-gender-age-girls/products" target="_top">Girls</a></li><li><a href="/clothing/ap-gender-age-boys/products" target="_top">Boys</a></li><li><a href="/clothing/ap-gender-age-infants-and-toddlers/products" target="_top">Infants and Toddlers</a></li><li><a href="/xCH-clothing_and_accessories" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/shoes/products" target="_top"><span class="tabText">Shoes</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/shoes/sh-gender-and-age-womens/products" target="_top">Womens</a></li><li><a href="/shoes/sh-gender-and-age-mens/products" target="_top">Mens</a></li><li><a href="/shoes/sh-gender-and-age-infants-and-toddlers/products" target="_top">Kids</a></li><li><a href="/shoes/products" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-computers" target="_top"><span class="tabText">Computers</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/cartridges-and-toners/products" target="_top">Cartridges and Toners</a></li><li><a href="/memory-cards/products" target="_top">Flash Memory</a></li><li><a href="/monitors/products" target="_top">Monitors</a></li><li><a href="/laptops/products" target="_top">PC Laptops</a></li><li><a href="/pdas/products" target="_top">PDAs</a></li><li><a href="/printers/products" target="_top">Printers</a></li><li><a href="/xCH-software" target="_top">Software</a></li><li><a href="/xCH-computers" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-electronics" target="_top"><span class="tabText">Electronics</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/camcorders/products" target="_top">Camcorders</a></li><li><a href="/cellular-phones/products" target="_top">Cellular Phones</a></li><li><a href="/digital-cameras/products" target="_top">Digital Cameras</a></li><li><a href="/gps-devices/products" target="_top">GPS Devices</a></li><li><a href="/mp3-players/products" target="_top">MP3 Players</a></li><li><a href="/flat-panel-televisions/products" target="_top">Flat Panel Televisions</a></li><li><a href="/home-theater-speakers-and-subwoofers/products" target="_top">Speakers and Subwoofers</a></li><li><a href="/sc/buying-guides" target="_top">Buying Guides</a></li><li><a href="/xCH-electronics" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-home_and_garden" target="_top"><span class="tabText">At Home</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/furniture/products" target="_top">Furniture</a></li><li><a href="/garden/products" target="_top">Garden</a></li><li><a href="/home-furnishing/products" target="_top">Home Furnishings</a></li><li><a href="/xCH-homeandgarden_kitchen" target="_top">Kitchen</a></li><li><a href="/xCH-pets" target="_top">Pet Supplies</a></li><li><a href="/building-supplies/products" target="_top">Building Supplies</a></li><li><a href="/xCH-home_and_garden" target="_top">See all...</a></li><li><a href="/brands" target="_top">Shop by Brands</a></li></ul></li><li><a href="/xCH-health_and_beauty" target="_top"><span class="tabText">Health</span> <span class="sdcSprite iNavArrowRight"></span></a><ul><li><a href="/cosmetics/products" target="_top">Cosmetics</a></li><li><a href="/fragrance/products" target="_top">Fragrances</a&..
