1. Cleartext submission of password
2. Password field with autocomplete enabled
3. Cross-domain script include
4. Cookie without HttpOnly flag set
Severity: | High |
Confidence: | Certain |
Host: | http://www.deniseaustin |
Path: | /exercises/triceps-chair |
GET /exercises/triceps-chair Host: www.deniseaustin.com Proxy-Connection: keep-alive Referer: http://www.everydayhealth User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16 Accept: application/xml Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* |
HTTP/1.1 200 OK Cache-Control: private Content-Length: 31959 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 Server-ID: : USNJWWEB03 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: .ASPXANONYMOUS=AcwXPQmse Set-Cookie: ASP.NET_SessionId Set-Cookie: FunnelCookie=0=442474125 Set-Cookie: FunnelCookie=0=442474125 Date: Sat, 12 Mar 2011 12:47:00 GMT <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR <html> <head id="head"><title> Denise Austin's Best Fitness Moves Fo ...[SNIP]... <body id="htmBody"> <form name="Form1" method="post" action="../publicsite <div> ...[SNIP]... <span id="quick_pass">Password: <input name="ctl00$uc_funneltop1 ...[SNIP]... |
Severity: | Low |
Confidence: | Certain |
Host: | http://www.deniseaustin |
Path: | /exercises/triceps-chair |
GET /exercises/triceps-chair Host: www.deniseaustin.com Proxy-Connection: keep-alive Referer: http://www.everydayhealth User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16 Accept: application/xml Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* |
HTTP/1.1 200 OK Cache-Control: private Content-Length: 31959 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 Server-ID: : USNJWWEB03 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: .ASPXANONYMOUS=AcwXPQmse Set-Cookie: ASP.NET_SessionId Set-Cookie: FunnelCookie=0=442474125 Set-Cookie: FunnelCookie=0=442474125 Date: Sat, 12 Mar 2011 12:47:00 GMT <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR <html> <head id="head"><title> Denise Austin's Best Fitness Moves Fo ...[SNIP]... <body id="htmBody"> <form name="Form1" method="post" action="../publicsite <div> ...[SNIP]... <span id="quick_pass">Password: <input name="ctl00$uc_funneltop1 ...[SNIP]... |
Severity: | Information |
Confidence: | Certain |
Host: | http://www.deniseaustin |
Path: | /exercises/triceps-chair |
GET /exercises/triceps-chair Host: www.deniseaustin.com Proxy-Connection: keep-alive Referer: http://www.everydayhealth User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16 Accept: application/xml Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* |
HTTP/1.1 200 OK Cache-Control: private Content-Length: 31959 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 Server-ID: : USNJWWEB03 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: .ASPXANONYMOUS=AcwXPQmse Set-Cookie: ASP.NET_SessionId Set-Cookie: FunnelCookie=0=442474125 Set-Cookie: FunnelCookie=0=442474125 Date: Sat, 12 Mar 2011 12:47:00 GMT <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR <html> <head id="head"><title> Denise Austin's Best Fitness Moves Fo ...[SNIP]... </script> <script language="javascript" type="text/javascript" src="http://tracking ...[SNIP]... </script> <script src='https://ssl.google ...[SNIP]... |
Severity: | Information |
Confidence: | Certain |
Host: | http://www.deniseaustin |
Path: | /exercises/triceps-chair |
GET /exercises/triceps-chair Host: www.deniseaustin.com Proxy-Connection: keep-alive Referer: http://www.everydayhealth User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.133 Safari/534.16 Accept: application/xml Accept-Encoding: gzip,deflate,sdch Accept-Language: en-US,en;q=0.8 Accept-Charset: ISO-8859-1,utf-8;q=0.7,* |
HTTP/1.1 200 OK Cache-Control: private Content-Length: 31959 Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/6.0 Server-ID: : USNJWWEB03 X-Powered-By: ASP.NET X-AspNet-Version: 2.0.50727 Set-Cookie: .ASPXANONYMOUS=AcwXPQmse Set-Cookie: ASP.NET_SessionId Set-Cookie: FunnelCookie=0=442474125 Set-Cookie: FunnelCookie=0=442474125 Date: Sat, 12 Mar 2011 12:47:00 GMT <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR <html> <head id="head"><title> Denise Austin's Best Fitness Moves Fo ...[SNIP]... |